cancel
Showing results for 
Search instead for 
Did you mean: 
Reliable Contributor bodysoda
Reliable Contributor
Report Inappropriate Content
Message 1 of 5

VSE OAS - DAT Reputation Message (McAfee DAT Reputation:Protect McAfee DAT Reputation AP Rule Files)

We are trying to install “Microsoft Dependency Agent" on Windows servers. Handful of servers “Microsoft Dependency Agent" installer fails to install.  Does anyone know why VSE access protection is blocking as shown below ? 

Threat Name: Mcafee DAT Repuration Event modification of Mcafee Reputation files
1/09/2018            10:16:57 a.m.    Blocked by Access Protection rule            XXXXX               C:\USERS\XXXXXX\APPDATA\LOCAL\TEMP\XXX\AU_.EXE           C:\Program Files\             McAfee DAT Reputation:Protect McAfee DAT Reputation AP Rule Files              Action blocked : Delete
6/09/2018            11:57:27 p.m.    Blocked by Access Protection rule             XXXXX               C:\USERS\XXXX\APPDATA\LOCAL\TEMP\XXXX\AU_.EXE           C:\Program Files\             McAfee DAT Reputation:Protect McAfee DAT Reputation AP Rule Files              Action blocked : Delete
In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
4 Replies
Highlighted
McAfee Employee johma
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: VSE OAS - DAT Reputation Message (McAfee DAT Reputation:Protect McAfee DAT Reputation AP Rule Fi

HI, 

AU_.exe will most likely be trying to  WRITE/CHANGE  (EXECUTE or  DELETE.) one of our files. This is why it was blocked. 

You have somewhat sanitised the log file, but effectively that rule specifically protects a file that deals with self protection of a DAT Rep component. 

This should not have any detrimental effect for the install of this agent, maybe worth checking with the vendor to see what it may actually be doing. 

The AP rule protects for WXCD file operations. 

I would assume that you are seeing this on all servers where you are trying to install this agent? However, if they installed ok on some machines even where this entry in the logs exist the install failure must be elsewhere.

 




Was my reply helpful?


If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Reliable Contributor bodysoda
Reliable Contributor
Report Inappropriate Content
Message 3 of 5

Re: VSE OAS - DAT Reputation Message (McAfee DAT Reputation:Protect McAfee DAT Reputation AP Rule Fi

Thanks @johma, Yes this agent installed on some server with out issues. Few servers agent installed failed. On t he same servers, if we disable the VSE the agent installation work.
In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
McAfee Employee johma
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: VSE OAS - DAT Reputation Message (McAfee DAT Reputation:Protect McAfee DAT Reputation AP Rule Fi

Hmm, This specific rule is actually hidden and is ACTIVE even when Access Protection is disabled, this rule will still work/trigger.

 

What is also interesting is that this rule does not report triggers either.. have you changed any behaviour on this rule?

 

If you disable Access Protection then the install works, It may be worth looking around

"Common Standard Protection:

  - Prevent Termination of McAfee Ptocesses

  - Prevent Hooking of McAfee Processes

  - Prevent modification of McAfee FIles and Settings"

Are the "usual Suspects" for preventing applications.

Disable these ( block & report ) settings and see if the issue persists.

 




Was my reply helpful?


If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Reliable Contributor bodysoda
Reliable Contributor
Report Inappropriate Content
Message 5 of 5

Re: VSE OAS - DAT Reputation Message (McAfee DAT Reputation:Protect McAfee DAT Reputation AP Rule Fi

What is also interesting is that this rule does not report triggers either.. have you changed any behaviour on this rule?

AFAIK, No there were no changes to VSE rule. 

 

f you disable Access Protection then the install works, It may be worth looking around
 "Common Standard Protection:
  - Prevent Termination of McAfee Ptocesses
  - Prevent Hooking of McAfee Processes
  - Prevent modification of McAfee FIles and Settings"
Are the "usual Suspects" for preventing applications.
Disable these ( block & report ) settings and see if the issue persists.

Thanks for the direction. Will review those rules and report back. 

In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator