Dell Endpoint Security Suite Enterprise ja McAfee saattavat antaa CylanceSvc.exe-hälytyksen käynnistyksen yhteydessä
Summary: Kun käytät Advanced Threat Preventionia McAfeen palomuurin kanssa, saatat nähdä jokaisessa käynnistyksessä hälytyksiä siitä, että Cylancesvc.exe yrittää käyttää McAfeen eri prosesseja. Nämä hälytykset saattavat luoda hälytysasetusten perusteella sähköpostihälytyksiä. ...
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
Huomautus:
- Toukokuussa 2022 Dell Endpoint Security Suite Enterprisen ylläpito on päättynyt. Dell ei enää päivitä tätä artikkelia. Lisätietoja on artikkelissa Dell Data Security -tuotteen elinkaari (tuen päättyminen / käytöstä poistuminen). Jos sinulla on kysyttävää vaihtoehtoisista artikkelista, ota yhteys myyntitiimiin tai lähetä sähköpostia osoitteeseen endpointsecurity@dell.com.
- Lisätietoja nykyisistä tuotteista on sivulla Endpoint Security.
Tuotteet, joita asia koskee:
- Dell Endpoint Security Suite Enterprise
Versiot, joita asia koskee:
- 2.8–2.9
Tapahtumat C:\Programdata\Dell\Dell Data Protection\DellAgent.log voi olla tämänkaltaisia merkintöjä:
[04912] (00008) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfefw.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewc.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00004) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00004) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfeesp.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewch.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.
pikanäppäimellä McAfee SelfProtection_Activity.log Siinä voi olla seuraavanlaisia merkintöjä:
mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEWC.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEESP.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEFW.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9900) ApBl.SP.Activity: SPRINGSCREATIVE\jcampbe-la ran IE4UINIT.EXE, which tried to access HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\ENABLE BROWSER EXTENSIONS, violating the rule "Web Control - Protect plug-in registry keys and values", and was blocked. For information about how to respond to this event, see KB85494.
Cause
McAfeen allekirjoitusvarmenne ei huomioi Cylance-varmennetta ja tarvitsee päivityksen.
Resolution
Ongelma on korjattu Dell Endpoint Security Suite Enterprise 3.0 -versiossa Windowsille.
Jos haluat ottaa yhteyttä tukeen, katso luettelo Dell Data Securityn kansainvälisen tuen puhelinnumeroista.
TechDirectissä voit luoda teknisen tukipyynnön verkossa.
Lisätietoja ja resursseja on Dell Security Community Forum -keskustelufoorumilla.
Affected Products
Dell Endpoint Security Suite EnterpriseArticle Properties
Article Number: 000189881
Article Type: Solution
Last Modified: 10 Jul 2024
Version: 10
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.