Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Kenth
New Contributor II

After update to Forticlient 6.4.6 and 7.0.1, malware real time protection goes wild

Hi,

We're running a forticlientems (7.01) and have a number of versions of forticlient installed at our company.

 

When we upgrade forticlient to 6.4.6 and 7.01 we get real time protection warnings like these,

 

Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

 

as well as for chrome.

 

This is on managed windows 10 computers and we can't find anything on them that we think should trigger this?

 

Anyone has any ideas on how to fix this or how the find out exactly what is causing the problem?

 

Thanks in advance!

Kenth

1 Solution
AlexC-FTNT
Staff
Staff

AntiExploit is a new feature in FortiClient that works by detecting abnormal process spawn behaviors (such as a virus starting running commands in the background, or, more common, a browser process spawning powershell or cmd processes).
For remediation of this behavior (when unwanted), it is already in work Antiexploit exceptions option for future releases of EMS and FortiClient, expected in FortiClient 7.0.3 (not binding or confirmed).
Current workaround (to stop generating these messages) is to disable the "Anti-Exploit" feature (which also disables the feature for other programs as well and limits the protection)

 

Internal reference: 713557 / 688725


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -

View solution in original post

3 REPLIES 3
AlexC-FTNT
Staff
Staff

AntiExploit is a new feature in FortiClient that works by detecting abnormal process spawn behaviors (such as a virus starting running commands in the background, or, more common, a browser process spawning powershell or cmd processes).
For remediation of this behavior (when unwanted), it is already in work Antiexploit exceptions option for future releases of EMS and FortiClient, expected in FortiClient 7.0.3 (not binding or confirmed).
Current workaround (to stop generating these messages) is to disable the "Anti-Exploit" feature (which also disables the feature for other programs as well and limits the protection)

 

Internal reference: 713557 / 688725


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
weiss-ira

Has there been any resolution to this issue aside from turning off Anti-exploit.  We're running FC7.0.7, and it's still an issue.  We added Chrome and Adobe to the exception list and the only way to solve the issue is to remove the add-on.

skolesar
New Contributor II

Had the same issue.   It had to do with extensions.  On one computer, it was Acrobat Browser Helper, another it was LastPass; otherwise working on other systems, some also having been updated.

 

I disabled the Add-In and the problem went away. 

I finally (v6.4.8 build 1753) added chrome.exe to the Anti-Exploit exception list, istead of the blanket feature disable.

(¯·._.··¸.-~*´¨¯¨*·~-.Dont Panic.-~*´¨¯¨*·~-.¸··._.·´¯)
(¯·._.··¸.-~*´¨¯¨*·~-.Dont Panic.-~*´¨¯¨*·~-.¸··._.·´¯)
Labels
Top Kudoed Authors