Oui, j'ai besoin d'une solution
Hi,
My customer send me these logs coming from McAfee, he claims EV is trying to terminate the McAfee processes.
Anyone ever encountered an issue like that?
I thought of including the whole enterprise vault folder from AV scanning, but I want to check first if anyone had this issue before.
Response Name: Threat Severity All
Event Type Name: Threat
Event Description: Access Protection rule violation detected and blocked
Number of events: 1
Product: VirusScan Enterprise 8.8
DAT: , Eng.:
>Source:
Host Name: _
Process Name: C:\Program Files (x86)\Enterprise Vault\StorageServer.exe
URL:
IPV4 addresses: IP Add
>Target Details:
File Name: C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
Host: ServerName, IP Add, Domain\adminev
Port: 0
Process Name:
>Threat Details:
Name: Common Standard Protection:Prevent termination of McAfee processes
Handled: true
Event ID: 1092
Action Taken: deny terminate
Category: 'File' class or access
Severity: Notice
Type: access protection
Event Time: Detected: 02/25/13 17:09:05 UTC, Received: 02/25/13 17:11:39 UTC