Self Protection - protect McAfee processes - ma_crypto.dll - Event ID:34865

[OzanCANAY]

Hi, 

What does this error mean? What should we do for control and solution?

Thanks,

[aguevara]

it looks like one of our own dlls is been detected, normally any injectors should be dealt with the article below by running Mcafee sysprep and resetting the VTP cache

https://kc.mcafee.com/corporate/index?page=content&id=KB88085

Could you please try that on that machine? 

Regards

Alejandro

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[cdinet]

Also, is that an ens event?  There is self protection on the agent and also self protection on ens.  The agent doesn't send those type of events with injection, so I will move this over to ens team.  The KB given, however, should help to resolve it.  Typically running mcafee sysprep should help.

[OzanCANAY]

Hi Alejandro,

I tried the MfeSysPrep.exe application in the document you shared first on my test computer to make sure I applied it correctly. I received the report, but then I could not send packets to this computer via Mcafee EPO.

I did as described in this document. https://kc.mcafee.com/corporate/index?page=content&id=KB89860

I can uninstall an application from the test computer (FRP for example) but I cannot install an application. When I delete the computer via EPO and add it again, the result is the same.

Did I do the operation wrong?

[aguevara]

id the Mcafeesysprep identify any injectors or was it unable to trust them? there is a log created when running the tool

[OzanCANAY]

I share the log created after the installation about SysPrep. I also forward the log that occurred during the FRP installation. (FRP cannot be installed)


I installed this version

[aguevara]

see, could you please open a Service request with teh FRP team and show them this log please:

01/20/22 9:38:44 [E] [0x4198] Unable to grant trust to module [C:\Program Files\McAfee\Endpoint Encryption for Files and Folders\MfeFfAutomation.dll]

That module is causing a problem and cant be trusted by the tool