No McAfee Icon in System Tray

[User91972758]

Hi All,

I'm running McAfee Agent Version 5.5.1.462 on some of my companies endpoints and the System Tray Icon is not appearing.

I open CMD.exe and run:

c:\program files\McAfee\Agent\Cmdagent.exe -s

to try try and jumpstart the status monitor, and the system icon still fails to appear. Even attempting to edit the McAfeeUpdaterUI registry key fails to bring the icon up.

From what I've understood is that a system re-boot also tends to resolve this, but I will need to check with our support team to see if this is possible. 

Has anyone else seen similar issues as of recent?

[cdinet · Accepted solution]

In c:\programdata\mcafee\logs, check the mfemactl log for any entries for mctray blocked. 

That would indicate possible dll injection blocking mctray from running.  You can also check the application event log for any faulting application errors.  If you see something like a faulting application error in that log referencing gdiplus.dll, then that is fixed in 5.6.1.

[User91972758]

Hi @cdinet,

Looks like SVCHOST.exe is being blocked by the Protect MA Process since we have agent self protection on:

2019-06-17 16:38:49.371 mfemactl(4920.6952) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(684) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\mfemactl.exe=""> via the rule
2019-06-17 16:38:49.387 mfemactl(4920.6952) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(684) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\updaterui.exe=""> via the rule
2019-06-17 16:38:49.387 mfemactl(4920.6952) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(684) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\mctray.exe=""> via the rule
2019-06-17 16:38:49.387 mfemactl(4920.6960) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(684) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\updaterui.exe=""> via the rule
2019-06-17 16:38:49.402 mfemactl(4920.6964) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(684) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\macompatsvc.exe=""> via the rule</aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe>

I'm looking into getting this taken care of now. Which this would explain the icon not appearing since UpdateUI.exe is blocked 😛

[cdinet]

No, in that case svchost is the one blocked from injecting into our processes.  When we are blocking ourselves due to an actual injection, you will see our process as the one blocked, not the other way around.  So that is not the issue necessarily. Follow kb82170 to enable some debug mctray logging to see if it will show any errors.  Do you see any mctray crashing in the event logs? 

As for the fix supposed to be in 5.6.1 for the crashing I mentioned, that was an older entry I was looking at in the defect for it.  It actually won't be fixed till MA 6.0 (no eta).  So hopefully you aren't seeing the process crash.

I would suggest possibly still testing with the 5.6.1 agent, it could just be a bad install of the agent.

[User91972758]

Ah, gotcha.

I'm not seeing any other blocks, however I did find this post KB today and it is a virtual system - https://kc.mcafee.com/corporate/index?page=content&id=KB83532&sns1214, could this be relative? I'm working on getting the McAfee Agent debug logging setup as well to look for any crashing events.

[cdinet]

The agent policy has an option to show or not show the agent tray icon in a remote session.  It is off by default due to times when it is a citrix server, for example, there would be too many mctray processes running (one for each session).  In your case, I believe you said running updaterui.exe didn't help bring up the try icon, or did I misunderstand?  If that works, then yes, that KB applies.

[User91972758]

You are correct. I attempted forcing the icon to appear by executing upadaterui.exe and unfortunately still no luck.

I was using RDP, which apparently is a terminal service, I've just never seen this occur on similar systems.

[cdinet]

Yea, there is something wrong when that won't invoke mctray, even in a remote session.  That's why I also suggested upgrading the agent to see if that resolves.

[City_SW]

Same here

Anwendungspopup: mctray.exe - Einsprungpunkt nicht gefunden: Der Prozedureinsprungpunkt "GdiplusStartup" wurde in der DLL "C:\Program Files\McAfee\Agent\x86\mctray.exe" nicht gefunden.

Thats from Eventlog plus

btw we run VDI with Move Agent 4.8.0 192, Agent 5.6.1.308 and DLP 11.0.700

2019-07-24 13:53:45.555 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 13:53:45.570 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 13:55:21.602 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mcscript_inuse.exe="">(3976) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\winhttp.dll> via the rule 2019-07-24 13:55:21.617 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mcscript_inuse.exe="">(3976) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\resutils.dll> via the rule 2019-07-24 13:55:21.617 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mcscript_inuse.exe="">(3976) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\clusapi.dll> via the rule 2019-07-24 13:56:14.836 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 14:00:32.091 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 14:00:32.185 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 14:01:08.664 mfemactl(6532.6556) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(10120) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:08.664 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(10120) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:08.679 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(10120) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:08.695 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(10120) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\program files\citrix\system32\mfaphook.dll=""> via the rule 2019-07-24 14:01:08.695 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(10120) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\program files\appsense\environment="" manager\agent\wow64\emloader.dll=""> via the rule 2019-07-24 14:01:11.228 mfemactl(6532.6500) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8816) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\program files\citrix\system32\mfaphook.dll=""> via the rule 2019-07-24 14:01:11.228 mfemactl(6532.6500) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8816) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\program files\appsense\environment="" manager\agent\wow64\emloader.dll=""> via the rule 2019-07-24 14:01:11.228 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8816) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:11.228 mfemactl(6532.6556) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8816) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:11.228 mfemactl(6532.6508) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8816) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:25.691 mfemactl(6532.6508) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8904) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:25.691 mfemactl(6532.6556) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8904) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:25.691 mfemactl(6532.6508) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8904) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll> via the rule 2019-07-24 14:01:25.691 mfemactl(6532.6556) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8904) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\program files\citrix\system32\mfaphook.dll=""> via the rule 2019-07-24 14:01:25.691 mfemactl(6532.6232) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\mctray.exe="">(8904) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\program files\appsense\environment="" manager\agent\wow64\emloader.dll=""> via the rule 2019-07-24 14:01:25.738 mfemactl(6532.6500) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 14:01:25.754 mfemactl(6532.6500) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 14:01:31.898 mfemactl(6532.6500) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 14:04:12.905 mfemactl(6532.6500) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 14:04:12.967 mfemactl(6532.6500) mfemactl.Info: The process <c:\program files\mcafee\agent\x86\macompatsvc.exe="">(6476) was blocked from accessing('CREATE' (1)) <aac_object_section:c:\windows\syswow64\msxml3.dll> via the rule 2019-07-24 14:04:22.499 mfemactl(6532.6500) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(1092) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\masvc.exe=""> via the rule 2019-07-24 14:04:22.499 mfemactl(6532.6232) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(1092) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\macmnsvc.exe=""> via the rule 2019-07-24 14:04:22.499 mfemactl(6532.6556) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(1092) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\macompatsvc.exe=""> via the rule 2019-07-24 14:04:22.499 mfemactl(6532.6556) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(1092) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\macompatsvc.exe=""> via the rule 2019-07-24 14:04:22.499 mfemactl(6532.6508) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(1092) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\mfemactl.exe=""> via the rule 2019-07-24 14:04:22.499 mfemactl(6532.6508) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(1092) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\x86\mfemactl.exe=""> via the rule 2019-07-24 14:04:22.499 mfemactl(6532.6500) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(1092) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\macmnsvc.exe=""> via the rule 2019-07-24 14:04:22.499 mfemactl(6532.6232) mfemactl.Info: The process <c:\windows\system32\svchost.exe>(1092) was blocked from accessing('WRITE, DELETE' (a)) <aac_object_process:c:\program files\mcafee\agent\masvc.exe=""> via the rule</aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_process:c:\program></c:\windows\system32\svchost.exe></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\program></c:\program></aac_object_section:c:\program></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\program></c:\program></aac_object_section:c:\program></c:\program></aac_object_section:c:\program></c:\program></aac_object_section:c:\program></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.14393.2485_none_f67b3d2af24e2795\gdiplus.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\windows\syswow64\clusapi.dll></c:\program></aac_object_section:c:\windows\syswow64\resutils.dll></c:\program></aac_object_section:c:\windows\syswow64\winhttp.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program></aac_object_section:c:\windows\syswow64\msxml3.dll></c:\program>

[cdinet]

In your log entry, our processes are definitely being blocked. For example: mfemactl.Info: The process <>(3976) was blocked from accessing('CREATE' (1)) <> You will need to identify all the dll's that are doing the injection and follow KB88085 to help remediate them. If the dll's have no certificates, then you might try upgrading the product that belongs to or remove it if it is not being used.