The VTP service (MFEVTPS.exe) inspects DLLs and running processes that interact with Trellix code to verify whether objects are trusted.
An object is a network, file, registry, or process. Trusted means the third-party process is allowed to access Trellix objects. For example, a trusted third-party process is allowed to be injected into Trellix processes or to read Trellix registry keys.
To function properly, the VTP service depends on:
Microsoft Cryptographic service (CryptSvc)
Trust-related APIs
Health of the certificate store or catalog files
Note
The latest package includes binaries signed with updated SHA‑256 certificates. To check the signature correctly, please keep the root certificate store up to date. Replace any missing certificates (KB91697).
Here's how the VTP service works:
A validation check runs when Trellix code needs to verify that the acting process is trusted, the target object is trusted, or both.
When Trellix processes are initialized, the VTP service validates that Trellix is loading trusted code. AAC makes sure that Trellix loads only trusted DLLs.
Only Trellix and Microsoft code are implicitly trusted.
Caching
The VTP service caches the results of a validation check to improve the performance of future validation checks. The VTP service always examines the cache first when performing a validation check.
If a validation check returns a result that the object is not trusted, that object is cached as untrusted.
If an object is cached incorrectly as untrusted, only a cache reset can correct it.
The cache resets when a system restarts in Safe Mode or by running this command:
VTPInfo.exe /ResetVTPCache.
You can also reset the cache from the DAT.
Trust failures
A trust failure is a VTP service validation check that results in "untrusted" when the expected result was "trusted." Trust failures occur because AAC denies access to untrusted code. The process is not allowed to access Trellix processes as a form of self-protection.
Here are some examples of trust failures:
A Trellix process was injected by an untrusted third party, so the process fails a validation check.
A Microsoft catalog-signed file has invalid signing information, so it can't be verified and fails to load by a Trellix process.
A valid DLL file was cached incorrectly as "untrusted," and subsequent attempts to load it are denied.
All of these examples can cause the affected Trellix processes to fail.