Patch 1 for McAfee VirusScan Enterprise 8.0i 1

[addus5]

https://knowledgemap.nai.com/phpcli...cType=DOC_KnowledgeBase&externalID=KB_KB38267

Goal and/or Problem Description
Patch 1 for McAfee VirusScan Enterprise 8.0i

VSE80P01

Memory leak in McOp

Leak in the TDI driver

Using excessive amounts of Non-page pool memory



Problem Environment
McAfee VirusScan Enterprise 8.0i



Changes affecting this Problem
Change information is not available for this solution

Cause of this Problem
Cause information is not available for this solution


Solution 1:
Release Notes for McAfee(R) VirusScan(R) Enterprise
Version 8.0i
Patch 1


- VirusScan Enterprise:8.0i
- DAT Version: 4390, September 8 2004
- Engine Version: 4.3.20

PURPOSE

This release updates the TDI driver, MVSTDIxx.SYS (where xx can be 4x, 5x, 5a or 5i, depending on your operating system or processor architecture), to resolve the issues listed in "Resolved Issues" below.


RESOLVED ISSUES

1. ISSUE:
An unaligned memory reference in the TDI driver would lead to an exception on IA64 systems, seen as a blue screen error or reboot.

RESOLUTION:
MVSTDI5i.SYS has been updated to correct this issue.

2. ISSUE:
A memory leak occurred in non-page pool memory when accessing files via the network redirector. The TDI driver did not release memory that had been allocated for identifying Source IP information.

RESOLUTION:
Memory is properly released by the TDI driver.

3. ISSUE:
If the TDI driver received an I/O Request Packet (IRP) that did not have enough stack locations to be passed down the stack, a new IRP was created and the original IRP was left uncompleted. This resulted in a small memory leak.

RESOLUTION:
The original IRP is now completed.


FILES INCLUDED WITH THIS RELEASE

This release consists of a package called VSE80P01.ZIP, which contains the following files:

VSE80P01.EXE =
Installer for this patch release
PKGCATALOG.Z =
Package catalog file
PATCH01.TXT =
This text file
VS800DET.MCS =
Detection script for VirusScan Enterprise
8.0i
PACKING.LST =
Packing list



Notes
A reboot is required before the previous driver can be unloaded from memory.

IMPORTANT:
The patch listed above can be downloaded directly without contacting Technical Support. It is located at the following location:

https://mysupport.nai.com/

You must be registered with Prime Support Service Portal and have a valid Grant number for this product to access the patch. If you do not have a valid Grant number, please contact Customer Service at 800-338-8754 As of the time of this posting, this patch was the latest patch available for the product and issues listed above. If this patch is no longer present, please check for a newer version.

 

[BarryHill]

Hey All...

If I deploy this new patch via EPO 3.5, I assume it will automatically patch every instance of 8.0 in my environment, as stated in the readme. BUT...will it throw the re-boot dialog via this method, and if so is there a way to mute such a dialog?

I installed the patch manually on a test machine and got a re-boot dialog. My fear is that if I check this into EPO, all my users are going to get re-boot dialogs...resulting in MANY phone calls to ME!

Thanks!

 

[bfralia]

I deployed it with 3.02a and got a reboot dialog. Also you get a reboot dialog with Alert Manager 4.7.1. I sent them out at the same time and got two reboots.

We sent out a blanket e-mail that said to reboot when you see the dialog and don't ask questions.

 

[addus5]

Barry,

Yes I also got the reboot. On the initial install of VSE 8.0 it did not require the reboot. I am actually disappointed at Mcafee because they did not put more granular control on patch deployment. You should at least be able to control the reboot or not deploy it if it does require a reboot. The answer for them is that patch updates for VSE is a new concept and they are going to be working in new changes. One thing that might work is if the patch was rolled into the new software package it might be able to be pulled into EPO and not require a reboot to any new machines that need to the full software upgrade

Addus

 

[mattmsudawg]

What addus5 suggested does work. I have done it. Use the Installation Designer and add the patch to the install. Also add /SILENT to the install parameters. Then check in the package to the Respository. On new installations it won't ask for a reboot. But it also won't show the correct plugin version in the ePo console until the computer reboots.

 

[addus5]

Matt. Thanks alot. I havent played around with the installation designer but will check it out.