Loading...

Knowledge Center


The Common Standard Protection rule "Prevent Termination of McAfee Processes" is triggered on Windows 8, 8.1 and 2012 Servers
Technical Articles ID:   KB84015
Last Modified:  7/23/2019
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.8 Patch 3 and later
Microsoft Windows 8, 8.1
Microsoft Windows 2012 servers

Problem

The access protection rule Prevent Termination of McAfee Processes is triggered during the log on, log off, shut down, and locking processes.

The following is an example of what is logged in the Access Protection log:

 
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\mfehidin.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\mfehidin.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\mfehidin.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

 

Cause

A service running within SvcHost.exe or a third-party process is accessing and enumerating the running processes with a permission set that allows it to terminate processes. But, it might not actually be trying to terminate processes.

Svchost.exe is a process on your computer that hosts, or contains, other individual services that Windows uses to perform several functions. For example, Windows Defender uses a service that is hosted by a svchost.exe process. There can be multiple instances of svchost.exe running on your computer, with each instance containing different services. One instance of svchost.exe might host a single service for a program, and another instance might host several services related to Windows. You can use Task Manager to view which services are running under each instance of svchost.exe.

Some third-party applications enumerate processes with the privilege to terminate processes. This fact can cause the rule to be triggered many times per minute, depending on the application.

Solution

This behavior is expected, and VSE is working as designed.

The rule is triggered because it is a self-protection rule. It acts as a security measure to avoid any third-party applications or malware from disabling VSE protection.

Contact Microsoft if further root cause or information is needed.

Rate this document

Affected Products

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.