BugCheck D1 error for mfefirek.sys (displays in blue screen dump after Host Intrusion Prevention 8.0 Patch 2 installation)

NOTES:

• Hotfix 833271 can be installed on either Host IPS 8.0 GA (8.0.0.1741) or Patch 1 (8.0.0.1919) systems before installing Patch 2 (8.0.0.2151).
• HF833271 will prevent systems installed with certain VPN filter drivers from incurring a D1 bug check after upgrading to Patch 2. Contact Technical Support and request Hotfix HostIPS_Client800_HotFix833271.zip for this issue.
  
  
  To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

  • If you are a registered user, type your User Id and Password, and then click Log In.
  • If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.
  
  
  IMPORTANT: The following files are required for Technical Support:
  • Minimum Escalation Requirements (MER) files for your specific product. For information about downloading the MERs for each McAfee product, see KB59385.
  • Other files and logs, as requested by Technical Support.

1. Delete all related packages from the first deployment branch.
   NOTE: Deletion of the existing packages from a repository branch is the only effective means to ensure that correct deployment detection script sequencing is maintained for multiple package deployments. 
    
2. Recheck the multiple packages into the new repository branch in the desired deployment order. 
3. To update specific client systems from specific ePO repository branches, change the McAfee Agent policy settings for those systems so that Host IPS updates are pulled from the Evaluation branch instead of the Current branch. To change the McAfee Agent policy settings, go to McAfee Agent, General, My Default, Updates.

1. Check in Host IPS 8.0 HF833271 to a designated branch of the ePO repository.
2. Check in Host IPS 8.0 Patch 2 (incremental update package) to a designated branch of the ePO repository.
3. Configure a product update task by first reviewing the list of selectable Patches and Service Packs (under Products, patches, service packs, etc. entry for Package types).
4. If the list includes more than one entry for Host IPS 8.0, ensure that all these entries are selected.
5. If your system is not fully updated after running the update task once, rerun it again to fully update systems with all packages. Product update tasks adhere to the following logic when updating a managed product: 
   • Install content updates.
   • Install an available hotfix update
   • Install an available patch update.

The first product update task installs Hotfix 833271 and Patch 2 (and only Hotfix 833271 for some networks). The next update task will install Patch 2. Customers might opt to do it by configuring a single product update task using the following options:

1. Configure a Daily product update task to run once per day. All packages will be deployed after 1 (or 2) successive days (or 1–2 runs of the product update task).
2. Configure multiple scheduled task times for a single update task. All packages will be deployed after 1 (or 2) successive product update tasks are completed.
3. Configure a product update task to repeat (McAfee recommends 30 minutes, or more, task intervals). All packages will be deployed after 2 (or 3) successive product update tasks are completed.

NOTE: McAfee also recommends using Task Randomization in large environments to reduce high periods of bandwidth consumption. 

Product Update tasks must be rerun on client systems not reporting the correct product version for Patch 2 (8.0.0.2151). 

If client systems are reporting product version 8.0.0.2481 (HF833271), the Product Update tasks must be rerun on client systems to install Patch 2. Contact Technical Support for further assistance if you have product update issues after multiple product update tasks have run on the systems.