Programs getting around the Behavior Blocker

[Mad_Clown]

@EricJH post:20

Did you try running clean up tools for previously installed security programs? Left over services or drivers can cause all sort of strange problems.

I didn’t but only because the only security programs I have used on this computer are CIS and Malwarebytes Antimalware Free, and both are currently installed.

[Citizen_K]

@Mad Clown post:21

I didn’t but only because the only security programs I have used on this computer are CIS and Malwarebytes Antimalware Free, and both are currently installed.

Thanks. MBAM Free is not a known trouble maker.

@Mad Clown post:13

I just did some more testing and when I turned on all the options in the File Rating Settings and restarted my computer, applications like pgcdemux were now listed in the trusted files. So that seems to be expected but when I disabled all of the options except the Trusted Vendors option, then cleared my Trusted Files list and restarted, then it was behaving like before with pgcdemux bypassing the behavior blocker despite not being on the Trusted Files list and not having a digital signature.

To pick up on this once again. Does the same thing happen when you reboot after disabling all File Rating Settings except TVL?

The reason for asking is to see the extend of what it happening.

[Mad_Clown]

@EricJH post:22

Thanks. MBAM Free is not a known trouble maker.To pick up on this once again. Does the same thing happen when you reboot after disabling all File Rating Settings except TVL?

The reason for asking is to see the extend of what it happening.

Yeah the same thing happens. The only way I got those particular programs to show up in the Trusted Files is by enabling all the settings in File Rating Settings. When I only have the TVL on, then they won’t be added to the Trusted Files and they’ll still execute without CIS prompting with a message. Like I said before, most unknown executables do get intercepted by the Behavior Blocker, it seems to be just a certain few that are getting around despite lacking a digital signature and not being on the Trusted Files list.

I also tested those programs using CIS Proactive Security configuration, after reinstalling CIS and they still executed with no prompt or message from CIS. The only option I had enabled in the File Ratings Settings is the TVL.

I would of thought programs like pgdemux and kega fusion would of prompted the Behavior Blocker when other more well known programs like GIMP, ImgBurn, LibreOffice and VirtualBox do get intercepted by the Behavior Blocker. As far as I know these programs are not prompting the behavior blocker: pgcdemux, KProbe2, HashCalc, Mpeg2Schnitt, and DosBox.

[dbrisendine]

Mad Clown - do you have the following enabled on your system?

[attachment deleted by admin]