Jump to content

GerKaspy

Members
  • Posts

    9
  • Joined

  • Last visited

    Never

Posts posted by GerKaspy

  1. Hi, 

    I got exactly the same in my file server today

    Endpoint Kes 11.2 

     

    Event "Malicious object detected" happened on computer XXXXX in the domain XXX_XXO on 16 September 2021 16:02:04 (GMT+00:00)
    Result:     Detected: HEUR:Trojan.Multi.Crypmod.gen
    User:     XXXXXXXXXX
    Object:     System
    Reason:     Behavior analysis
    Database release date:     16/09/2021 10:40:00
    Remote session:     0x6f0c6af92
    Remote host:     - (XXXXXXXX3)

     

    The interesting the user account which at that time was working remotely do not have access to the folder which the detection has happened

    ********************************************************************************

    Event type:     Object not processed
    Application:     System
    Application\Name:     System
    Application\Path:     System
    User:     NT AUTHORITY\SYSTEM (System user)
    Component:     File Threat Protection
    Result\Description:     Untreated
    Object:     Y:\UserFiles\XXXXXXX\D7BC910F.tmp
    Object\Type:     File
    Object\Path:     Y:\UserFiles\XXXXXXX\D7BC910F.tmp
    Object\Name:     D7BC910F.tmp
    Reason:     Size
     

     

    Any ideas??

     


     

  2. Hi 

     

    I cannot encrypt the 2 new models I have ordered from Dell

     

    Kaspersky Console 12.3

    Endpoint 11.5 

    Latitude 7320 and Latitude 5420

    After I fully decrypt the pre encryption from bitlocker 

     

    I have run the check tool and I am getting

     

    FDE Precheck 11.6.0.1 (Feb  4 2021 09:24:31)
    Start time: 2021-04-14 09:08:07 +0100
    OS: Windows 10  x64  (10.0.18363 SP 0)  UEFI64
    User: XXXXXXXXXXXXXX
    Manufacturer: Dell Inc.
    Model: Latitude 5420
    Firmware: Dell Inc.

    ------------- SUMMARY -------------

    Found compatibility issues.

    ------------- ISSUES --------------

    * [MAJOR] Found active KLFDE driver, version: 6

    * [MINOR] Third party credential provider found:
        File name: C:\windows\SYSTEM32\LMIinit.dll
        Company name: LogMeIn, Inc.
        Product name: LogMeIn
        Product version: 4.1.14344
        File description: LogMeIn Remote Control Helper

     

    After the policy is applied in the reboot (then continues to Windows 10 enterprise 1909)

     

     

    Console error

     

     

    I have disabled in the BIOS Secure Boot  and make sure is UEFI mode. 

    The Drive is M.2 PCIe SSD-1 type 256GB PC sn530 NVMe WDC

  3. Hi

     

    I have the same issue in the Latitude 7320 and 5420 

    FDE Precheck 11.6.0.1 (Feb  4 2021 09:24:31)
    Start time: 2021-04-14 09:08:07 +0100
    OS: Windows 10  x64  (10.0.18363 SP 0)  UEFI64
    User: XXXXXXXXXXXXXX
    Manufacturer: Dell Inc.
    Model: Latitude 5420
    Firmware: Dell Inc.

    ------------- SUMMARY -------------

    Found compatibility issues.

    ------------- ISSUES --------------

    * [MAJOR] Found active KLFDE driver, version: 6

    * [MINOR] Third party credential provider found:
        File name: C:\windows\SYSTEM32\LMIinit.dll
        Company name: LogMeIn, Inc.
        Product name: LogMeIn
        Product version: 4.1.14344
        File description: LogMeIn Remote Control Helper

     

     

     

    Can you help? 

×
×
  • Create New...