Dell Endpoint Security Suite Enterprise et McAfee peuvent vous alerter sur CylanceSvc.exe à chaque démarrage
Summary: Lors de l’utilisation d’Advanced Threat Prevention avec le pare-feu McAfee, vous pouvez voir des alertes à chaque démarrage indiquant que Cylancesvc.exe tente d’accéder à divers processus McAfee. Ces alertes peuvent générer des alertes par e-mail basées sur les paramètres d’alerte. ...
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
Remarque :
- depuis mai 2022, Dell Endpoint Security Suite Enterprise n’est plus couvert par les services de maintenance. Cet article n’est plus mis à jour par Dell. Pour plus d’informations, consultez l’article Politique de cycle de vie du produit (fin de support/fin de vie) pour Dell Data Security. Si vous avez des questions concernant des articles, contactez votre équipe des ventes ou endpointsecurity@dell.com.
- Consultez l’article sur la sécurité des points de terminaison pour plus d’informations sur les produits actuels.
Produits concernés :
- Dell Endpoint Security Suite Enterprise
Versions concernées :
- v2.8 à 2.9
Les événements de l' C:\Programdata\Dell\Dell Data Protection\DellAgent.log Peut avoir des entrées similaires à celle-ci :
[04912] (00008) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfefw.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewc.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00004) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00004) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfeesp.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewch.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.
La commande McAfee SelfProtection_Activity.log Peut avoir des entrées comme les suivantes :
mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEWC.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEESP.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEFW.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9900) ApBl.SP.Activity: SPRINGSCREATIVE\jcampbe-la ran IE4UINIT.EXE, which tried to access HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\ENABLE BROWSER EXTENSIONS, violating the rule "Web Control - Protect plug-in registry keys and values", and was blocked. For information about how to respond to this event, see KB85494.
Cause
Le certificat de signature de McAfee ne respecte pas le certificat Cylance et nécessite une mise à jour.
Resolution
Le problème est résolu dans Dell Endpoint Security Suite Enterprise v3.0 pour Windows.
Pour contacter le support technique, consultez l’article Numéros de téléphone du support international Dell Data Security.
Accédez à TechDirect pour générer une demande de support technique en ligne.
Pour plus d’informations et de ressources, rejoignez le Forum de la communauté Dell Security.
Affected Products
Dell Endpoint Security Suite EnterpriseArticle Properties
Article Number: 000189881
Article Type: Solution
Last Modified: 10 Jul 2024
Version: 10
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.