To stay updated on your favorite discussions, please create an account or log in. Then, click the Bookmark icon to subscribe and receive notifications.

Exception wont work

Options
TaNi
TaNi W/ Alumni Posts: 1 Security Scout
in WithSecure Elements Endpoint Protection

Hey

 

Kinda new with this so if someone could help out. We keep getting allert for one file:
Backdoor.PCClient.TCB    C:\Users\user.name\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000004A8.bin 

 

I have tried to create exception to the profile that this computer uses:
%allusersprofile%\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\*.bin
C:\Users\user.name\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\*.bin

 

But neither of these seems to work... still getting the alerts. Any ideas?

 

Comments

  • Vad
    Vad W/ Alumni Posts: 1,069 Cybercrime Crusader
    Options

    Hello TaNi,

     

    Please, note:

    - Variables are not supported.

    - Whenever wildcards * or ? are used in an exclusion, you have to type backslash twice.

     

    *\\harddiskvolume1\\Users\\user.name\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\tmp\\*.bin    should work for you. If it will not, please, contact support.

     

    Best regards,

    Vad

  • etomcat
    etomcat W/ Alumni Posts: 1,172 Firewall Master
    Options

    Hello,

     

    > We keep getting allert for one file

     

    Submit the file to F-Secure virus lab, so they can fix the false alarm centrally:

    https://www.f-secure.com/en/web/labs_global/submit-a-sample

     

    Note: don't forget to tick "I want to give more details.." and fill in the data, so they can send you a response with the revised verdict in e-mail.

     

    Best regards: Tamas Feher, Hungary.

This discussion has been closed.

Categories