2 Replies Latest reply on Feb 28, 2012 1:32 PM by pwolfe

    Problems with McAfee self protection

      There a few settings in VSE Access protection related to protection of the various McAfee components.   In VSE 8.8 it seems McAfee has been getting more and more aggressive with how they go about this protection.  This is leading to issues.


      I currently have servers where we can not kill hung processes as we  could prior to VSE 8.8 P1.   The process we are trying to kill had mfeavfk.sys running as a subordinate thread.   The only way to solve the issue is to reboot the machines. 


      I also had case where a svchost.exe process and  McAfee Protection Validation service where combining to use 100% of the CPU on a multicore system.  Again neither process could be killed.  Logs showed that Access Protection was protection the McAfee service.  Again reboot was the only way out.


      With VSE 8.8 I have been told major changes in the Self Protection methods were made.   Now when SMS inventories running processes for its licensing features, it trips an access protection rule and generates warnings.   Since SMS is used to distribute software I don't like the idea making exceptions for it, and letting it do what ever it wants. 


      Are others having issues with more aggressive Self Protection in VSE 8.8?


      I certainly understand the need for the Self Protection.   But with being more aggressive comes more unintended consequences.   Other peoples code is not always perfect.   We can not just rip out the other vendors code because now it McAfee is tripping over it.  The old stuff has squatters rights.   There needs to be a way turn off the newer features without cutting back on the stuff that does work.





      Herb Smith