Hi. When I open the menu called “Treat this application as…”, now it only shows me “installer or updater”. “Web browser”, “trusted application”, “blocked application” and so on have disappeared. How can I solve this? Thank you!
That sounds like a typical Defense a+ alert for services.exe, rundll32.exe or regserv.exe. Do you recall for what program the alert was? If so make sure whether it was a Firewall or D+ alert.
Thank you for your answer. Yes, it’s D+, I’m sorry for posting in the wrong place, can you please move it to the right one?
Anyway, until two days ago, D+ used to show me more options. Why have they disappeared and why there’s only “installer or updater” left?
I will move the topic. That’s what we do among other things
For what programs do you see that behaviour? Notice that services.exe can never be given a policy. It needs to be answered on a per case basis; this is by design. The same thing is true for rundll32.exe.
Can you check under Defense + → Advanced → Predefined Security Policies and see if all four policies are still there.
Just checked, there’s no one left… that’s strange. A rootkit attacked my computer a few days ago, but I didn’t think a rootkit could do something like that.
Under the cloak of a rootkit all sorts of programs can run. So, basically anything can happen.
Did you use a registry cleaner around the time the policies disappeared? See if putting restoring a back up made by the cleaner helps. CIS rules are stored in the registry.
Other way to go is to import a back up configuration profile from the CIS installation folder and start from scratch.