0 Replies Latest reply on Mar 6, 2017 11:18 AM by albertop

    Event 1092

    albertop

      Hi all,

      I attached the logs that I need to understand if I have to investigate something malware or could be the server reboot the root cause.

       

      the process SVCHOST.EXE

      try to stop the follow...

       

      C:\PROGRAM FILES (X86)\MCAFEE\VIRUSSCAN ENTERPRISE\MFEANN.EXE

      C:\PROGRAM FILES (X86)\MCAFEE\VIRUSSCAN ENTERPRISE\SHSTAT.EXE

      C:\PROGRAM FILES (X86)\MCAFEE\VIRUSSCAN ENTERPRISE\VSTSKMGR.EXE

      C:\PROGRAM FILES\COMMON FILES\MCAFEE\SYSTEMCORE\MCSHIELD.EXE

       

      NOTE: all included in "Prevent modification of McAfee Scan Engine files and settings" rule

       

      Thanks in advance.

      Best Regards

       

      Albe