McAfee Agent fails to update or deploy products due to an untrusted or unsigned DLL

Technical Articles ID: KB93263
Last Modified: 2/5/2021

Environment

McAfee Agent (MA) 5.7.x, 5.6.x

Problem

When the McAfee Agent runs a scheduled task that calls on the McScript_InUse.exe process, the task fails.

The masvc_computer_name.log records entries similar to the ones below:

NOTE: Default log location: C:\ProgramData\McAfee\Agent\logs\

masvc(3068.3148) Updater.Info: Script Event msg iEventId "0" iSeverity "0" iProductId "EPOAGENT3000" iLocale "0409" iUpdateType "N/A" iUpdateState "4" iUpdateError "26" iNewVersion "N/A" iDateTime "N/A" iCustomMessage ""
masvc(3068.3148) Updater.Debug: Script progress muecProgressEvent "4" Message "Update process failed"
masvc(3068.3148) Updater.Debug: Task summary xml : <Status><Code>-1</Code><TaskName>update</TaskName><Detail>Deployment/Update task failed, reason "Unable to find valid repository".</Detail><FailureReason></FailureReason></Status>.
masvc(3068.3148) scheduler.Info: The task update has failed

The McScript.log records entries similar to the ones below:g:

I #7924 network URL(https://myePO.lab2.local:443/Software/SiteStat.xml?hash={0d884446-e180-11ea-081e-2be48f0084e6}) request, failed with curl error 6, Response 0, Connect code 0,

I #7924 curl text 41 Could not resolve host: myePO.lab2.local

E #7924 downloader Downloading file from https://myePO.lab2.local:443/Software/SiteStat.xml?hash={0d884446-e180-11ea-081e-2be48f0084e6} to C:\WINDOWS\TEMP\SiteStat.xml failed.

I #7924 network URL(http://update.nai.com:80/Products/CommonUpdater/SiteStat.xml?hash={0eda3fb6-e180-11ea-19af-2be48f0084e6}) request, failed with curl error 6, Response 0, Connect code 0,

I #7924 curl text 39 Could not resolve host: update.nai.com

E #7924 downloader Downloading file from http://update.nai.com:80/Products/CommonUpdater/SiteStat.xml?hash={0eda3fb6-e180-11ea-19af-2be48f0084e6} to C:\WINDOWS\TEMP\SiteStat.xml failed

Cause

An untrusted or unsigned DLL is injecting into the Layered Service Provider (LSP) stack, and McAfee Arbitrary Access Control (AAC) rules are blocking the injector from hooking into McScript_InUse.

If you can download or view the sitestat.xml file from the affected system, look to see if there is an AAC block. Look for an injection in the mfemactl.log. Review the log for the time of the update or that the deployment task failed. Default location is: C:\ProgramData\McAfee\Agent\logs\mfemactl.log

Example

mfemactl(4704.5040) mfemactl.Info: The process <C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCSCRIPT_INUSE.EXE>(7136) was blocked from accessing('CREATE' (1)) <AAC_OBJECT_SECTION:C:\WINDOWS\SYSWOW64\ASPROXY.DLL> via the rule <Sanitize selected MA Processes>
mfemactl(4704.5040) mfemactl.Info: The process <C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCSCRIPT_INUSE.EXE>(7136) was blocked from accessing('CREATE' (1)) <AAC_OBJECT_SECTION:C:\WINDOWS\SYSWOW64\ASPROXY.DLL> via the rule <Sanitize selected MA Processes>

The above indicates both of the following has occurred:

An untrusted or unsigned DLL is injecting into the LSP stack.
McAfee AAC rules are blocking the injector from hooking into McScript_InUse.

Solution

Identify the injector and set up a trust:

Run the latest McAfee sysprep tool to detect and trust the possible injectors. For more information about this tool, see: KB89860 - How to use the McAfee SysPrep Utility (MFESysPrep)
Update the software that is injecting to a later version.
If ENS is installed, add the DLL certificate to the ENS common policy in ePO.
On the client, find the DLL causing the injection from the mfemactl.log.
1. Navigate to the location where the DLL is located.
2. Right-click the DLL, and Click Properties.
3. Click the Digital Signatures tab.
4. Select the certificate, and click Details.
5. Click View Certificate.
6. Click the Details tab, and click the option Copy to File.
7. On the next screen, click Next, and Next again.
8. Choose a path and a name for the exported certificate.
9. Click Next. NOTE: Leave the default file extension it assigns.
  
  The certificate is exported,
10. If Endpoint Security (ENS) is installed on the client, you must add the newly created certificate to the ENS common policy in ePO.

Other applicable resources:

For how to add a certificate to the ENS common policy, view the ENS Product Guide.
KB88085 - Third-party DLL injectors, code detours, and hooking.

Affected Products

Install/Uninstall
McAfee Agent 5.7.x
McAfee Agent 5.6.x
Upgrade/Migrate

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

McAfee Agent fails to update or deploy products due to an untrusted or unsigned DLL

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

McAfee Agent fails to update or deploy products due to an untrusted or unsigned DLL

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title