4 Replies Latest reply on Jun 24, 2015 10:27 AM by frank_enser

    Prevent common programs from running files from the Temp folder & IEXPLORE.EXE

    lee@dovehousehospice

      I have started to use the Mcafee Default rules and instantly getting hundreds of alerts from multiple machines triggered by

       

      Common Standard Protection:Prevent common programs from running files from the Temp folder

       

      Source Process Name: C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE

       

      Target File Name: C:\Users\USERNAME\AppData\Local\MICROSOFT\Windows\TEMPORARY INTERNET FILES\Content.IE5\4QT06WEU\CHOSEN[3].CSS   (multiple files not just this one!!!)

       

      If this is a default setting how can it trigger so many alerts from such a common application?  I do not want to exclude IEXPLORE.EXE but surely just turning the rule off is not an option.

       

      Surely there must be a way to sort this out !!!!!

       

      We have got Sophos doing a demo soon and I think we will be looking at moving asap due to massive problems with Mcafee !!!

       

      ANY HELP WOULD BE APPRECIATED