Dell Endpoint Security Suite Enterprise og McAfee kan varsle på CylanceSvc.exe ved hver oppstart

Summary: Når du bruker avansert trusselforhindring med McAfee-brannmur, kan det hende du ser varsler ved hver oppstart som indikerer at Cylancesvc.exe prøver å få tilgang til ulike McAfee-prosesser. Disse varslene kan generere e-postvarsler som er basert på innstillingene for varsler. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Merk:

Berørte produkter:

  • Dell Endpoint Security Suite Enterprise

Berørte versjoner:

  • v2.8 til 2.9

Konsollvarsel

Hendelsene i C:\Programdata\Dell\Dell Data Protection\DellAgent.log kan ha oppføringer som ligner på dette:

 [04912] (00008) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfefw.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

 [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092
 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewc.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

 [04912] (00004) W AVAS : received Information threat protection event: BO=SP Id=1092
 [04912] (00004) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfeesp.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

 [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092
 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewch.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

Informasjonen i McAfee SelfProtection_Activity.log Kan inneholde oppføringer som følgende:

mfeesp(7716.9896)  ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEWC.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

mfeesp(7716.9896)  ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEESP.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

mfeesp(7716.9896)  ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEFW.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.

mfeesp(7716.9900)  ApBl.SP.Activity: SPRINGSCREATIVE\jcampbe-la ran IE4UINIT.EXE, which tried to access HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\ENABLE BROWSER EXTENSIONS, violating the rule "Web Control - Protect plug-in registry keys and values", and was blocked. For information about how to respond to this event, see KB85494.

Cause

Signeringssertifikatet fra McAfee respekterer ikke Cylance-sertifikatet og krever en oppdatering.

Resolution

Problemet er løst i Dell Endpoint Security Suite Enterprise v3.0 for Windows.

Når du skal kontakte kundestøtte, kan du se Dell Data Security internasjonale telefonnumre for støtte..
Gå til TechDirect for å generere en forespørsel om teknisk støtte på Internett.
Hvis du vil ha mer innsikt og flere ressurser, kan du bli med i fellesskapsforumet for Dell Security.

Affected Products

Dell Endpoint Security Suite Enterprise
Article Properties
Article Number: 000189881
Article Type: Solution
Last Modified: 10 Jul 2024
Version:  10
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.