[How to create a blacklist set of files]

I will have a look and see if the mods get around a few concerns

 

thks

[How to create a blacklist set of files]

Thanks for the reply.

 

The idea of blocking filenames is not just for malware and virus-related purposes it also stops users from installing a pre-set of unwanted programs. Users with admin rights are forever installing programs by themselves (torrent related) or accidently due to software updates (drivermagician.exe etc).

Yes viruses change the executable name but we have also found that there are a lot that keep the same executable file name. These additions are an additional layer of protection.

The sysinternals suite seems a bit complex and time consuming to adapt. Possibly group policy may help.

The idea of blocking entire folders is valid and used carefully. EG C:\PROGRAM FILES\TIXATI\*.* will block users from installing the torrent client.

 %homepath%\AppData\Roaming\*.exe  - this is a recommended Mcafee insertion that we have used and never had any issues.

 

I still feel that there should be a mechanism to restrict users from running a set file name.

  

Thanks

[How to create a blacklist set of files]

Hello,

We have just migrated from Mcafee EPO. We are using the latest version of ESET endpoint for windows.  We are told that we cannot create a policy that stops computers creating the following files from any process. We could with Mcafee EPO. Examples below.

Stop creating the file in any folder  EG..
myresume.exe
news.exe
DriverMagician.exe
driverupdate.exe
partypoker.exe
Payment order details.doc

Stop the folder being created EG..
C:\PROGRAM FILES\TIXAT

Even wildcards in any folder  EG..
*.tmp.tmp
*.lol!
*.toxcrypt

Wildcards in a specific set of users folders  EG..
%homepath%\AppData\Roaming\*.exe

Has anyone found a way?

Thanks in advance.