CSA Config - Trojan Detection

[mcvosi]

I have an application class (anti-virus in this case) configured as an exception to the trojan detection policy, however it's not working. No matter what application class I exclude, it seems to be ignored. Seems to be a bug.

[benhur.p]

Any update on this...would be helpful to all if you can post an update...tahnks

[tsteger1]

Would this be McAfee Antivirus and frameworkservices.exe by any chance? If so we are having a similar problem.

[mcvosi]

Nope - Trend.

[bcarroll]

Are you still having this problem? Is the "wizard" avaliable in the event log? IF so, have you created an exception using the wizard?

BC

[mcvosi]

I seem to have solved it with multiple rule exclusions.

[5mlattimore]

Can you post how you did it? We are seeing 'keystroke captruing alerts" from the trojan detection engine for

iexplore.exe

explorer.exe

nnotes.exe

frameworkservices.exe

and a few others

We have created exceptions but the alerts persist as if its not recognizing the EXE file.

So when you say multiple rule excluions, what exactly are you doing?

thx

[tsteger1]

As long as you have those executables in an application class, you can add the application class to the exclusion list of each behavior in the trojan detection rule that triggers the event. If not, you need to create the app class first, then add it to the list. There are several of these rules assigned to different policies so you'll want to make sure you either change each rule for each policy or create one rule and copy it to the other policies. The wizard can help you get started as it can be pretty tricky trying to figure out which behavior is triggering the rule.

Hope this helps...