Access protection blocking On Demand Scanner on Windows XPE (embedded)?

[phl92812]

We are having problems runing on demand scanner tasks on Windows XP Embedded systems.

In the agent logs the task seems to run fine but it only takes 14 seconds to perform a full scan. The OnDemandScanner.txt file does not exist in the targets systems.

We tried to execute the same task diabling the Access Protection, and then, the ODS task runs ok. The AccessProteccion.txt log file does not show anything.

Have anyone experience this issue? Perhaps is something related to the Access Protection and Buffer Overflow  DAT version 647. In ohers systems (WIndows XP, Windows 7, Windows 2003, Windows 2008), the same ODS task is executed without any problem and with the Access protection enabled.

In the Windows XPEs systems we have tried running the ODS task with VSE 8.8 P1, VSE 8.8 P2, and agent versions 4.6 P3 and 4.8.

[ajha1]

Hi phl92812,

Could you please uninstall the VSE, from one of the machine, reboot and re-install it again on one Windows XPEs machine for troubleshoting purpose and check and update the post.

Also mention on How Many machines (Windows XPEs) you are facing this issue.

[phl92812]

Already tried that.

We are going to deploy the former version of the Access Protection an Buffer overflow DAT in one XPE system and see what happens.

We have not deployed the ODS  task to all the XPE  systems, but we have tested about 10 systems and in all of them the ODS does not work as expected.

Regards.

[phl92812 · Accepted solution]

McAfee Support found the problem. It is the issue with the MSI.DLL and the "Prevent hook McAfee Process" access protection rule

https://kc.mcafee.com/corporate/index?page=content&id=KB74174