Tak można, w ustawieniach.A można w nim wyłączyć silnik clam?
Changes in 7.5.8
New
Bugfixes/Enhancements
- Exploit Prevention
- Protect processes running from network drives
- Protect processes running remotely
- Prevent AppControl bypass through rundll32
- Prevent Windows User Account Control bypass
- Protect against credential theft from Internet Explorer and Edge by Mimikatz
- Detect shadow copy deletion
- Protect against SAM hash credential theft by Mimikatz
- Protect previously running processes
- Fixed exploit prevention compatibility issues with McAfee
- General Performance Improvements
- Chrome Credential protection
- AMSI bypass protection
- Exclusions
- The connector now supports wildcards (‘*’) in Process Exclusions. This wildcard will not expand beyond path separators
- Exclusion performance enhancements.
- Miscellaneous
- Addressed an issue with malicious Ethos file detections not being quarantined if seen more than once
- Addressed a race condition that may end in BSOD when the driver verifier was used in conjunction with the connector
- Implemented scan optimization in script protection scanning by using the caching mechanism for unknown disposition
- New capability to send additional Microsoft Windows update build revision information to improve risk-based OS vulnerability interference capability
- Improved the uninstall process of the connector
- Added support for the BypassIO feature in Windows 11
- This version is the last to support legacy operating systems such as Windows 7 and 8, Server 2012, and all 32-bit versions of Windows.
- Exploit Prevention
- General performance and stability improvements for the exploit prevention engine
- Fixed exploit prevention engine compatibility issues with Zoom
- Fixed a bug that caused Outlook to crash when exploit prevention was enabled
- Addressed an issue where clients were experiencing a blue screen on Windows Server 2012 with the exploit prevention driver when upgrading to 7.5.1. (CSCwa59221)
- Addressed an issue that caused exploit prevention to fail to after a connector upgrade. (CSCvz83877)
- Improved exploit prevention engine for:
- Script control functionality (wmi detection in plugins/macros)
- Atom bombing protection mechanism
- User access control bypass mechanism (false positive reduction)
- Handling a potential crash in Windows 7
- Behavioural Protection
- Script protection has been enhanced to use the same core detection engine as behavioural protection to be able to detect fileless malware attacks using a signature-based mechanism
- Behavioral protection engine improved to be able to match activity on the endpoint that occurs in a specific order
- Behavioral Protection engine updated to be able to detect command line argument spoofing
Bugfixes/Enhancements
- Fixed an issue where Google chrome won't start after applying Microsoft (2023-06) patches. (CSCwf66658)
- ClamAV 0.104.3 patched with the fixes for the vulnerabilities:
- CVE-2023-20197
- CVE-2023-20052
- Updated expat to 2.5.0 to fix multiple vulnerabilities:
- CVE-2022-43680
- CVE-2022-25314
- CVE-2022-23990
- CVE-2022-40670
- CVE-2022-22825
- Curl updated to 8.1.0 to fix multiple vulnerabilities:
- CVE-2023-28322
- CVE-2023-28320
- CVE-2023-28321
- CVE-2023-23914
- CVE-2023-23915
- CVE-2023-23916
- CVE-2023-27533
- CVE-2023-27534
- CVE-2023-43551
- CVE-2023-45552
- Sqlite updated to 3.42.0 to fix the vulnerability:
- CVE-2022-46908
- Zlib updated to 1.2.13 to fix the vulnerability:
- CVE-2022-37434
- Libxml2 updated to 2.11.4 to fix the vulnerabilities:
- CVE-2023-28484
- CVE-2023-29469
- Ciscossl updated to 3.0.9 to fix the vulnerabilities:
- CVE-2022-3786
- CVE-2022-3602