I had started with Defense+ disabled. I then set to paranoid, unchecked the deactivate box, and rebooted. (I also have the trust certified apps unchecked)
Upon rebooting, Defense+ learned everything that was already running, and then started giving me alerts for new things.
With IE set as a browser, and Defense+ set in paranoid mode, here’s what happens
- CPIL asks to access the keyboard directly
–I blocked - I type some text and hit Test 1.
- First time it said it wanted to access memory directly
–I Blocked - First time it said it wanted to access cpil.exe
–I blocked
result: nothing
Subsequent times it gets through with no alerts
(I DID NOT remember any responses)
I’m not liking this outcome.
I’m going to go back to v2, and wait until some of these things get more ironed out. 