Dell Endpoint Security Suite Enterprise en McAfee kunnen bij elke opstartprocedure een melding CylanceSvc.exe
Summary: Wanneer u Advanced Threat Prevention gebruikt met McAfee Firewall, ziet u mogelijk bij elke opstartprocedure waarschuwingen die aangeven dat Cylancesvc.exe probeert toegang te krijgen tot verschillende McAfee-processen. Deze waarschuwingen kunnen e-mailwaarschuwingen genereren op basis van de waarschuwingsinstellingen. ...
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
Opmerking:
- Vanaf mei 2022 heeft Dell Endpoint Security Suite Enterprise het einde van het onderhoud bereikt. Dit artikel wordt niet meer bijgewerkt door Dell. Raadpleeg voor meer informatie Beleid voor productlevenscyclus (einde support/einde levensduur) voor Dell Data Security. Als u vragen heeft over alternatieve artikelen, neem dan contact op met uw verkoopteam of neem contact op met endpointsecurity@dell.com.
- Raadpleeg Eindpuntbeveiliging voor meer informatie over huidige producten.
Betreffende producten:
- Dell Endpoint Security Suite Enterprise
Betreffende versies:
- V2.8 t/m 2.9
De gebeurtenissen in de C:\Programdata\Dell\Dell Data Protection\DellAgent.log Kan vermeldingen hebben die er als volgt uitzien:
[04912] (00008) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfefw.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewc.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00004) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00004) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfeesp.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewch.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.
De McAfee SelfProtection_Activity.log Kan de volgende vermeldingen bevatten:
mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEWC.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEESP.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEFW.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9900) ApBl.SP.Activity: SPRINGSCREATIVE\jcampbe-la ran IE4UINIT.EXE, which tried to access HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\ENABLE BROWSER EXTENSIONS, violating the rule "Web Control - Protect plug-in registry keys and values", and was blocked. For information about how to respond to this event, see KB85494.
Cause
Het ondertekeningscertificaat van McAfee voldoet niet aan het Cylance-certificaat en moet worden bijgewerkt.
Resolution
Het probleem is opgelost in Dell Endpoint Security Suite Enterprise v3.0 voor Windows.
Als u contact wilt opnemen met support, raadpleegt u de internationale telefoonnummers voor support van Dell Data Security.
Ga naar TechDirect om online een aanvraag voor technische support te genereren.
Voor meer informatie over inzichten en hulpbronnen kunt u zich aanmelden bij het Dell Security Community Forum.
Affected Products
Dell Endpoint Security Suite EnterpriseArticle Properties
Article Number: 000189881
Article Type: Solution
Last Modified: 10 Jul 2024
Version: 10
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.