Possible bug with Malware Defender ???

Discussion in 'other anti-malware software' started by LoneWolf, Dec 26, 2008.

Thread Status:
Not open for further replies.
  1. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,408
    Malware Defender has been working just fine untill recently i've noticed that tring to change an application execution rule from Permit to Deny or Ask does not change anything.
    Sure it says Deny or Ask but will still allow the app to be executed. (normal mode selected)
    (See screenshots)

    fileassassin shot.png

    fileassassin 2.png

    Nothing in the logs too.
    File Assassin is just an example, the same goes for any and all other application rules. What ever the rule is I cannot change (be it permit,ask or deny)
    Still MD set in Silent mode will block unknown apps and exes as well as
    MD set in normal mode will give a pop up to ask.
    It is just for rules already created. I tried to delete a rule and create a new one but even with new rule set to Deny MD will permit o_O
    A'm I doing something wrong or could this be a bug of some sort?
    It has been fine as far as I know up untill v1.2.3
    Anyone else notice this?
     
  2. xiaolin

    xiaolin Registered Member

    Joined:
    Aug 11, 2008
    Posts:
    248
    Hi,

    If you have created child application rule in explorer.exe to permit File Assassin, the execute permission of File Assassin will be ignored.

    Changing the execute permission of File Assassin to DENY or ASK will only affect the parent app which have lower priority rule.

    You can find the following description in help file:
    If an action of creating process is detected, Malware Defender will search application rules for child process also. If the execute permission of child process is not "Permit", and the rule priority is higher than the matched rule of parent process, then the execute permission of child process will be used.
     
  3. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,408
    That was it. :thumb:
    Thank you very much xialon :D
     
  4. demonon

    demonon Guest

    I encountered the same problem! You have my gratitude too Xaolin.
     
Loading...
Thread Status:
Not open for further replies.