Skip to main content
Kenth
Kenth
Explorer
December 14, 2021
Solved

After update to Forticlient 6.4.6 and 7.0.1, malware real time protection goes wild

  • December 14, 2021
  • 2 replies
  • 13309 views

Hi,

We're running a forticlientems (7.01) and have a number of versions of forticlient installed at our company.

 

When we upgrade forticlient to 6.4.6 and 7.01 we get real time protection warnings like these,

 

Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

 

as well as for chrome.

 

This is on managed windows 10 computers and we can't find anything on them that we think should trigger this?

 

Anyone has any ideas on how to fix this or how the find out exactly what is causing the problem?

 

Thanks in advance!

Kenth

Best answer by AlexC-FTNT

AntiExploit is a new feature in FortiClient that works by detecting abnormal process spawn behaviors (such as a virus starting running commands in the background, or, more common, a browser process spawning powershell or cmd processes).
For remediation of this behavior (when unwanted), it is already in work Antiexploit exceptions option for future releases of EMS and FortiClient, expected in FortiClient 7.0.3 (not binding or confirmed).
Current workaround (to stop generating these messages) is to disable the "Anti-Exploit" feature (which also disables the feature for other programs as well and limits the protection)

 

Internal reference: 713557 / 688725

2 replies

AlexC-FTNT
Staff
AlexC-FTNTAnswer
Staff
December 15, 2021

AntiExploit is a new feature in FortiClient that works by detecting abnormal process spawn behaviors (such as a virus starting running commands in the background, or, more common, a browser process spawning powershell or cmd processes).
For remediation of this behavior (when unwanted), it is already in work Antiexploit exceptions option for future releases of EMS and FortiClient, expected in FortiClient 7.0.3 (not binding or confirmed).
Current workaround (to stop generating these messages) is to disable the "Anti-Exploit" feature (which also disables the feature for other programs as well and limits the protection)

 

Internal reference: 713557 / 688725

    weiss-ira
    weiss-ira
    New Member
    January 5, 2023

    Has there been any resolution to this issue aside from turning off Anti-exploit.  We're running FC7.0.7, and it's still an issue.  We added Chrome and Adobe to the exception list and the only way to solve the issue is to remove the add-on.

      skolesar
      skolesar
      Explorer
      April 20, 2022

      Had the same issue.   It had to do with extensions.  On one computer, it was Acrobat Browser Helper, another it was LastPass; otherwise working on other systems, some also having been updated.

       

      I disabled the Add-In and the problem went away. 

      I finally (v6.4.8 build 1753) added chrome.exe to the Anti-Exploit exception list, istead of the blanket feature disable.

      Terms & ConditionsAccessibility statement