Loading...

Knowledge Center


一般標準保護規則「防止 McAfee 處理程序終止」在 Windows 8、8.1 與 2012 Server 上觸發
技術文章 ID:   KB84015
上次修改:  2015/5/8
已評分:


環境

McAfee VirusScan Enterprise (VSE) 8.8 Patch 3 和更新版本
Mirosoft Windows 8、8.1
Microsoft Windows 2012 Server

問題

存取保護規則防止 McAfee 處理程序終止在登入、登出、關閉與鎖定處理程序時觸發。

下列範例為存取保護記錄的記錄內容:

 
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\mfehidin.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\mfehidin.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:52 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\mfehidin.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/20/2015 12:52:53 PM Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate


原因

在 SVCHost.exe 中執行的某個服務或第三方處理程序,正透過可允許其終止處理程序的權限集存取並列舉執行中的處理程序,即使該服務實際上並非要嘗試終止處理程序。

Svchost.exe 是您電腦上的處理程序,寄存或包含其他 Windows 使用的個別服務,以執行不同功能。舉例來說,Windows Defender 使用一項 svchost.exe 處理程序寄存的服務。在您的電腦上可以有多個 svchost.exe 例項執行中,每個例項包含不同的服務。一個 svchost.exe 例項可能為一套程式寄存單一服務,而另一個例項則可能寄存數個 Windows 相關服務。您可以使用工作管理員來檢視每個 svchost.exe 例項下正在執行的服務。

部分第三方應用程式會用權限來列舉處理程序,以終止處理程序。依據不同應用程式而定,可能會導致該規則每分鐘觸發好幾次。

解決方案

此為預期行為,VSE 依設計運作。

這項規則會觸發是因為這是一項自我保護的規則,作為安全性措施運作,避免任何第三方應用程式或惡意軟體停用 VSE 保護。

如需進一步根本原因或資訊,請連絡 Microsoft。

免責聲明

本文內容源於英文。如果英文內容和翻譯有差異,請一律以英文內容為準。其中部分內容是使用 Microsoft 機器翻譯技術翻譯的。

為本文件評分

受影響的產品