__rsignal(RSIG_BOOTENGINE) returned failure, missing definitions?

[amartin-git]

Hello,

As of this morning it looks like MS changed something in the distribution files. Now getting the following error when trying to run mpclient:

main(): __rsignal(RSIG_BOOTENGINE) returned failure, missing definitions?
main(): Make sure the VDM files and mpengine.dll are in the engine directory

Don't know if it's related, but compared to yesterday's files, some of the new files seem to have shrunk:

-rw-r--r-- 1 root root 47954880 Aug  5 06:10 mpasbase.vdm
-rw-r--r-- 1 root root 10175432 Aug  5 06:03 mpasdlta.vdm
-rw-r--r-- 1 root root 45193160 Aug  5 06:03 mpavbase.vdm
-rw-r--r-- 1 root root 11338184 Aug  5 06:03 mpavdlta.vdm
-rw-r--r-- 1 root root 12990384 Aug  5 06:03 mpengine.dll
-rw-r--r-- 1 root root   647560 Aug  5 06:03 MpSigStub.exe

-rw-r--r-- 1 root root 48507840 Aug  6 08:50 mpasbase.vdm
-rw-r--r-- 1 root root  2742728 Aug  6 08:50 mpasdlta.vdm
-rw-r--r-- 1 root root 50892208 Aug  6 08:50 mpavbase.vdm
-rw-r--r-- 1 root root   139200 Aug  6 08:50 mpavdlta.vdm
-rw-r--r-- 1 root root 12848312 Aug  6 08:50 mpengine.dll
-rw-r--r-- 1 root root   647560 Aug  6 08:50 MpSigStub.exe

[idanfei]

Having the same issue

[frisch-raphael]

Same here :(

[taviso]

Thanks for letting me know, I'm investigating.

[amartin-git]

Using the mpengine.dll from Aug 5 with the newer .vdm files seems to work for now (not familiar with the inner-workings of these files, but it does detect EICAR and several other virsuses correctly).

Thanks for all the work that you put into this project!

[taviso]

I see the issue, mpengine is doing a lot more work to validate all the signatures on the VDM, and not trusting the host system to do the verification. It might take a day or two, but I'm thinking about solutions!

[frisch-raphael]

Thanks :)

[IkeZZZ]

i am also troubled by this problem :(

[DDB-en]

Same Issue, Thanks @taviso

[amartin-git]

Looks like using the mpengine.dll from Aug 5 no longer works with the new VDM files as of this weekend.

@taviso - have you been able to make any progress with this? Thanks again.

[YongZeer]

I search another download link, it works. But I don't know why. It maybe helpful.

http://download.microsoft.com/download/DefinitionUpdates/mpam-fe.exe

[mikewilusz-stairwell]

Thanks for the other link. That does work, but it appears to be an outdate engine. I'm seeing the error listed in this issue on the latest version of the engine. Would love to have a fix as well!

[Rd1997]

It works fine with older version but latest updated is not supported.

[blacktop]

@taviso were you able to figure out the root cause for this?