How to block Microsoft tool.

[Former Member]

Dear Team,

We have a Microsoft troubleshooting tool with extension *.diagcab. Can we stop it from being execution.

Thx in advance for your time!!

[BenEllis]

1. you can block it by banning hash or name.

https://docs.mcafee.com/bundle/application-change-control-8.3.x-product-guide-windows/page/GUID-F0F9...

https://docs.mcafee.com/bundle/application-change-control-8.3.x-product-guide-windows/page/GUID-1881...

you cant block all extension unfortunately. but if you are using tie. You could set the reputation and block based off reputation. 

[Former Member]

Thx BenEllis for your time!!

I tried to bane it by SHA-1 value through this command: sadmin auth –b –c <checksumvalue>

But below is the result of the command: 

C:\Program Files\McAfee\Solidcore>sadmin auth -b -c abda636c99b021c9e624812d3f5d41a33ee8fd5f
Too many arguments.
Type "sadmin help auth" for help.

Any insight!!

[BenEllis]

odd what version you on? i did this same command on 8.2.6 and it worked fine. 

[Former Member]

Thx Benjamin Ellis!!

It's weird. Now it's okay. But having executed it I'm still able to run the file. For your reference I have attached the file. The file name is "MicrosoftProgram_Install_and_Uninstall.meta.diagcab". 

Thank you. 

[BenEllis · Accepted solution]

Thank you the reason you cannot block this is because in 8.2.1.435 and above we added VTP trust. Which auto allows Microsoft and Mcafee Certs no matter what. 

If you really need to block this you can open a case and we can see what we can do to disable this feature. but VTP was added in 8.2.1 Update 4 and above. 

How the Validation and Trust Protection service works

The VTP service (MFEVTPS.exe) inspects DLLs and running processes that interact with McAfee code to verify whether objects are trusted.

An object is a network, file, registry, or process. Trusted means the third-party process is allowed to access McAfee objects. For example, a trusted third-party process is allowed to be injected into McAfee processes or to read McAfee registry keys.

To function properly, the VTP service depends on:

• Microsoft Cryptographic service (CryptSvc)
• Trust-related APIs
• Health of the certificate store or catalog files

Here's how the VTP service works:

1. A validation check runs when McAfee code needs to verify that the acting process is trusted, the target object is trusted, or both.
2. When McAfee processes are initialized, the VTP service validates that McAfee is loading trusted code. AAC makes sure that McAfee loads only trusted DLLs.

Only McAfee and Microsoft code are implicitly trusted.

Caching

The VTP service caches the results of a validation check to improve the performance of future validation checks. The VTP service always examines the cache first when performing a validation check.

• If a validation check returns a result that the object is not trusted, that object is cached as untrusted.
• If an object is cached incorrectly as untrusted, only a cache reset can correct it.

The cache resets when a system restarts in Safe Mode or by running this command:

VTPInfo.exe /ResetVTPCache.

You can also reset the cache from the DAT.

Trust failures

A trust failure is a VTP service validation check that results in "untrusted" when the expected result was "trusted." Trust failures occur because AAC denies access to untrusted code. The process is not allowed to access McAfee processes as a form of self-protection.

Here are some examples of trust failures:

• A McAfee process was injected by an untrusted third party, so the process fails a validation check.
• A Microsoft catalog-signed file has invalid signing information, so it can't be verified and fails to load by a McAfee process.
• A valid DLL file was cached incorrectly as "untrusted," and subsequent attempts to load it are denied.

All of these examples can cause the affected McAfee processes to fail.

[Former Member]

Thx Ben for your great detail!!