Access Protection rules triggered when installing a VirusScan Enterprise hotfix or when performing a McAfee Agent upgrade

Technical Articles ID: KB81930
Last Modified: 3/31/2016

Environment

McAfee VirusScan Enterprise (VSE) 8.8

For details of VSE 8.x supported environments, see KB51111.

Problem

VSE Access Protection - Common Standard Protection rules are triggered during either of the following:

VSE hotfix deployment
McAfee Agent upgrade

You see the following rules being triggered:

Prevent modification of McAfee files and settings
Prevent termination of McAfee processes

These rules prevent the VSE hotfix update.

Cause

Most McAfee products have a trust relationship mechanism, which prevents such a violation from occurring for a McAfee process. However, the trust relationship can fail under certain conditions.

For example, when the Validation and Trust Protection service (mfevtps.exe) is updated (such as applying a patch for VSE or Host Intrusion Prevention), it causes all existing trust relationships to be purged, and reacquired. If trust is not reacquired, or fails to be acquired by a process, the actions performed by that process are blocked.

Solution

This issue is less likely to occur in patched versions of VSE 8.8.

VSE 8.8 Patch 14 is the latest patch available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.

NOTE: VSE 8.8 Patch 14 supports all supported Windows operating systems.

If this issue occurs after installing the latest patch, implement one of the following workarounds.

Workaround

Restart your computer. This restores normal operations because the trust is reacquired.

Workaround

To trust the process:
NOTE: The following example shows how to exclude the DAInstall.exe process from the rule.

Click Start, Programs, McAfee, VirusScan Console.
Double-click Access Protection, and select Common Standard Protection.
Double-click Prevent modification of McAfee processes.
Under Processes to exclude, scroll down to the end of the list.
Type DAInstall.exe, and then click OK.

IMPORTANT:
- Ensure there are no spaces before or after the comma separating the process names.
- Use a (partial) path name if other processes with the same name exist. For further assistance with exclusions, see KB66909.
Click OK until the Access Protection Properties window is closed.
Exit the VSE console.

Affected Products

VirusScan Enterprise 8.8

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Access Protection rules triggered when installing a VirusScan Enterprise hotfix or when performing a McAfee Agent upgrade

Environment

Problem

Cause

Solution

Workaround

Workaround

Affected Products

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Access Protection rules triggered when installing a VirusScan Enterprise hotfix or when performing a McAfee Agent upgrade

Environment

Problem

Cause

Solution

Workaround

Workaround

Affected Products

Glossary of Technical Terms

Choose your region

Title

Title