Application Control 6.x Known Issues

605369

Issue: When Solidcore Agent installer is run by an agent installer with the /? argument, a series of unwanted dialog boxes appear due to a bug in the third-party packaging software. These dialog boxes can be ignored.

609311

Issue: Manual uninstallation of Solidcore Agent (deployed from ePO) fails on a client computer having McAfee Agent version 4.0 (or earlier).
Workaround: Contact Technical Support for assistance in case manual uninstallation has already been tried.

595570
595025
595511
595615
597243
598406
595043
607434
607899
611229

Issue: The following applications are incompatible with the Solidcore Agent for Windows. Contact Technical Support for further assistance.

• Panda Titanium anti-virus 2005
• Spyware Doctor
• BlackIce
• Trojan Hunter
• BitDefender
• BufferZone
• Twister Anti-Trojan Virus 2005
• Trend Micro OfficeScan 8.0, Trend Micro anti-virus 2008
• Double-Take
• Cisco Security Agent

594579

Issue: Unsolidified scripts cannot be copied using the MS-DOS command prompt on a solidified system. Any read access to unsolidified scripts by script interpreter configured for that script is denied. This denial generates unauthorized execution events. Such problems can be avoided by performing file operation using Windows Explorer.

594596
594770
595290

Issue: Antivirus software applications generate logs when the Solidcore Agent is enabled.
Workaround: Use appropriate applications as updaters.

594707

Issue: Roaming and Mandatory profiles with code files do not work properly. Copying files from Central store on domain controller to member server and back might fail.

594790

Issue: Solidcore Protection prevents updating of applications, such as Microsoft Office and Office tools after the initial installation. When executing the applications for the first time, Technical Support recommends that you run these applications in the Update Mode.

596425

Issue: Print server logs errors on Runtime Control module systems with the Solidcore Agent active in the Enabled mode.
Workaround: Add the printer share as a trusted share.

601158

Issue: The Runtime Control module uses MP-CASP as the default Memory Protection technique. If you want to enable MP-VASR, contact Technical Support.

607414

Issue: When script interpreters are added to memory protection bypass (casp or mangling-decoying), even after a script marked as an updater exits, the script interpreter’s updater privilege is not revoked.

608647

Issue: On 64-bit systems, multiple events might get generated when an unauthorized binary file is executed. The Windows operating system tries to run the binary multiple times by using reducing set of attributes until final failure.

609632

Issue: After the initial scan task completes and MAC Initial Scan task is complete and McAfee Application Control is enforced on the system now message displays, the system is said to be solidified.

608745

Issue: Files that are read-protected by the user (using 'sadmin read-protect' command) cannot be solidified.

624015

Issue: If enabled on a 64-bit computer, the memory protection feature prevents the installation of ActiveX.
Workaround: From the ePO console, complete the following steps to add the Internet Explorer executable (iexplore.exe) to the memory protection bypass list.

1. Log on to the ePO 4.x console.
2. Click Menu, Policy, Policy Catalog.
3. Select the Solidcore 5.1.0 General entry from the Product drop-down.
4. Select Exception Rules (Windows).
5. Click Duplicate for the McAfee Default policy, specify the policy name, and click OK.
6. Click the created policy and click Add.
7. Enter iexplorer.exe as the file name, select Bypassed from Memory Control, and click OK.
8. Click Save.
9. Apply the policy to the appropriate endpoints. 
10. From the endpoint, run ActiveX after adding the Internet Explorer executable (iexplore.exe) to the memory protection bypass list. Use the following command to add the executable to the bypass list. 
    
    sadmin attr add –n iexplore.exe

643688

Issue: If you try an ActiveX installation before enabling the ActiveX feature and retry the installation after enabling the ActiveX feature, the ActiveX might not get installed properly.
Workaround: If the ActiveX installation fails, delete all files in the <system drive>\windows\downloaded program files directory on the endpoint, remove all .cab files in the temporary Internet files. Now, install the ActiveX control on the endpoint.

602194

Issue: The package control feature is not able to stop the installation of some applications, such as Gvim and Winrar.

602929

Issue: If a package-based installer is executed before the package control feature can detect the package change, the deny-exec feature might prevent the execution of the installer.

607014

Issue: Adding a script as an updater twice (once on its own and again with its parent) might lead to ambiguous behavior.

616147

Issue: For standalone Solidcore Agent installation (in other words, installation not done via ePO) on endpoints where Oracle is installed, finetune.bat must be run manually at the endpoints to apply Oracle-specific rules.

595067

Issue: The system might hang while installing the security hotfix WindowsXP-KB884020-x86-enu.exe.
Workaround: Disable the Solidcore Agent before installing this hotfix.

598286

Issue: System hangs after installing Citrix MetaFrameXP with feature release 3.0.
Workaround: Add csrss.exe to bypass list.

599348

Issue: On viewing the properties of a file on the local drive, deny-write and deny-exec events are generated for the solidified and unsolidified files, respectively.

601126

Issue: When copying solidified files to a rewritable CD, although the files are copied successfully deny-write errors are logged.

601427

Issue: On 64-bit platforms, Enum or Performance in sub keys is bypassed from Solidcore Agent protection. Thus, when you delete a write-protected registry key with Enum or Performance in sub keys, you might get a partial completion status.

609812

Issue: For an ePO managed endpoint with a valid Application Control license for which the Initial Scan was deferred and that has many executable files installed, the Initial Scan client task after a reboot completes successfully. But, the system remains in Update mode for some time before going to Enabled mode. During this time, sending another client task to the endpoint might fail.

610206

Issue: The pop-up message regarding the completion of Initial Scan client task sent from ePO does not display on remote desktop sessions.

616089

Issue: In the output of sadmin diag command on the Spanish locale, read 'actualizadores agregar' as 'updaters add'.
For example, in the following output:

* actualizadores agregar -t DIAG: cmd.exe -p explorer.exe ""cmd.exe""

Read it as:

* updaters add -t DIAG: cmd.exe -p explorer.exe ""cmd.exe""

600748

Issue: Multiple deny write events might get generated for a single deny write action. 
Example: On deletion of a file using Windows Explorer, up to 8 file deletion events are reported. The reason is because when the application denies deletion of a file, Windows Explorer tries multiple other methods to delete the file, resulting in the generation of an event for each attempt.

724600

Issue: ActiveX alerts are not generated on 64-bit Windows systems.
Workaround: Complete these steps if you are using the ePO console:

1. Log on to the ePO 4.x. console.
2. Click Menu, Policy, Policy Catalog.
3. Select the Solidcore 6.0 General entry from the Product drop-down.
4. Select Exception Rules (Windows).
5. Click Duplicate for the McAfee Default policy, specify the policy name, and click OK.
6. Open the created policy and click Add.
7. Enter iexplore.exe as the file name, select Bypassed from Memory Control, and click OK.
8. Click Add.
9. Type ieinstal.exe as the file name, select Bypassed from Memory Control and click OK.
10. Click Save.
11. Apply the policy to the endpoints.

Complete these steps from the endpoint if you are using the product in Standalone mode.

1. Execute the following commands to define the required memory-protection bypass rules.
   
   sadmin attr add –n iexplore.exe
   sadmin attr add –n ieinstal.exe
2. Run ActiveX controls.

608639

Issue: After you uninstall the Solidcore client from the Windows (64-bit) operating system, the Solidcore folder (c: \program files(x86)\solidcore) and Registry link (HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates) remain on the endpoint.

695246

Issue: Although the Solidcore NX protection is based on system DEP, it is possible that some applications work with system DEP but not with Solidcore NX. In such cases, if processes are added to Solidcore NX bypass list, the system DEP protection is enabled for the processes.

720663

Issue: Editing the Updater Label for an existing trusted publisher in an Application Control policy fails. Although the label changes on the ePO console, the change is not reflected on the endpoints.

723624

Issue: Execution Denied events might be generated for some DLL files with searchprotocolhost.exe as the process name. These events have no functionality impact.
Workaround: If many events are generated, create an AEF rule to prune the events.

725204

Issue: For 6.0 release, the Yahoo, Adobe Acrobat, CuteFTP, and WinZip rule groups have been removed from the default Application Control policy because of their security implications. Also, when you upgrade, these rule groups are removed from the default policies. If needed, you need to add these rule groups to policies manually.

702580

Issue: For Application Control-related internal files (such as finetune.bat and gatherinfo.bat), version details including binary version, vendor, application name, and application version are not available.

713989

Issue: If Application Control and Spector are installed on an endpoint and MP-CASP is enabled, Internet Explorer crashes.

685124

Issue: If you are running VirusScan Enterprise (VSE) 8.8 with the Access Protection Level set to Maximum on an endpoint, you cannot deploy Solidcore on the endpoint.

652602

Issue: If you disable the deny-exec-exes feature on any Windows (64-bit) operating system, change extension of an exe to .sys, and try to run the .sys file, execution of the .sys file is prevented. You can change the file extension to dll to run the file even if the deny-exex-dlls feature is enabled as well.

713011

Issue: Observations are erroneously generated for 64-bit binary files that are not supported on 32-bit platforms.

607574

Issue: On opening a network share (for systems running Windows Vista, Windows 7, Windows 2008), deny-write and deny-exec events are generated for the binary files present on the network share. The events are generated because Windows Explorer tries to fetch the icons for the files stored on the network share.

726020

Issue: If you upgrade from an older release to the 6.0 release and use a command added or changed in the 6.0 release without restarting the endpoint, you might receive a Msg not found error. 
Workaround: Restart the endpoint to ensure that all commands added or changed in the 6.0 release work correctly.

608868

Issue: On the Windows 2008, Windows 7, and Windows Vista operating systems, you might receive the An unauthorized change made to the Windows error. 
Workaround: Disable the MP-CASP feature.

768708

Issue: Unable to set flag fs-passthru 'p' and flag vasr forced reloc 'v' together with extra info flag 'o' in the attr command.

770362

Issue: Unable to set more than one dll to bypass from VASR forced reloc.