Classe ou accès 'Registre' event ID 1092

[BKS_Nesrine]

HI,

I Have the message event below '''AUTORITE NT\Système a exécuté C:\Program Files\McAfee\WebAdvisor\updater.exe, qui tentait d'accéder à HKLM\SOFTWARE\GOOGLE\CHROME\ d'une manière contraire à la règle « Contrôle Web - Clés et valeurs du registre du plug-in Protect », et a été bloqué. 

Nom de la menace : Web Control protect plug-in registry keys and values

Gravité de la menace: Critique 

type de la menace ; autoprotection 

ID de la menace 1092

Fichier Source: C:\Program Files\McAfee\WebAdvisor

Thanks in advence 

[AdithyanT · Accepted solution]

Hi @BKS_Nesrine,

Thank you for your post! This is an interesting catch! Looking into the event, We see McAfee WebAdvisor present on the machine: https://chrome.google.com/webstore/detail/mcafee%C2%AE-webadvisor/fheoggkfdfchfphceeifdbepaooicaho which uses similar components as McAfee Web Control, however this is not an enterprise/Business user product. This is a Home user product from McAfee

So, My guess here is that you have ENS installed on the machine that is protecting access of updater.exe to locations where web control would be present. This is based on the below line:

Nom de la menace : Web Control protect plug-in registry keys and values

Please note that Web Control is an Enterprise product that is usually a part of Endpoint Security. If The above statement of using ENS with Web Advisor is true on the PC under question, I can confirm that this is expected behavior and would recommend removing WebAdvisor and using McAfee Endpoint Security Web Control instead!

I sincerely hope this helps!

[BKS_Nesrine]

HI,
Thank you for your answer , it was helpful, i will try to uninstall WebAdvisor.
😉

[AdithyanT · Accepted solution]

Hi @BKS_Nesrine,

Glad I could be of some help here! By the way, Glad to see you active here and to meet again. Hopefully this resolves your query! Have a nice day ahead and Kudos to you for keeping us updated!