New Antiexecutable: NoVirusThanks EXE Radar Pro

C:\WINDOWS\system32\cmd.exe /c "C:\Program Files (x86)\360\Total Security\safemon\chrome\360webshield.exe" --parent-window=0 chrome-extension://glcimepnljoholdmjchkloafkggfoijh/ < \\.\pipe\chrome.nativeMessaging.in. * > \\.\pipe\chrome.nativeMessaging.out. *

Watch carefully and leave a space between red dot and asterisk.

 

Also take a look at this post and next ones:
https://www.wilderssecurity.com/thre...ks-exe-radar-pro.300552/page-197#post-2551557

 

Okay....Thanks

 

.

 

@marzametal so I was feeling all smug thinking I didn't have an issue with NVT ERP in a SUA BUT as soon as I logged into my Admin account to do something... I found the 'Trusted Vendors' list and 'Whitelist' were both reset to default Everything works fine as long as i stay in the SUA - I guess i can live with this - i'll just export my settings for the few times a year i need my Admin account

 

Q: wildcard question re spaces.
for example \12.3.4.56\
I've tried \*\ and \ * \ and \*.*.*.*\ and \ *.*.*.* \with no joy...so, what do you think....where to add space...?
Do I add space before and after * or ? or .

 

You can't use Wildcard with those lines; cmd.exe is the parent and is in the vulnerable processes list , so you will ALWAYS have an alert whatever you do ; unless you remove it from the list , which i don't suggest.

 

wildcard with Whitelist Command-Lines....edit command line string.
e.g.,
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.2.15\coNatHst.exe" --parent-window=0 chrome-extension://cjabmdjcfcfdmffimndhafhblfmpjdpe/ < \\.\pipe\chrome.nativeMessaging.in.* > \\.\pipe\chrome.nativeMessagi

 

cmd.exe = vulnerable process

 

Well, string goes to Command-Lines and has been there from almost day one with multiple strings.
I thought after reading about spaces I could narrow down 15 strings.
So, Vulnerable like cmd and rundll cannot be wildcard.
Well, that's good to know.
So, I can Whitelist coNatHst.exe and no work-around for changing 22.5.2.15

Um, what about default Command-Lines with cmd and rundll + wildcards...?

 

It is up to you if you want reduce security alerts for more comfort.

 

Sorry, and sorry for being thick.

So, ERP default can employ wildcards with cmd and rundll...... but, I can't.... or shouldn't or can't or may or ?

 

You can but it is pointless until you remove cmd & rundll from vulnerable process list, i personally won't do that , security win over comfort. if you can't handle alerts , shift to another product.

 

I don't get alerts for coNatHst.exe (Norton browser extension).
Since, ERP default employs wildcards with cmd and rundll.
I presumed I could....
I like Alerts, hence I have ERP on Alert Mode.
Once trained. Alert has been quiet for trained.

 

Same here. Contrary to the "silent type" I actually thrive on Alert Notifications especially with AUDIO!!!

 

Q: re Allow system protected. When I have "Allow system protected" checked.
Does "Allow system protected" override Alert Mode alerts and or Lockdown Mode alerts for Vulnerable Processes that are "system protected".
Meaning, will I still get alerts for Vulnerable Processes with Allow system protected checked.

 

Yes.

 

Good, W10 in-place upgrade has been throwing a lot more alerts than W8.1, even with whitelist running. So, I checked Allow system protected until W10 gets settled. Thanks!

 

FWIW ~ here's my Vulnerable Processes. Easier for me to manage in ERP, then edit to other. Back to Lockdown Mode, allow system protected not checked, allow from programs files not checked, no trusted vendors ~ YMMV

Spoiler: ERP Vulnerable Processes

C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscript.exe
C:\WINDOWS\system32\cscript.exe
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\rundll32.exe
-10
C:\Windows\SysWOW64\wscript.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
C:\Windows\System32\vssadmin.exe
C:\Windows\SysWOW64\vssadmin.exe
C:\Windows\SysWOW64\bitsadmin.exe
C:\Windows\System32\bitsadmin.exe
C:\Windows\System32\bcdedit.exe
C:\Windows\SysWOW64\mshta.exe
-20
C:\Windows\SysWOW64\mstsc.exe
C:\Windows\System32\mshta.exe
C:\Windows\System32\mstsc.exe
C:\Windows\SysWOW64\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\reg.exe
C:\Windows\SysWOW64\reg.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
C:\Windows\System32\DiskSnapshot.exe (blacklist)
-30
C:\Windows\System32\dmclient.exe (blacklist)
C:\Windows\System32\CompatTelRunner.exe (blacklist)
C:\Windows\System32\dstokenclean.exe (blacklist)
C:\Windows\System32\setx.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.486_none_7640e086266ea227\TiWorker.exe
C:\Windows\System32\Defrag.exe
C:\Windows\System32\MRT.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
-40
C:\Windows\SysWOW64\msra.exe
C:\Windows\System32\msra.exe
C:\Windows\SysWOW64\regini.exe
C:\Windows\System32\regini.exe

LUV to NVT

 

@ bjm --- Thanks!!!

 

work in progress > W10 has a few, head scratch.

 

Q: what does ERP do when same item on more than one filter...e.g., Whitelist and Vulnerable.
Seems item in Vulnerable may also be Whitelisted.
at least for me e.g., > C:\Windows\SysWOW64\svr32.exe will add to Whitelist okay while also (and remains) in Vulnerable (same hash).

 

The vulnerable list "overrules" the Whitelist.
Application = whitelisted + on the vulnerable list = Prompt
Application = whitelisted + not on the vulnerable list = No prompt

 

Thanks!, and Blacklist "overrules" Vulnerable.?. And Whitelist / Blacklist are either or.?.
Edit: and with item in Vulnerable, I may also add item to Blacklist.

 

The Blacklist should have the highest priority (it's "final")
If something is in the blacklist = blocked.
Even if it's in the whitelist / vulnerable / whitelist command-lines list.