Skip to content

Commit a01ce33

Browse files
committed
sp_Blitz - Update Dangerous Third Party Modules for AntiVirus
To detect sqlmaggieAntiVirus_64.dll (malware) or anything else labelled AntiVirus. #3149
1 parent fbcbc56 commit a01ce33

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

sp_Blitz.sql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5479,7 +5479,8 @@ IF @ProductVersionMajor >= 10
54795479
OR UPPER(name) LIKE UPPER('%ScriptControl%.dll') OR UPPER(name) LIKE UPPER('%umppc%.dll') /* CrowdStrike */
54805480
OR UPPER(name) LIKE UPPER('%perfiCrcPerfMonMgr.DLL') /* Trend Micro OfficeScan */
54815481
OR UPPER(name) LIKE UPPER('%NLEMSQL.SYS') /* NetLib Encryptionizer-Software. */
5482-
OR UPPER(name) LIKE UPPER('%MFETDIK.SYS'); /* McAfee Anti-Virus Mini-Firewall */
5482+
OR UPPER(name) LIKE UPPER('%MFETDIK.SYS') /* McAfee Anti-Virus Mini-Firewall */
5483+
OR UPPER(name) LIKE UPPER('%ANTIVIRUS%'); /* To pick up sqlmaggieAntiVirus_64.dll (malware) or anything else labelled AntiVirus */
54835484
/* MS docs link for blacklisted modules: https://learn.microsoft.com/en-us/troubleshoot/sql/performance/performance-consistency-issues-filter-drivers-modules */
54845485
END;
54855486

0 commit comments

Comments
 (0)