cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

REALTEK HD AUDIO UNIVERSAL SERVICE continuously attempts to both hook and terminate mcafee processes

For some reason, the realtek audio driver keeps attempting to both hook and terminate mcafee processes on a consistent basis.  I've placed some details below to get a better understanding of the issue.  This happens over 2,000 times a day per system.  Has anyone run into an issue like this?  I really don't want to allow an audio driver to perform these actions (terminate or hook into mcafee processes)

ePO 5.3.1

HIPS 8.0.0.4480

Security Content: 8.0.0.8725 

Patch 10: 

Driver Name and File: REALTEK HD AUDIO UNIVERSAL SERVICE (RTKAUDUSERVICE64.EXE) 

- Signature Name: Access Protection - Prevent hooking of McAfee processes

Threat Source Process Name: C:\WINDOWS\SYSTEM32\RTKAUDUSERVICE64.EXE

Threat Target Files: MCSHIELD.EXE, MFEVTPS.EXE, FIRESVC.EXE, MFEANN.EXE, MFEFIRE.EXE

Threat Source User Name: NT AUTHORITY\SYSTEM

- Signature Name: Access Protection - Prevent termination of McAfee processes

Threat Source Process Name: C:\WINDOWS\SYSTEM32\RTKAUDUSERVICE64.EXE

Threat Target Files: MCSHIELD.EXE, MFEVTPS.EXE, MFEVTPS.EXE

Threat Source User Name: NT AUTHORITY\SYSTEM

1 Reply
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: REALTEK HD AUDIO UNIVERSAL SERVICE continuously attempts to both hook and terminate mcafee proce

Third party software can do driver injection into McAfee software and the self-protection functionality would block it, but is this causing an actual issue in either software?  If not, then continue to block it within the McAfee software.  The third party vendor (Realtek in this example) would need to explain why audio drivers (RTKAUDUSERVICE64.EXE; or its related software) are  trying to hook McAfee software drivers.  Modifications to this to exclude the McAfee drivers would need to be implemented by the vendor (if they choose to do so).

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community