Anything similar to Faronics Anti-Executables?

It's been a while, but i do believe it was NOT whitelisted.

I assume you tried it. If so, then i don't know.

 

If it was on your system before you installed Exe Lockdown it was whitelisted. I'm not saying it shouldnt have alerted you when you did what you did even if it was whitelisted but that would be a small bug no security risk though.

Thanks,

Chris

 

No, i downloaded for the effect. The only thing i can't remember accurately is if i ran it normally, then ran it with .bat extension.
Ah no, wait a minute, i do believe i blocked .exe and then ran .bat.

 

I stand corrected I just tried it and it is a bypass. This will be corrected asap. Any other extensions i could think of did not bypass it but .bat did. I'll post back when the update is available.

If there is any more extensions you find that escape it please let me know.

Thanks,

Chris

P.S. You are the man

 

Sure, if i try it again, no problem.

But, the main conclusion i took then, and still hold it, is: it blocks by extension. It's a pros and cons vs. XP's own SRP, which is also by extension.

AE is better, and it will take a lot of testing from professionals to convince me otherwise.
The only issue in AE is flexibility, but even that, i have a feeling it was for good reasons besides the "public computers" target.
More focused functionality first, "do one thing, do it right". Blocking executables from change, download, and ultimately execute.

Then they will add flexibility for a broader audience, convinced they have a solid code base.

All guesses and assumptions

 

Exe lockdown doesn't just block by extension but i'm not sure exactly what all the criteria are but i will find out for you and let you know. Erik Albert also was curious about that so it will help a few people.

Thanks again,

Chris

 

Definitely, someone will ask about it, and this would be a good place to point.
Keep us posted.

 

Perhaps it's not as simple, since Process Explorer is not a batch. It's likely that Windows figures out what to do with it, and executes it in a different way.
?