topic Re: CSA 5.2 & rootkit detection in Network Security https://community.cisco.com/t5/network-security/csa-5-2-rootkit-detection/m-p/741976#M85857 <HTML><HEAD></HEAD><BODY><P>Tom,</P><P></P><P>thank you very much. You're absolutely right. I trust those applications, so I will make an exclusion for them.</P><P></P><P>Best regards, Marko</P></BODY></HTML> Tue, 28 Aug 2007 12:20:45 GMT m.vuckovic 2007-08-28T12:20:45Z CSA 5.2 & rootkit detection https://community.cisco.com/t5/network-security/csa-5-2-rootkit-detection/m-p/741974#M85851 <P>Hello !</P><P></P><P>On two of our PCs there is special SW installed (Winternals and VMWare. During boot CSA detects this SW as rootkits and puts the systems in untrusted state. What is disturbing is that both machines are then begining to work in TESTMODE. After I reset system state of both agents systems continue to work normal, meaning that CSA is not in test mode anymore.</P><P></P><P>Any clue, how can I avoid putting in test mode when systems start ?</P> Sun, 10 Mar 2019 10:46:01 GMT https://community.cisco.com/t5/network-security/csa-5-2-rootkit-detection/m-p/741974#M85851 m.vuckovic 2019-03-10T10:46:01Z Re: CSA 5.2 & rootkit detection https://community.cisco.com/t5/network-security/csa-5-2-rootkit-detection/m-p/741975#M85855 <HTML><HEAD></HEAD><BODY><P>Hello Marko, the Rootkit Lockdown Module is in testmode (by default) so anything triggered by the system state will also be in testmode. </P><P></P><P>I don't believe the systems are in testmode, just the alerts from this rule.</P><P></P><P>Tom </P></BODY></HTML> Tue, 28 Aug 2007 05:24:39 GMT https://community.cisco.com/t5/network-security/csa-5-2-rootkit-detection/m-p/741975#M85855 tsteger1 2007-08-28T05:24:39Z Re: CSA 5.2 & rootkit detection https://community.cisco.com/t5/network-security/csa-5-2-rootkit-detection/m-p/741976#M85857 <HTML><HEAD></HEAD><BODY><P>Tom,</P><P></P><P>thank you very much. You're absolutely right. I trust those applications, so I will make an exclusion for them.</P><P></P><P>Best regards, Marko</P></BODY></HTML> Tue, 28 Aug 2007 12:20:45 GMT https://community.cisco.com/t5/network-security/csa-5-2-rootkit-detection/m-p/741976#M85857 m.vuckovic 2007-08-28T12:20:45Z