cancel
Showing results for 
Search instead for 
Did you mean: 
mcdave
Level 10
Report Inappropriate Content
Message 1 of 2

adding low-risk processes with path and wildcards

Hi,

Is there a possibility to add processes to the low-risk processes list including wildcards and or path?

I find it quite unsafe without, because malware can abuse this by using a processname equal to a low-risked process name.

If had bad intentions I simply read out the low risk processes from the ProcessList registrykey  (HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\SystemCore\VSCore\On Access Scanner\McShield\Configuration\Low\) and abuse one of the listed names

and certainly when you want to low rist a process with a common name, by adding the path of the process the risk would be minimized.

regards,

Dave

Message was edited by: mcdave on 18/06/14 08:55:51 CDT
1 Reply

Re: adding low-risk processes with path and wildcards

Hi Dave,

I see your point, but at the moment the product works only by adding processes and not accepting wildcards or path.

As you said, there is a risk when using low risk, but you can minimize the risk following the McAfee KB55139

https://kc.mcafee.com/corporate/index?page=content&id=KB55139

In adition, you could submitt a PER to see if McAfee can change the functionality in the next releases.

To submit a PER, please follow the KB60021:

https://kc.mcafee.com/corporate/index?page=content&id=KB60021

Please, let me know your thoughts.

Cheers,