Dell Endpoint Security Suite EnterpriseおよびMcAfeeが起動するたびにCylanceSvc.exeでアラートを発する場合がある

Summary: McAfeeファイアウォールでAdvanced Threat Preventionを使用している場合、Cylancesvc.exeがさまざまなMcAfeeプロセスにアクセスしようとしていることを示すアラートが起動のたびに表示されることがあります。 これらのアラートは、アラート設定に基づいてEメール アラートを生成する場合があります。

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

注：

対象製品：

  • Dell Endpoint Security Suite Enterprise

影響を受けるバージョン:

  • v2.8～2.9

コンソール アラート

イベントは、 C:\Programdata\Dell\Dell Data Protection\DellAgent.log 次のようなエントリーが含まれる場合があります。

 [04912] (00008) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfefw.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

 [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092
 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewc.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

 [04912] (00004) W AVAS : received Information threat protection event: BO=SP Id=1092
 [04912] (00004) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfeesp.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

 [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092
 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewch.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

そうすると、 McAfee SelfProtection_Activity.log 次のようなエントリーが含まれる場合があります。

mfeesp(7716.9896)  ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEWC.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

mfeesp(7716.9896)  ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEESP.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

mfeesp(7716.9896)  ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEFW.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

mfeesp(7716.9900)  ApBl.SP.Activity: SPRINGSCREATIVE\jcampbe-la ran IE4UINIT.EXE, which tried to access HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\ENABLE BROWSER EXTENSIONS, violating the rule "Web Control - Protect plug-in registry keys and values", and was blocked. For information about how to respond to this event, see KB85494.

Cause

McAfeeからの署名証明書はCylance証明書を配慮していないため、アップデートが必要です。

Resolution

この問題は、Dell Endpoint Security Suite Enterprise v3.0 for Windowsで解決されました。

サポートに問い合わせるには、「Dell Data Securityのインターナショナル サポート電話番号」を参照してください。
TechDirectにアクセスして、テクニカル サポート リクエストをオンラインで生成します。
さらに詳しい情報やリソースについては、「デル セキュリティ コミュニティー フォーラム」に参加してください。

Affected Products

Dell Endpoint Security Suite Enterprise
Article Properties
Article Number: 000189881
Article Type: Solution
Last Modified: 10 Jul 2024
Version:  10
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.