EPO and MA agent logs showing blocked via the rule

[lostbear]

Anybody know why these logs are appearing on the MA logs for the workstations and how to fix these rules?

EPO 5.3.1

2018-04-09 12:16:06.573 mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE> was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MACMNSVC.EXE> via the rule <Protect MA Processes>

2018-04-09 12:16:06.573  mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE> was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MACMNSVC.EXE> via the rule <Protect MA Processes>

2018-04-09 12:16:06.573  mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE> was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MASVC.EXE> via the rule <Protect MA Processes>

2018-04-09 12:16:06.573  mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE> was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MACOMPATSVC.EXE> via the rule <Protect MA Processes>

2018-04-09 12:16:06.573 mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE> was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MFEMACTL.EXE> via the rule <Protect MA Processes>

2018-04-09 12:16:06.573 mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE> was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MASVC.EXE> via the rule <Protect MA Processes>

2018-04-09 12:16:06.573 mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE> was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MACOMPATSVC.EXE> via the rule <Protect MA Processes>

2018-04-09 12:16:06.573 mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE> was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MFEMACTL.EXE> via the rule <Protect MA Processes>

[Daniel_S]

I have seen this many times on different systems.

If I remember right we also had a case open with McAfee back in like 2014 or so.

It was nothing to worry about, and I wouldn´t recommend to exclude the svchost.

[cdinet]

Those are entries for the agent self protection preventing injection into its processes.  They are normal and can be ignored for svchost.  There is no way to exclude any processes for self protection.  When you want to be concerned is if functionality is impeded somehow with other processes being blocked.