CSA REFUSE execution of the EXE, BUT DO NOT THE READ.

We have V4.5.616 CSA

I would like a rule which denies running the exe, but allows reads them.

The rule I have for now denies both.

If a user opens a directory that contains the reading part is triggered to exe, I want only the rule to trigger if they try to run, THERE IS A WAY?

Thank you

OK, so what you want is a rule that allows a list of directories of all files, but does not have one of them must be performed? You want to prevent users just run the executable file manually, or you want to restrict the set of the system of execution of their? Am I correct in that you are trying to protect a specific directory and not all on the disc?

Create a new file defined, I suggest naming "restricted directories:

Corresponding directories: (regardless of the directories you are trying to restrict)

C:\Secret_Folder\**

@ Fixed: \PathTo\AnotherDir\**

@ removable:------*.

\\Office1\Data\**

@network: \Office Data\Programs\ *.

Files:

*.exe

*.com

*.cmd

*. PIF

*. SCR

*.bat

*. WSH

*.vbs

*.HTA

Create a new class of Application, I suggest naming "shells execution queue.

* \explorer.exe

* \cmd.exe

* \COMMAND.com

* \taskmgr.exe

Alternatively, you can simply use the 'Shell command' and 'MS explorer' if they are available, but I can't find any other classes that include "taskmgr.exe" (which can call executable files outside of the Windows Explorer).

Now, create another class of Application, it will be "executable Directory-Restricted. Put "$Restricted folders" in the list.

Then create a new control rule Application 'A' attempted in protected execution folder, with the following options:

Take the following steps: refuse

When

The following applications in the selected classes: "run file shells.

But not in one of the following classes selected: None

attempt to run

New applications in the following selected classes: "executable Directory-Restricted.

But not in one of the following classes selected: None

Tags: Cisco Security

Similar Questions

  • isqlplussvc.exe memory could not be read error

    I get an error "isqlplussvc.exe memory could not be read error" at windows xp startup which is very confusing!

    If I remove the file:
    C:\oracle\product\10.2.0\client_2

    The error disappears by all my holiday of ODBC connections.

    If I put the rear backrest, returns the error...

    Advice greatly appreciated!

    (And some explanations about why there is a client_1 folder as a folder client_2!)

    Thank you!!

    It is you need or use iSQLPlus? Or you simply annoyed by the message. You can disable the startup automatic iSQLPLUS during OS reboot in the Panel--> Services. If you need to use iSQLPlus then try to fix it. But iSQLplus must be running on your server not your customer.

    You had client2 and client1 is because you installed Oracle client twice at any given time. Check your connection ODBC see what ORACLE_HOME they use. If you only need one, uninstall one of the Oracle client.

  • I need win32hlp.exe but can not download.

    I tried to download win32hlp of microsoft link that the program in question sent me but the link does not work.

    Just says it moved or unavailable. Help please

    I tried to download win32hlp of microsoft link that the program in question sent me but the link does not work.

    Just says it moved or unavailable. Help please

    You have not said where you went to download the file, but here's a link that works.

    http://www.Microsoft.com/en-US/Download/details.aspx?ID=91

  • can I add a menu item to the messaging application during execution (after the reading of the object and decide whether to add this menu item or not)?

    Hi all...

    can I add a mail application menu item when running...

    I want to open a mail, depending on its content, I want to decide whether to add an element or not or at least change the name of my customized according to the context of the email...?

    Please help anyone

    still no

  • While trying to update Adobe, I keep getting the error HKEY_LOCAL_MACHINE32\SOFTWARE\MICROSOFT\WINDOWSNT\CurrentVersion\Image file execution Option\AcroRd32Info.exe.

    Original title: Error 1402

    Hi, updating Adobe but error HKEY_LOCAL_MACHINE32\SOFTWARE\MICROSOFT\WINDOWSNT\CurrentVersion\Image file execution Option\AcroRd32Info.exe. and request "check that you have sufficient access to that key.

    I saw on the net demand UtilitiesTech that their software would fix this problem.  Paid $43 .00AUD find still with the same problem.  I have "Cat live would be" their technology who asked away from my PC, I said no, he said that he could not fix the problem unless it is remote my PC.  My question is is this a legitimate claim of the software UtilitiesTech provider and why they say they may need to distance your PC before paying their fees.  I would not have paid and downloaded their software if I knew in advance that the solution involved "opening the door" in my PC.

    Thanks in advance for any advice.

    This is a Fix - It Ms that can help.  I found it after a few other errors of 1402 in Win 7

    https://support.Microsoft.com/en-us/mats/program_install_and_uninstall

  • Need help to remove malware dfrgsnapnt.exe have found solutions on the internet, but do not know if they can trust.

    Recently, my PC started to boot the system & web surfing very slowly, making me suspect a virus. I found this file on my computer (dfrgsnapnt.exe) running Microsoft troubleshooting, but have not spotted on my C: drive again. Did a quick search on the internet and learned that it is malware. There are patches and downloads of free software on the web, but I don't know which ones is safe!

    Hello NoBen,

    Please read this article, it contains all the information about the malware troubleshooting
    Fix Firefox problems caused by malicious software

    Just reply back to us.

  • After you have installed the KB2707511 and updates KB2724197, error in execution of NTVDM.exe.

    Original title: problem with KB2707511 and KB2724197 updates.

    When you enter a DOS program I get a failure of execution of NTVDM.exe. Remove these updates restores normal operation. Anyone know if there are risks in doing this?

    Hi LeRoy,

    If I understand correctly you will receive an error by, NTVDM.exe running, after having installed the updates KB2707511 and KB KB2724197. However once you uninstall the updates, the problem is resolved, is that correct?
    I apologize for the inconvenience, please note that it is a known problem and Microsoft released a supported fix to help solve the problem.
    Please follow the links below to help troubleshoot-made the question.

    I suggest you reinstall the security updates that you uninstalled and then run the fix as suggested to solve the problem.

    KB2707511 and KB2724197

    MS12-042: Description of the update of security for Windows XP and Windows Server 2003: 12 June 2012
    http://support.Microsoft.com/kb/2707511

    According to the section more information under, known issues with this security update.


    The hotfix update is available,

    "NTVDM. EXE has encountered a problem and needs to close"error message when you use 16-bit applications in Windows XP
    http://support.Microsoft.com/kb/2732488

    Once you run the hotfix you can continue to install the rest updates normally.

    Please let me know if the problem has been resolved, or if you need additional help on the issue.

    I hope this helps.

  • Im trying to install my first than Pro CS4, the first disc installs fine but the 2nd disc refuses to install. I have searched a downloadable version, but can not find a. any ideas how I can actually complete installation?

    Im trying to install my first than Pro CS4, the first disc installs fine but the 2nd disc refuses to install. I have searched a downloadable version, but can not find a. any ideas how I can actually complete installation?

    Download & install instructions https://forums.adobe.com/thread/2003339 can help

    -includes a link to access a page to download the Adobe programs if you do not have a disk or drive

    -you will need to enter your original serial number during the installation for non-Cloud programs

    - or kglad links in response to #1 here can help https://forums.adobe.com/thread/2081216

    Also go to https://forums.adobe.com/community/creative_cloud/creative_cloud_faq

    - and also read https://forums.adobe.com/thread/1146459

  • How can I activate Technicon in adobe elements first 13? I can see it running in the Manager of tasks as elementsautoanalyzer13.exe but didn't interrupt the process in the case where he assigned to the program.  There must be a way inside the adobe progra

    How can I activate Technicon in adobe elements first 13? I can see it running in the Manager of tasks as elementsautoanalyzer13.exe but didn't interrupt the process in the case where he assigned to the program.  There must be a way inside the adobe program to turn off because I turned it on by clicking with the right button on an image in the editor of the first, and then when you are prompted, he said he would run in the background and I said okay, now I can't stop it! .  It appears in earlier versions of first items under Edit-> Preferences-> media analysis you could uncheck it to turn it off.  But there is only a media section and in this tab, there is no automatic Analyzer to be seen.  Thanks in advance for any advice

    Rebeccah

    What computer operating system? You are in the first elements 13/13.1 editor preferences or in organizing elements 13/13.1 preferences?

    Where are you looking for in organizing elements 13/13.1 that you do not see Edit Menu/preferences /-media analysis that you do not see the options of AutoAnalzyer.

    Organizing elements 13/13.1 preferences...

    Please point out where you find a command to run AutoAnalzyer in the background in 13/13.1. If I right click a file, I see AutoAnalzyer perform what seems to be a time run command automatic Analyzer of a file.

    Please specify.

    Thank you.

    RTA

  • I have the last El Captain MAC update fom and an iMac Mid 2015 retina but Lightroom refuses to use the GPU indicating a display error. Has anyone else experienced the same question?

    I have the latest update of El captain and an iMac Mid 2015 retina but Lightroom refuses to use the GPU indicating a display error. Has anyone else experienced the same question?

    I also got an iMac mid 2015 27 "retina and not have problems. But I have another option 'see the add screen pictures"deselected it's the ravages of a single reading. See screenshot of my graphics card.

  • Shortcuts in Vista, go to the correct exe file but will not run

    I ran numerouse reg fixes, automatic and mannual.  Some bad shortcuts Guide others go right back but will not open them.  The problem is with the lnk shortcuts

    I ran numerouse reg fixes, automatic and mannual.  Some bad shortcuts Guide others go right back but will not open them.  The problem is with the lnk shortcuts

    Here is a tutorial on how to rebuild your cache of icons. Your icons cache may be corrupted.

    http://www.Vistax64.com/tutorials/117229-icon-cache-rebuild.html

    Option One is easier. For the benefits of others looking for answers, please mark as answer suggestion if it solves your problem.

  • During execution of the backup and maintenance on one of my computers, I noticed a folder and the file that I can't identify me...

    Original title: identity of unknown folder

    During execution of the backup and maintenance on one of my computers (Windows xp home, sp3), I noticed a folder and the file that I can't identify.  The name of the folder is cc68f6b7a7ca948eefb018f001 and the name of the update.exe file.  The properties of the file that it is a Windows Service Pack installation.  I tried Googling the name of the folder, but found nothing.

    Can you tell me with regard to this issue, and what, if anything, I have to do?

    Thank you.

    When some programs (including Windows) installs things, it can create a temporary folder composed of 20-30 random letters and numbers or random numbers and letters in the root of the drive of the volume with more free space.

    This explains why the records are sometimes on your C drive or any other drive - the most space?

    For example, you can see a similar to or called folder:

    D:\9470bb12e8a4f3447657236478e41c5

    There may be other folders and files in this main temporary folder such as amd64 and i386 platforms.

    They should normally be deleted when the installation is complete, but sometimes they are not - especially if the installation fails.  They are harmless but annoying.  You can think something is wrong when there are no or fear, that the files are really necessary.  To avoid confusion, you can delete the temporary files.

    If your installation has failed or the installation does not remove the folder to the random name when it finishes running again installation will be another folder at the random name.

    You may be able to identify installation (out of curiosity) by looking at some of the contents of the folder and decide if this installation was not serious, just remove the files/folders.  If the installation does not work for some reason, run again just installation will create a new temporary folder to the random name so the old temporary folder is really useless.

    Records are sometimes tough to remove.  Even if you are an administrator on the system, you might get a "sharing violation", "access denied", "used" or type similar message when you try to delete temporary folders.  Facilities sometimes use different permissions that can have a regular user with the administrator group.

    There are many methods to try to remove the folders, and some require third party programs to install or change some windows settings that could compromise the security of your system if you do not change them back when you're done.

    Start your system in Mode safe mode (by pressing the F8 key several times just before XP attempts to load) is one good method to try to remove the files because it does not have to make any changes to your system configuration or by downloading third-party programs.

    If you are running XP Home Edition, the following section on turn off "Simple file sharing" does not apply to you since in XP Home, Simple file sharing is always turned on.  If you are running XP Home Edition, skip the next few paragraphs and resume where it says:

    "If no part tool above work try a third popular called Unlocker.

    If Safe Mode does not work you can change the security of the folder when you start in Normal Mode to give your username full control over the files by navigating to it in Solution Explorer, click on tools, Folder Options, view and in the advanced settings window, uncheck (at the bottom of the list) use simple file sharing (recommended) and click OK.  This disables him recommended simple file sharing on your computer if you want to turn it back on when you're done to make everything you do.

    Right-click on the files of interest, click Properties and click the now visible security tab.  Change the properties, but you need (for example, select your user name, and check the box to allow full control), click OK to apply the changes.

    With usage share of active simple files (recommended) the checked the properties of the folder tabs are:

    General, sharing, customize

    With the use of sharing files simple disabled (recommended) box unchecked, the properties of the folder tabs are:

    General, security, customize

    Now, try to manipulate/delete the folder.

    It's a good idea to go back to the Explorer and the cheque in the box easy to use sharing files (recommended) when you have finished making everything you do.

    If none of the above works, try a popular third-party tool called Unlocker.

    Unlocker can be downloaded here:

    http://www.emptyloop.com/Unlocker/

    If you use Unlocker, be sure to install because he wants to add a bunch of options, addons, shortcuts and other extras that you don't need.

    You must add the shell extension so when you right click on the offending file, you will have a Unlocker option to choose.  I would just install it long enough to clean up the leftovers and then, I usually just uninstall and all parts of it.  You can always install it again another day if you like.

    Unlocker can be uninstalled when you have finished using it.

    Reboot when finished to ensure that boring records are really missing.

  • Firefox is already running but is not responding. The old process of Firefox must be closed to open a new window.

    When I try to open Firefox, I get this message:
    "Firefox is already running but is not responding. The old process of Firefox must be closed to open a new window. »
    I then clicked close firefox, but the problem was solved not so I uninstalled and reinstalled firefox, but it's the same thing.
    At this point, I went to support Mozilla and tried the steps described in the article, "Firefox is already running but is not responsible for - How to fix error message", but the firefox.exe process was not in the processes tab in windows Task Manager. While he was in the Details tab, when I tried to put an end to the process, I received this message:

    "The operation could not be completed. Access is denied. "

    What can I do to fix this?

    Thank you.

    Usually when you stop and restart Windows, Firefox is not running and can be started normally.

    Firefox is set to start automatically with Windows? Microsoft has a utility to investigate what is set to happen at startup: https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

    It is possible that something is triggering a process in your default browser and it is the hanging of Firefox. You can try to change your default browser to IE (IE can offer to do when you start) before the shutdown and restart Windows to see if it makes a difference.

  • I have message handler Firefox is already running but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system. It is NOT open I onlly have a computer

    I installed FF on my new computer, Windows 7 Toshiba, I get the message Firefox is already running but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system. It is NOT open I have only one computer.
    I had a computer scientist to try everything, and we cannot on it to open it.

    Search the firefox process firefox.exe and kill him with for example the Task Manager. It is also worth watching for the plugincontainer.exe.

    The problem and the solutions are explained in the articles:

  • I downloaded the last Adobe Flash - it is said to be successful but will not work. What he says "Manage plugins but the plugin says it is enabled, but it will not work." I have tried disabling and then enabling - without success.

    I downloaded the last Adobe Flash - it is said to be successful but will not work. What he says "Manage plugins but the plugin says it is enabled, but it will not work." I have tried disabling and then enabling - without success. Help, please!

    There are two different versions of Flash. ActiveX for IE version and the version of the Plugin for other browsers. Have you installed the correct version? This forum software is not thing that Flash is installed for Firefox or the Plugin is disabled.

    1. download the file of configuration Flash from here:

    Adobe Flash - Plugin version.

    Save it to your desktop.

    2. close Firefox using file > exit

    Then check the Task Manager > processes tab to make sure that firefox.exe is closed.

    {XP: Ctrl + Alt + Delete, Vista: Shift + Ctrl + ESC process tab =}

    3. then run the Flash configuration from your desktop file.

    4. run Firefox and test your installation here: https://www.adobe.com/software/flash/about/

    • On Vista and Windows 7, you may need to run the installer of plugin as administrator by starting the installation program via the context menu if you do not get a UAC prompt for permission to continue (that is to say that nothing seems to be happening).

    See this:

    http://vistasupport.MVPs.org/run_as_administrator.htm

Maybe you are looking for