Hi Team,

One of the users in our network installed DisplayFusion and since then the DisplayFusionService.exe is trying to terminate McAfee's VirusScan related processes. This is resulting in zillions of VSE related point product events on the PC and filling up the McAfee central management solution i.e. ePO's Database.

Why DisplayFusionService.exe trying to terminate Anti-Virus process?
If this is expected behavior then its not looking good as we may have to remove DisplayFusionService.exe

The below is an extract from VirusScan's Access Protection logbr/]


Regards,

Amit Vaidya

My company is also experiencing this. The McAfee access protection rule to prevent termination of McAfee processes is activated whenever a process tries to interact with a protected McAfee process, and explicitly seeks the access mask called TERMINATE_PROCESS, which is a flag that programmers of the 3rd party process, in this case DisplayFusionService.exe, pass along in their request for gaining access/info from the protected McAfee process.

It's a behavior that processes do not need to engage in but has become a fairly common programming practice because the programmers are not using the principle of "least privilege". It is easier for the programmer to seek a higher level of access, even to do mundane things in their program (not actually intending to terminate the process) than it is to take the time to use appropriate levels of access for each task.

This is something that needs to change since it makes legitimate programs appear malicious.