Is there a possibility to add processes to the low-risk processes list including wildcards and or path?
I find it quite unsafe without, because malware can abuse this by using a processname equal to a low-risked process name.
If had bad intentions I simply read out the low risk processes from the ProcessList registrykey (HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\SystemCore\VSCore\On Access Scanner\McShield\Configuration\Low\) and abuse one of the listed names
and certainly when you want to low rist a process with a common name, by adding the path of the process the risk would be minimized.
DaveMessage was edited by: mcdave on 18/06/14 08:55:51 CDT
I see your point, but at the moment the product works only by adding processes and not accepting wildcards or path.
As you said, there is a risk when using low risk, but you can minimize the risk following the McAfee KB55139
In adition, you could submitt a PER to see if McAfee can change the functionality in the next releases.
To submit a PER, please follow the KB60021:
Please, let me know your thoughts.