I use CIS 5.3…1237: Sandbox disabled, Defense+ in Paranoid Mode at highest level. I make a test: I launch Ultradefrag.exe ( http://ultradefrag.sourceforge.net/ ): Defense+ alerts me with the first pop up, I set " "; Defense give to me others pop ups, I always answer " block always "; but then I see this:
C - Programs. The strange is that I tried with a lot of other programs and Defense+ worked fine with all them. Anyway, after the installation, if I launch Ultradefrag, Defense correctly alerts me and asks about it.
I installed and uninstalled Ultra Defrag various times. Only the first time I installed it behaved like you described. Other times I had to consent for each step as it gets installed in :\Windows\ folder.
Not sure why it behaved like that the firs time. It had done an online look up according to the D+ logs and it was found safe.
On a sidenote. I am using a mod preview of v5.4; not v5.3.