Dell Endpoint Security Suite Enterprise и McAfee могут выдавать оповещения о CylanceSvc.exe при каждой загрузке
Summary: При использовании Advanced Threat Prevention с межсетевым экраном McAfee при каждой загрузке могут отображаться оповещения о том, что Cylancesvc.exe пытается получить доступ к различным процессам McAfee. Эти оповещения могут создавать оповещения по электронной почте, основанные на настройках оповещений. ...
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
Примечание.:
- По состоянию на май 2022 г., обслуживание Dell Endpoint Security Suite Enterprise прекращено. Эта статья больше не обновляется компанией Dell. Подробнее см. в статье Политика в отношении жизненного цикла продукта (окончание поддержки / снятие с производства) для Dell Data Security. Если у вас возникли вопросы по альтернативным статьям, обратитесь в отдел продаж или по адресу endpointsecurity@dell.com.
- Дополнительные сведения о текущих продуктах см. в разделе Endpoint Security.
Затронутые продукты:
- Dell Endpoint Security Suite Enterprise
Затронутые версии:
- С версии 2.8 до 2.9
События в C:\Programdata\Dell\Dell Data Protection\DellAgent.log может содержать записи, похожие на эту:
[04912] (00008) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfefw.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewc.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00004) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00004) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfeesp.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. [04912] (00007) W AVAS : received Information threat protection event: BO=SP Id=1092 [04912] (00007) W AVAS : NT AUTHORITY\SYSTEM ran C:\Program Files\Dell\Dell Data Protection\Advanced Threat Protection\CylanceSvc.exe, which attempted to access the process mfewch.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494.
В строке McAfee SelfProtection_Activity.log может содержать записи, подобные следующие:
mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEWC.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEESP.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9896) ApBl.SP.Activity: NT AUTHORITY\SYSTEM ran CYLANCESVC.EXE, which attempted to access MFEFW.EXE, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. mfeesp(7716.9900) ApBl.SP.Activity: SPRINGSCREATIVE\jcampbe-la ran IE4UINIT.EXE, which tried to access HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\ENABLE BROWSER EXTENSIONS, violating the rule "Web Control - Protect plug-in registry keys and values", and was blocked. For information about how to respond to this event, see KB85494.
Cause
Сертификат подписи McAfee не соответствует сертификату Cylance и требует обновления.
Resolution
Эта проблема решена в Dell Endpoint Security Suite Enterprise версии 3.0 для Windows.
Чтобы связаться со службой поддержки, см. Номера телефонов международной службы поддержки Dell Data Security.
Перейдите в TechDirect, чтобы создать запрос на техническую поддержку в режиме онлайн.
Для получения дополнительной информации и ресурсов зарегистрируйтесь на форуме сообщества Dell Security.
Affected Products
Dell Endpoint Security Suite EnterpriseArticle Properties
Article Number: 000189881
Article Type: Solution
Last Modified: 10 Jul 2024
Version: 10
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.