AMSI is Not Responding

[tmelville]

I recently updated my system to the newest agent and patched the ENS endpoint platform and threat prevention. This message however I think I've seen before the updates. AMSI appears to be some type of interface to Windows 10. Does anyone have background on troubleshooting this? Is there a service that's supposed to be running? Thanks!

[tzemva]

Hi @tmelville,

In the ENS 10.6.1 we addressed issue with McAfee Agent Security Status wrongly reports ENS Component status; See ENS 10.6.1 Release Notes (see reference 1236546 in PD27825)

Can you please verify if you see same behaviour with ENS 10.6.1 installed.

Thank you!

[tmelville]

Hi: Above is a snip from epo which shows the products installed on the PC in question (which is actually the PC I use every day in the IT Dept).

[tmelville]

I've rebooted my system and the ! indicator is no longer present. I'll reply to this forum post if it re-appears. I thought I've rebooted once last week and it went away but returned. I'll advise either way. Thanks-

[tzemva · Accepted solution]

Hi @tmelville

McAfee Security Status is updated by McTray.exe process which belongs to McAfee Agent. If mctray.exe is unable to receive status from ENS it will display and alert with information that specific module is not responding. There can be many reasons why mctray.exe is not receiving status from ENS; I asume here that information in McAfee Security Status is wrong and ENS is working OK;

- Make sure you have McAfee Agent Self-Protection enabled! If mctray.exe has been injected by 3rd party DLL's, ENS would not trust it anymore and therefor not replay to its query for module status;

Anyway if you still expirience this behaviour please open an Service Request with Enabeling Team (McAfee Agent) to further investigate why mctray.exe is not reporting correct status for ENS module.