This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cant make an Exception work

Hi
I have a file that is being flagged as a PUA that I want to keep, NirCmd (nircmd.exe). I'm trying to create an exception to stop it from being flagged.

I created 2, even uploaded a copy to the suspicious file exception .

I still get
- Threat: Adware or PUA 'NirCmd' (of type Other) has been detected.
Status: Cleanupable
Action: Blocked
Scan type: Unknown
Type: P UA

I finally had to just turn off PUA scanning all together.

Is there something I'm doing wrong, or a different kind of exception needed?

This thread was automatically locked due to age.

0 BrucekConvergent over 12 years ago

I don't think you are doing anything wrong, I think some of the exception capability is broken. I've seen this here too.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael3245 over 12 years ago

Have you tried allowing it on the endpoint? You should not have to configure it on the utm. To allow it you would need to go to the computer you want this on. Open sophos endpoint go to configure and under that list should be a choice for exexptions i can look and post screen shots soon if you would like. I have to do this for the school i am at they use sophos as well.

Sent from my DROID BIONIC using Astaro.org
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael3245 over 12 years ago

Ok I said I would get back about the endpoint and wanted to check in. Here is where you would allow a file on the endpoint client. See attachment. Also did you figure it out?

And yes I help the school IT Staff with sophos alot as well so the endpoint is kind of my area [:D]
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 12 years ago in reply to Michael3245

Michael--you are missing the point. One is supposed to be able to configure the exceptoin from the UTM; it does not currently work. Manually configuring such an exceptoin on the Endpoint is not the answer -- the bug needs to be fixed.

Newimage, I will report the bug to Sophos Support.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael3245 over 12 years ago

True but it was a suggestion to try for now. I know it could be done. Sorry if I seamed harsh about the other temp solution. True I see what he is trying to do now push a application policy out from the utm i was going by it was only one pc needing this.
Cancel
Vote Up 0 Vote Down

Cancel
0 NewImage over 12 years ago in reply to Michael3245

Thank you Michael, yeah I just turned off PUA scanning for now, it affects a large number of computers.

Once the bug gets fixed ill turn it back on.
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael3245 over 12 years ago

No problem. Glad I could help you [:D]

Speaking of that file name is it form a testing system called IQ Systems for Microsoft office certification by any chance? I have seen that file name somewhere but cannot place where.
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 12 years ago

NirCmd - Windows command line tool

Nir Sofer makes a ton of incredibly useful free tools for windows admins.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 chrish16 over 10 years ago

I know this is an old thread, but has the bug been fixed as we can't get it to work on UTM 9.2
Cancel
Vote Up 0 Vote Down

Cancel

Cant make an Exception work

Submitted a Tech Support Case lately from the Support Portal?