8.8 Windows 7 64
When the user attemps to open a folder using Windows Explorer via doble click on the folder the action is blocked and ccessprotectionLog entries are made:
11/23/2011 7:14:28 AM Blocked by Access Protection rule <domain>\<user> C:\Windows\Explorer.EXE C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
11/23/2011 7:14:28 AM Blocked by Access Protection rule <domain>\<user> C:\Windows\Explorer.EXE C:\Program Files (x86)\McAfee\Common Framework\McTray.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
A right click Open works - only the double click causes the events.
A full scan does not find anything.
How can I determine what is trying to run and mess with the McAfee processes?
McAfee VirusScan Enterprise + AntiSpyware Enterprise Version number: 8.8.0 (188.8.131.527) Scan engine version (32-bit): 5400.1158 Scan engine version (64-bit): 5400.1158 DAT version: 6538.0000
Turns out this behaviour was due to my using UltraVNC to remotely access the desktop. The blocking does not happen using the Remote Desktop program.
If someone recognizes this problem and has a fix please let me know.
Truns out not to be VNC related - the local user has the same issue - double clicks appear to be ignored by Windows Explorer becasue VSE is blocking attempts to stop McAffee process - tray icon + ???
I have no clue why Explorer thinks it needs to stop these processes.
Should I just disable VSE and let Explorer have its way?
This is because ePO checks to see if a process is being enumerated with permissions to terminate it. So this can fire if any process that tries to enumerate running processing with permissions that allow it to terminate processes, not necessarily when a process is actually trying to kill a Mcafee process. See:
http://www.google.com/url?sa=t&rct=j&q=prevent%20termination%20of%20mcafee%20pro cesses&source=web&cd=1&ved=0CB4QFjAA&url=https%3A%2F%2Fkc.mcafee.com%2Fcorporate %2Findex%3Fpage%3Dcontent%26id%3DKB53876&ei=3WzvTv2pIdPJ0AG8vf2xCQ&usg=AFQjCNH8p Ze432w23vOPTjIUC5x-yfnmkA&sig2=RlICleLwGH9vLKQaRDl7Fw&cad=rja
Is there a way to discover which program/process is causing the problem?
I'm seeing events each time Windows Explorer is used to open folders. When the rule was enforced a double click wouldn't work. When I dialed back the event to notify a double click works to open a folder.
I don't see any menu items on the context menu that aren't on other PCs.
Pls refer the attached link which will gives u clear idea and how to get rid of that...
Hope this ll heps u.....
All the KB article does is tell you how to supress the event- not that safe IMO if you don't know what is causing the problem. I have 5+ identical PCs and only one is throwing the event.
As asked above - how do I determine what is causing the event?
Did you ever find a solution to this? I have clients running 4.6 agent with VSE 8.8 and I still see numerous explorer.exe prevent mcafee from ....... events. Intel i5 and win7. Based on the KB linked in this discussion this host should not be effected by the false postives, but I suspect there's more to it than just 64bit hosts having the problem.