Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 1 subscriber
  • Views 8318 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Suspicious behaviour in \\.\globalroot

humungo6

I've just noticed that SEC is reporting suspicious behaviour of a file on one of our servers, but it is in \\.\globalroot...

HIPS/RegMod-002 is the reported behaviour for file lmie.tmp\lmi_rescue.exe, which I am fairly certain will be something to do with LogMeIn, which is installed on certain workstations and we will have used with of third parties dialling in remotely. Using the Sophos knowledgebase, as expected, the regmod-002 description is vague at best, due to the nature of the alert.

Now, I'm not too bothered on this one as I think its safe and it has been blocked as it should've been, but how on earth can I obtain a copy of the file for sample submission, even if only for future reference if I see anything similar again?!

I have tried to "Clean up detected items..." but nothing shows up. All that is left for me to do is "Acknowledge alerts and errors...", so I assume that the file isn't there anymore.

Any thoughts would be appreciated.

:2596


This thread was automatically locked due to age.
Parents
  • 0

    Hello David,

    the computer details window should show you the path to the file. You'll see a path like this e.g. during logon in a domain and further "down" is the interesting part like \\.\globalroot\device\...\your.domain\netlogon\suspicious.exe.

    But if you think it's legitimate you simply authorize it in the policy (Edit policy -> Auhorization ... -> tab Suspicious).

    HTH

    Christian

    :2599
Reply
  • 0

    Hello David,

    the computer details window should show you the path to the file. You'll see a path like this e.g. during logon in a domain and further "down" is the interesting part like \\.\globalroot\device\...\your.domain\netlogon\suspicious.exe.

    But if you think it's legitimate you simply authorize it in the policy (Edit policy -> Auhorization ... -> tab Suspicious).

    HTH

    Christian

    :2599
Children
No Data
Unfiltered HTML