cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Event log flooding with McLogEvent 257

Hello,

Since I moved my 200 windows xp systems to another newer ePO server the event log of all the systemens are flooding with McLogEvent 257.

"Would be blocked by access protection rule  (rule is in warn-only mode) (Anti-spyware Maximum Protection:Prevent installation of new CLSIDs, APPIDs and TYPELIBs)."

In the Action Protection Log I see alot of these entries:

9/06/201512:01:49Would be blocked by Access Protection rule  (rule is currently not enforced)%username%C:\Program Files\Internet Explorer\iexplore.exe\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}Anti-spyware Maximum Protection:Prevent installation of new CLSIDs, APPIDs and TYPELIBsAction blocked : Delete
9/06/201512:01:49Would be blocked by Access Protection rule  (rule is currently not enforced)%username%C:\Program Files\Internet Explorer\iexplore.exe\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\InprocServer32Anti-spyware Maximum Protection:Prevent installation of new CLSIDs, APPIDs and TYPELIBsAction blocked : Create

Does somebody knows how to stop this? (not by disabling the Anti-Spyware Protection warning mode on Prevent installation of new CLSIDs, APPIDs and TYPELIBs)

I am running Agent version 4.8 Patch 3 and VSE 8.8 Patch 4

Kind regards

2 Replies

Re: Event log flooding with McLogEvent 257

Moved to ePO for faster response.

---

Peter

Moderator

Re: Event log flooding with McLogEvent 257

Well to stop it, you would add iexplore.exe in the "processes to exclude" portion of that AP policy, however, I would be a bit leary of just throwing IE into that rule if you are using that rule for something specific in your environment.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community