CSA 4.x blocking but no wizard available

Unanswered Question
Apr 14th, 2009

The issue I'm having is the help desk is using goto assist. csa is showing a warning and blocking. normally there is a wizard tab after the rule that was triggered. that i usually run to allow a application to run. so now instead i went into the rule "rule 1012 Trojan detection) and go to the area with check box (accessing system functions from code executing in data or stack space) and then i highlight a application class to exclude and then i goto that application class file set and add the executable that give the error. In theory it should work am i missing something

Thanks for any help

Jim2k

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
tsteger1 Tue, 04/14/2009 - 13:46

That should unless something else is superceding it.

My CSA 4.x is a bit rusty but I recall creating application classes for each of the Trojan Detection categories and adding executables to those when I wanted them to be ignored.

Tom

jimmahoney99 Wed, 04/15/2009 - 06:28

so far i tried adding the executable to an application class and then execluding that class in the rule. i also tried creating a new App class and excluding that. any other ideas

tsteger1 Fri, 04/17/2009 - 16:09

The wizard will create an exception that is a separate trojan detection rule so you may want to look and see if there is more than one rule.

It may also stop presenting the wizard if there was already an exception created.

It's been a while since I used 4.x but I remember that particular rule being difficult to manage.

Tom

Actions

This Discussion