NeuShield triggers Suspicious File Modification Detection when running WatchGuard

Posted by by

When running WatchGuard alongside NeuShield you may occasionally get a warning message that says “NeuShield has detected possible malicious file modifications”. This comes from a WatchGuard feature that creates “dummy” files in a folder. Every so often they remove the dummy files and add new files. These folders could contain thousands of files.

See this thread for more details: https://community.watchguard.com/watchguard-community/discussion/110/wg-tdr-critical-file

To prevent the warning message you can add an exclusion in NeuShield for this folder. To do this, the following folders need to be added:


C:\Users\[^\\]*\Desktop\!TDR.Bin\
C:\Users\[^\\]*\Desktop\!WGUA.Bin\
C:\Users\[^\\]*\Desktop\ΩTDR.Bin\
C:\Users\[^\\]*\Desktop\ΩWGUA.Bin\
C:\Users\[^\\]*\Documents\!TDR.Bin\
C:\Users\[^\\]*\Documents\!WGUA.Bin\
C:\Users\[^\\]*\Documents\ΩTDR.Bin\
C:\Users\[^\\]*\Documents\ΩWGUA.Bin\
 

 

See also: Protected Custom Folders

ignored folders.txt
296 Bytes Download