cancel
Showing results for 
Search instead for 
Did you mean: 

Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

Hi everyone, McAfee Team!

I would like to make a discussion about my problem.

Part of hosts/PC on our system installed public applications and all of them installed McAfee Endpoint Security (AV, agent). When I manual update signature/AMCore version of McAfee Antivirus or run deployment task from ePO to client, it will fail.

Checking log of McAfee agent (C:\ProgramData\McAfee\Agent\logs), for example mfemactl.log, I saw this lines:

2019-11-13 16:13:13.987 mfemactl(6208.7704) mfemactl.Info: The process <C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCTRAY.EXE>(5196) was blocked from accessing('CREATE' (1)) <AAC_OBJECT_SECTION:D:\[SETUP]\ULTRAVIEWER\ULTRAVIEWER\UVH.DLL> via the rule <Sanitize McTray Process>
2019-11-13 16:13:13.988 mfemactl(6208.7704) mfemactl.Info: The process <C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCTRAY.EXE>(5196) was blocked from accessing('CREATE' (1)) <AAC_OBJECT_SECTION:D:\[SETUP]\ULTRAVIEWER\ULTRAVIEWER\UVH.DLL> via the rule <Sanitize McTray Process>
2019-11-13 16:13:13.989 mfemactl(6208.7704) mfemactl.Info: The process <C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCTRAY.EXE>(5196) was blocked from accessing('CREATE' (1)) <AAC_OBJECT_SECTION:E:\[SETUP]\PROXIFIER_PORTABLE\PRXDRVPE.DLL> via the rule <Sanitize McTray Process>

I searched for many topics that everyone created before about this error but i can't find a satisfactory answers. I checked that DLL file and saw that, applications of that DLL file maybe is out-of-date or certificate of vendor is unsigned or certificate is out-of-sign. It is trying to inject it's code to McAfee process.

If McAfee process need to load untrust/unsigned DLL file to use, updating/deployment task will fail and I have to manual remove that application which contains that DLL file to make updating/deployment task successful. 

Does McAfee have any actions on that untrusted/unsigned DLL files (for example delete, block,...) to make McAfee process to continue without my action?

If we have 50 PCs with untrusted/unsigned DLL files, I cannot manual remove DLL file on that PC to make McAfee process to continue without error.

I hope I can find a solution for this error in this topic. Thank you so much.

1 Solution

Accepted Solutions
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 8 of 9

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

HI @VietDuc19 

It mean: McAfee does not trust module PrxDrvPE.dll of Proxifier application.
> This is correct. 

In those situations, does McAfee have any actions on that DLL file (block/delete/...DLL file) to make McAfee process run successful instead of return status fail of process?
> I'm afraid not. Because there is something untrusted on the system, the installation/ running of an update/ etc. will be stopped. If you trust this and what to trust it yourself, you can add the .cer file into the ENS Common policy. This will add the trust.

For more details on dll injections, please do take the time to read this article: KB88085

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

8 Replies
McAfee Employee patrakshar
McAfee Employee
Report Inappropriate Content
Message 2 of 9

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

Hello @VietDuc19 

When you mentioned that you need to trust all these untrusted DLL's, there is a easy way to it. We have tool call mfesysprep (Available by contacting support) which can scan the machine and see if there is any 3rd party DLL getting injected and if we can trust it by that version of the tool. If yes then we add that into trust center if not then we can create a customize mfesysprep tool just to trust those DLL's.  You can contact support to avail that tool.

 

You mentioned that installation was failing because of this DLL trust issue, can you please IM me the installation log  (McAfeeLogs Folder)?

McAfee Employee patrakshar
McAfee Employee
Report Inappropriate Content
Message 3 of 9

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

The log you have shared shows hooking of "E:\[SETUP]\PROXIFIER_PORTABLE\PRXDRVPE.DLL". This is not during deployment but during update. This can be looked by Agent team. 

The provided logs are from the Agent Folder and not the Installation log folder. What I am looking for is the installation log. If you have scenario where you pushed the ENS from EPO and it failed, then go to C:\Windows\Temp\ location and you will see McAfeeLogs folder. You can share that with me so that I can check which DLL's are causing the installation issue.

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

Sorry for my mistake. I sent you update log. Please help me to review it.

Thank you so much!

McAfee Employee patrakshar
McAfee Employee
Report Inappropriate Content
Message 5 of 9

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

Thank you for sharing the log.

Looking at the installation point of view, last sysprep log says:

 

11/08/19 10:28:52 [I] [0x1d38] Creating unprotected process to detect injections "C:\ProgramData\McAfee\Agent\Current\ENDP_GS_1060\Install\0000\compattest_6008_3875.exe" -detect
11/08/19 10:28:54 [I] [0x1d38] Reading child results
11/08/19 10:28:54 [I] [0x1d38] Read child results |
11/08/19 10:28:54 [I] [0x1d38] No injectors found

Which means there was no injector during the last installation try. Also installation logs says that it has completed successfully. So it does not seems to be any issue with the installation as such.

 

Coming to the point of DLL hooking we are seeing in mfemactl.log  for E:\[SETUP]\PROXIFIER_PORTABLE\PRXDRVPE.DLL file. This may cause problem with content update. A further investigation will be required for this. I would suggest to open a support ticket for this with us so that we can take it further.

 

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

So if I don't wanna trust that DLL files, does McAfee have any actions on that untrusted/unsigned DLL files (for example delete, block,...) to make McAfee process to continue without my action?

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

I just removed McAfee Products and re-installed again. After that, I tried to run McAfee SysPrep and sysprep log  show that:

11/14/19 14:45:53 [I] [0x31ec] MfeSysPrep 1.0.0.296
11/14/19 14:45:53 [I] [0x31ec] Initializing certificate manager...
11/14/19 14:45:53 [I] [0x31ec] Detecting injectors...
11/14/19 14:45:53 [I] [0x31ec] Creating unprotected process to detect injections "C:\Users\VIETDUC19\Desktop\McAfee_SysPrep_1.0.0.296\compattest_3940_28944.exe" -detect
11/14/19 14:45:54 [I] [0x31ec] Reading child results
11/14/19 14:45:54 [I] [0x31ec] Read child results E:\[SETUP]\Proxifier_Portable\PrxDrvPE64.dll||
11/14/19 14:45:54 [I] [0x31ec] Injector discovered [E:\[SETUP]\Proxifier_Portable\PrxDrvPE64.dll]
11/14/19 14:45:54 [I] [0x31ec] Loaded module [E:\[SETUP]\Proxifier_Portable\PrxDrvPE64.dll] is untrusted
11/14/19 14:45:54 [I] [0x31ec] Extracting certificate information for file [E:\[SETUP]\Proxifier_Portable\PrxDrvPE64.dll]
11/14/19 14:45:54 [I] [0x31ec] File [E:\[SETUP]\Proxifier_Portable\PrxDrvPE64.dll] sha2[E109011F96919D968164DE6957B9A75E87A167AFA961855AF7C291E8DE475735] sha1[DB58536833F6D25AFDD429BDDDDF3C3CD17EB146] md5[77F0642BCD7A97A068C0AFE70BE22F03]
11/14/19 14:45:54 [I] [0x31ec] File [E:\[SETUP]\Proxifier_Portable\PrxDrvPE64.dll] is signed with certificate:
11/14/19 14:45:54 [I] [0x31ec] ***************** BEGIN CERT DUMP ********************
11/14/19 14:45:54 [I] [0x31ec] Issuer[GlobalSign Extended Validation CodeSigning CA - SHA256 - G3]
11/14/19 14:45:54 [I] [0x31ec] subject[Initeks, OOO]
11/14/19 14:45:54 [I] [0x31ec] issuerDn[CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE]
11/14/19 14:45:54 [I] [0x31ec] subjectDn[CN="Initeks, OOO", O="Initeks, OOO", STREET=Komendantskiy 51-1-300, L=Saint Petersburg, S=Saint Petersburg, C=RU, OID.1.3.6.1.4.1.311.60.2.1.2=Saint Petersburg, OID.1.3.6.1.4.1.311.60.2.1.3=RU, SERIALNUMBER=1089847274439, OID.2.5.4.15=Private Organization]
11/14/19 14:45:54 [I] [0x31ec] signatureAlgorithm[sha256RSA]
11/14/19 14:45:54 [I] [0x31ec] sign key sha1[1FA5144C0AB20B23F3D9F6C8F3D0642C89506161]
11/14/19 14:45:54 [I] [0x31ec] cert sha1[FCA847CF2222CF0D0952AE6039EB5B269BA582A3]
11/14/19 14:45:54 [I] [0x31ec] ***************** END CERT DUMP ********************
11/14/19 14:45:54 [E] [0x31ec] Unable to grant trust to module [E:\[SETUP]\Proxifier_Portable\PrxDrvPE64.dll]
11/14/19 14:45:55 [I] [0x27c0] MfeSysPrep 1.0.0.296
11/14/19 14:45:55 [I] [0x27c0] Initializing certificate manager...
11/14/19 14:45:55 [I] [0x27c0] Detecting injectors...
11/14/19 14:45:55 [I] [0x27c0] Creating unprotected process to detect injections "C:\Users\VIETDUC19\Desktop\McAfee_SysPrep_1.0.0.296\compattest_4608_2096.exe" -detect
11/14/19 14:45:55 [I] [0x27c0] Reading child results
11/14/19 14:45:55 [I] [0x27c0] Read child results E:\[SETUP]\Proxifier_Portable\PrxDrvPE.dll||
11/14/19 14:45:55 [I] [0x27c0] Injector discovered [E:\[SETUP]\Proxifier_Portable\PrxDrvPE.dll]
11/14/19 14:45:55 [I] [0x27c0] Loaded module [E:\[SETUP]\Proxifier_Portable\PrxDrvPE.dll] is untrusted
11/14/19 14:45:55 [I] [0x27c0] Extracting certificate information for file [E:\[SETUP]\Proxifier_Portable\PrxDrvPE.dll]
11/14/19 14:45:55 [I] [0x27c0] File [E:\[SETUP]\Proxifier_Portable\PrxDrvPE.dll] sha2[44243F0D0102D654C5CAD1AC3826B52DA9454D4AF99D9A417CEB6AE4DDDA71F0] sha1[EBF1C54049E801C3B665990C0612C44BA6B75940] md5[D3DA1003323423DA89AF2C83E5E2B40A]
11/14/19 14:45:55 [I] [0x27c0] File [E:\[SETUP]\Proxifier_Portable\PrxDrvPE.dll] is signed with certificate:
11/14/19 14:45:55 [I] [0x27c0] ***************** BEGIN CERT DUMP ********************
11/14/19 14:45:55 [I] [0x27c0] Issuer[GlobalSign Extended Validation CodeSigning CA - SHA256 - G3]
11/14/19 14:45:55 [I] [0x27c0] subject[Initeks, OOO]
11/14/19 14:45:55 [I] [0x27c0] issuerDn[CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE]
11/14/19 14:45:55 [I] [0x27c0] subjectDn[CN="Initeks, OOO", O="Initeks, OOO", STREET=Komendantskiy 51-1-300, L=Saint Petersburg, S=Saint Petersburg, C=RU, OID.1.3.6.1.4.1.311.60.2.1.2=Saint Petersburg, OID.1.3.6.1.4.1.311.60.2.1.3=RU, SERIALNUMBER=1089847274439, OID.2.5.4.15=Private Organization]
11/14/19 14:45:55 [I] [0x27c0] signatureAlgorithm[sha256RSA]
11/14/19 14:45:55 [I] [0x27c0] sign key sha1[1FA5144C0AB20B23F3D9F6C8F3D0642C89506161]
11/14/19 14:45:55 [I] [0x27c0] cert sha1[FCA847CF2222CF0D0952AE6039EB5B269BA582A3]
11/14/19 14:45:55 [I] [0x27c0] ***************** END CERT DUMP ********************
11/14/19 14:45:56 [E] [0x27c0] Unable to grant trust to module [E:\[SETUP]\Proxifier_Portable\PrxDrvPE.dll]

It mean: McAfee does not trust module PrxDrvPE.dll of Proxifier application.

In those situations, does McAfee have any actions on that DLL file (block/delete/...DLL file) to make McAfee process run successful instead of return status fail of process?

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 8 of 9

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

HI @VietDuc19 

It mean: McAfee does not trust module PrxDrvPE.dll of Proxifier application.
> This is correct. 

In those situations, does McAfee have any actions on that DLL file (block/delete/...DLL file) to make McAfee process run successful instead of return status fail of process?
> I'm afraid not. Because there is something untrusted on the system, the installation/ running of an update/ etc. will be stopped. If you trust this and what to trust it yourself, you can add the .cer file into the ENS Common policy. This will add the trust.

For more details on dll injections, please do take the time to read this article: KB88085

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

Re: Process of McAfee Agent was Blocked from Accessing Untrust DLL File

Jump to solution

Thank you for your information. I think this is answer I am looking for.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community