cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

REALTEK HD AUDIO UNIVERSAL SERVICE continuously attempts to both hook and terminate mcafee processes

For some reason, the realtek audio driver keeps attempting to both hook and terminate mcafee processes on a consistent basis.  I've placed some details below to get a better understanding of the issue.  This happens over 2,000 times a day per system.  Has anyone run into an issue like this?  I really don't want to allow an audio driver to perform these actions (terminate or hook into mcafee processes)

ePO 5.3.1

HIPS 8.0.0.4480

Security Content: 8.0.0.8725 

Patch 10: 

Driver Name and File: REALTEK HD AUDIO UNIVERSAL SERVICE (RTKAUDUSERVICE64.EXE) 

- Signature Name: Access Protection - Prevent hooking of McAfee processes

Threat Source Process Name: C:\WINDOWS\SYSTEM32\RTKAUDUSERVICE64.EXE

Threat Target Files: MCSHIELD.EXE, MFEVTPS.EXE, FIRESVC.EXE, MFEANN.EXE, MFEFIRE.EXE

Threat Source User Name: NT AUTHORITY\SYSTEM

- Signature Name: Access Protection - Prevent termination of McAfee processes

Threat Source Process Name: C:\WINDOWS\SYSTEM32\RTKAUDUSERVICE64.EXE

Threat Target Files: MCSHIELD.EXE, MFEVTPS.EXE, MFEVTPS.EXE

Threat Source User Name: NT AUTHORITY\SYSTEM

1 Reply
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: REALTEK HD AUDIO UNIVERSAL SERVICE continuously attempts to both hook and terminate mcafee proce

Third party software can do driver injection into McAfee software and the self-protection functionality would block it, but is this causing an actual issue in either software?  If not, then continue to block it within the McAfee software.  The third party vendor (Realtek in this example) would need to explain why audio drivers (RTKAUDUSERVICE64.EXE; or its related software) are  trying to hook McAfee software drivers.  Modifications to this to exclude the McAfee drivers would need to be implemented by the vendor (if they choose to do so).

ePO Support Center Plug-in
Check out the new ePO Support Center. Simply access the ePO Software Manager and follow the instructions in the Product Guide for the most commonly used utilities, top known issues announcements, search the knowledgebase for product documentation, and server status and statistics – all from within ePO.