cancel
Showing results for 
Search instead for 
Did you mean: 

Re: VSE 8.8 can't detect virus


Hi All,

This rule is working fine, but i want whenever this type of file/folder find in the system or usb, mcafee antivirus automatically delete these type of file.

Regards

Furqan Ahmed

Reliable Contributor ansarias
Reliable Contributor
Report Inappropriate Content
Message 12 of 25

Re: VSE 8.8 can't detect virus

Hello,

Yes McAfee will always block these files on system and usb connected to that machine.

Highlighted

Re: VSE 8.8 can't detect virus

Hello,

Thanx for the reply, when i scan my system some ink file are on the system but macfee cannot delete these file.

Regards

Furqan Ahmed

mapc
Level 7
Report Inappropriate Content
Message 14 of 25

Re: VSE 8.8 can't detect virus

Hello,

That rule would block all new lnk files from being created, it will not delete existing ones.

However, I would think twice about blocking all new lnk files as they are used heavily in Windows, for the start menu etc...

B reg,

Mattias

Re: VSE 8.8 can't detect virus


Thanx for the reply,

But i want whenever the Mcafee antiviurs detect these type of file it consider it as virus and delete it.

Regards

Furqan Ahmed

mapc
Level 7
Report Inappropriate Content
Message 16 of 25

Re: VSE 8.8 can't detect virus

You could add *.lnk as a user-defined item in the Unwanted Programs Policies.

That would cause VSE to treat all lnk files as a virus and delete them.

I would recommend to start small though and test it on one or two clients first.

Regards,

Mattias

Re: VSE 8.8 can't detect virus


Hi Mapc,

when i try to create rule as user-defined item in the unwatnetd programs policies, plicy assigment doesnot allow me to add *.Ink file types in "file name". It cannot accept the "*" in the file names, they want the proper file name.

Regards

Furqan Ahmed

mapc
Level 7
Report Inappropriate Content
Message 18 of 25

Re: VSE 8.8 can't detect virus

Hi Furqan,

Sorry. Just entering .lnk without the * seems to pass validation. Not sure if it works in reality though...

B reg,

Mattias

Re: VSE 8.8 can't detect virus


Sorry. Just entering .lnk without the * seems to pass validation. Not sure if it works in reality though...


AP doesn't validate what you are trying to block. * is a wildcard, by entering *.lnk is will include any file with extension .lnk. Not having the start before will have AP check for a file with no name and .lnk

Also note that blocking .lnk file creation is a mitigation process only and will not stopping the offending process from attempting to create them.

Run process monitor on an infected system and file results to those creating malicious .lnk, that will help you locate the machine file to submit to McAfee.

HTH

mapc
Level 7
Report Inappropriate Content
Message 20 of 25

Re: VSE 8.8 can't detect virus


AP doesn't validate what you are trying to block. * is a wildcard, by entering *.lnk is will include any file with extension .lnk. Not having the start before will have AP check for a file with no name and .lnk

Yes, for AP, but do you know if the same applies to Unwanted Programs?

B reg,

Mattias

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community