I suggest you only use "block and notify" options together in each VirusScan Access Protection rule that you know should prevent the type of action it is named after. Wscript in itself is not a virus, although scripts that it executes (from a webpage, for instance) could be harmful. The boldfaced letter event - to me- suggests that there were a browser script that has executed and VIrusScan Access Protection relevant rule (Anti-spyware Maximum Protection:Prevent execution of scripts from the Temp folder') was set to notify-only in the case of such event and creating an ePO event in addition.īrowser scripts always download for execution to the %TEMP% folder so whether you monitor or not, this folder will always be used. )Ĭscript.exe is the command line version of the same (see more at. Wscript.exe is the Windows Scripting Host (see more at.
How do I determine from a packet like this- If its safe to let go the event? I usually see the process name and path to figure out, please suggest if there is a better research process. When I researched about Wscript.exe some have stated it might be a virus. SourceProcessName='C:\windows\Explorer.EXE' TargetFileName='G:\DATACVS\ITS\JHaste\Win2K_OAG\Win2K_PharmNet-f001.vmdk' SourceProcessName='C:\windows\SysWOW64\cscript.exe TargetFileName='C:\Windows\Temp\inv733b_tmp\NIC_Broadcom\BComInv.vbs SourceProcessName='C:\WINDOWS\system32\CCM\CcmExec.exe TargetFileName='C:\Program Files\VMware\VMware Tools\VMwareUser.exe'
SourceProcessName='C:\windows\system32\DllHost.exe' TargetFileName='G:\DATACVS\ITS\JHaste\Win2K_OAG\Win2K_PharmNet-f001.vmdk'
ThreatCategory='hip.file' ThreatSeverity='5' ThreatName='Anti-spyware Maximum Protection:Prevent execution of scripts from the Temp folder' ThreatEventID='1095' ThreatType='access protection' ThreatActionTaken='would deny read' ThreatHandled='1' ProductFamily='VIRUSCAN' IPv6='::ffff:204.67.68.129' InTrustNetwork='' SourceProcessName='C:\WINDOWS\System32\WScript.exe' TargetFileName='C:\Documents and Settings\blosabia.TEA.027\Local Settings\Temporary Internet Files\Content.IE5\2YAXLZ5Z\desktop.ini' Can some one please suggest how we can determine if a provided file path is genuine and ePO threat action can be ignored? I work on Nitro SIEM and currently monitoring the ePO alerts logging to Nitro.
0 kommentar(er)
