Loading...

Knowledge Center


Access Protection events are generated for McAfee Agent executable (masvc.exe) with VSE 8.8 Patch 4 and earlier
Technical Articles ID:   KB88972
Last Modified:  3/23/2017
Rated:


Environment

McAfee Agent (MA) 5.0.5
McAfee VirusScan Enterprise (VSE) 8.8 Patch 4 and earlier

All supported Windows operating systems. For details of VSE 8.x supported environments, see KB51111.

Problem

Access Protection events for masvc.exe are generated on the client after you install VSE 8.8 Patch 4 or earlier.

The issue only occurs when VSE 8.8.0 Patch 4 or earlier is deployed to the client in the following sequence:
  • Install or upgrade to McAfee Agent 5.0.5.
  • Deploy VirusScan Enterprise 8.8.0 Patch 4 or earlier.
You see the following MA symptoms:
  • Unable to collect and send properties
  • Fails to receive new policies or tasks from ePolicy Orchestrator (ePO)
  • Unable to upload events

Examples of Access Protection events:
 
Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Program Files\McAfee\Agent\masvc.exe    \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework    Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings    Action blocked : Write

Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Program Files\McAfee\Agent\masvc.exe    \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework\AgPlcyEnableEventTrigger    Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings    Action blocked : Create

Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Program Files\McAfee\Agent\masvc.exe    \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework\AgPlcyEventTriggerThreshold    Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings    Action blocked : Create

Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Program Files\McAfee\Agent\masvc.exe    \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework    Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings    Action blocked : Write

Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Program Files\McAfee\Agent\masvc.exe    \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework    Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings    Action blocked : Write

Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Program Files\McAfee\Agent\masvc.exe    \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework\IPAddress    Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings    Action blocked : Create

Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Program Files\McAfee\Agent\masvc.exe    \REGISTRY\MACHINE\Software\Wow6432Node\Network Associates\TVD\Shared Components\Framework    Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings    Action blocked : Write

Blocked by Access Protection rule     NT AUTHORITY\SYSTEM    C:\Program Files\McAfee\Agent\masvc.exe    \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework\ePOServerList    Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings    Action blocked : Create

Cause

The McAfee Agent executable, masvc.exe, is not whitelisted by VSE 8.8.0 Patch 4 or earlier.

Solution

Restart the client after you install VSE 8.8 Patch 4 or earlier.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Languages:

This article is available in the following languages:

English United States
Spanish Spain
Japanese

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.