Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

McAfee DAT 4715 false positives and CSA

Has anyone seen or heard of the effects that the McAfee DAT 4715? Was anyone running CSA - and if so, how did it respond? I'm anxious to find out if CSA would have stopped this behavior...

http://isc.sans.org/

2 REPLIES
Silver

Re: McAfee DAT 4715 false positives and CSA

To the best of my knowledge, the 4.5 system replaces the network worm heuristic with a user-configurable rule module. You can configure this worm rule module to display a query popup, a straight deny, or an allow.

Note: These options are similar to other configurable rule types

http://www.cisco.com/en/US/products/sw/secursw/ps5057/products_qanda_item09186a008049ad72.shtml#qa12

Blue

Re: McAfee DAT 4715 false positives and CSA

CSA would have stopped it only if you didn't allow deletion or renaming of the affected files (and how would you have guessed that ahead of time?).

We allow our AV software unrestricted access to all files so we would have been affected had we not switched from McAfee to another vendor last November.

Whew...

126
Views
0
Helpful
2
Replies
CreatePlease login to create content