Endpoint Protection Cloud

Symantec is giving a false positive on an executable for a program that we are using to help block remote desktop password hacks call RDP Defender. The path to the file that is getting flagged is the following:

c:\program files (x86)\rdp defender\rdpdefender-service.exe

I have tried to set the path using the variable like this "[program_files]\rdp defender\rdpdefender-service.exe" and symantec is still flagging the file. Which made me think that [program_files] variable is not for the (x86) folder. 

I have tried to completely spell out the path "c:\program files (x86)\rdp defender\rdpdefender-service.exe" with no success and then I got desperate and used the 8.3 name "c:\progra~2\rdpdef~1\rdpdefender-service.exe" to the path and it is still flagging the file as a virus.

Any suggestions? I am certain the policy is applying to the server as I am just showing a distribution of 90+% and my Remote Desktop Server is not on the list. 

Hi,

To be able to exclude all folder, you may try and add the folder exclusion in the security policy as mentioned on the screenshot below

If you are looking to exclude just one file then please add the following line into "File Exclusions:" field - "C:\Program Files (x86)\RDP Defender\RDPDefender-service.exe"

Hope it helps.

Thanks,

Dmitri