The third-party software injects code into McAfee processes. McAfee software considers third-party DLLs that inject into McAfee processes untrusted, and those processes also become untrusted. McAfee software then denies access to the untrusted processes, which causes the affected McAfee process to not work as expected. For detailed information about ENS and third-party injection, see: KB88085 - Third-party DLL injectors, code detours, and hooking.

When a third-party DLL is detected trying to load into MFECANARY.EXE, the digital certificate for the process is populated in the certificate table. This certificate table is in the user interface at Endpoint Security Common policy, your enforced policy, Show Advanced, Certificates. The certificate table is populated with the Vendor, Subject, and Hash of the associated public key.

NOTE: If the certificate for the third-party software is not populated in the certificate table, you might have an issue other than the one described in this article.