Installer policy not suppressing alerts for installer child processes [M396]

Also please could you tell if if the orphaned ( :slight_smile: ) process that is still being alerted is the program executable.

In theory that might be desirable - you would not want the executable running with full installer privs. Think whjat would happen if you were installing an explorer-substitute. All you files would suddently be run as trusted installers

Best wishes

Mike

Hello,
No its not the program executable. If you are installing an explorer hijacker and you have given it installer rights then thats your fault :stuck_out_tongue:
I want it these rights for my IDEs and program launchers. I dont want to create rules for my own executables as I am .net/java/android/php programer/developer and it can get really annoying.

Furthermore, Iā€™m not sure anymore if this happens as I reported previously or if is a bug or even both. When Iā€™m at work i still get popups sometimes for child processes that are not orphaned.

Iā€™m busy with work and real life problems. I will try to make a video tomorrow.

This is not replicating for the devs. Is it for sure still happening on your system, and is not what mouse1 suggested?

Thanks.

Sorry for the late response. ā€œCloud lookupā€ and ā€œTrust applications signed by trusted vendorsā€ should be disabled for true results. Let me give an example. Try 7stacks an app launcher and try to launch QuiteRSS an RSS feed reader. 7stacks just launches the app and then its terminated so You will get Defence+ alerts for QuiteRSS. So this happens ONLY when the installer(or the parent) process closes and Defence+ shows alerts for its child processes. If its indented to work this way then there is no bugs in CISā€¦

Thank you. I have passed this information into the tracker.

Hi nick55555,

Devs have marked this issue as ā€œFixedā€. Please verify.

Thanks.

itā€™s fixed in v8.0.332922.4281 beta. Plus i have no more memory leaks :smiley:

Iā€™m very happy to hear that. In that case I will move this bug report to Resolved.

Thank you.