Execute Prevent log file

[wmmiller]

Hi Fred,

Would it be possible to have a log file that shows any programs that have been or are being blocked by “Execute Prevent"?

Bill

[Fred]

That would be possible, of course. I bookmarked this for the next update.

[wmmiller]

Thank you Fred. I think it will come in handy.

[wmmiller]

Hi Fred,

I was thinking that it might be a good idea to have a pop that tells you something you’re trying to open has been blocked and give one the option to run the blocked application anyway if one chooses to do so. My thinking is that if Execute prevent is enabled on a customer’s computer and it blocks something they need to use and they can’t get a hold of me they would have the option to run it anyway. This is just an idea and maybe I haven’t thought it through far enough. Actually this happened in a dream and that’s what made me start thinking about it. I’m wondering what you and anyone else here thinks of this.

Bill

[Fred]

Hi Bill.

That's a very good idea, but I'm afraid it can't be accomplished. You see, UVK only sets the Software restriction policy paths. Blocking of programs is handled by the system afterwards. UVK may not even be installed in the moment the blocked application is run.

I guess the best way around is by teaching your clients to add unrestricted paths when necessary.

[wmmiller]

That’s good thinking there Fred. In my scenario UVK wouldn’t be installed. I guess I didn’t think that through all the way. I knew it sounded too easy. Thanks for your reply.

Bill

[Fred]

I don't know if I documented this somewhere, so I'll start by telling it here.

As you certainly know, when you uninstall UVK, it asks you if you want to delete the application backups. If you answer Yes, UVK will remove not only the backups, but also any Execute prevent paths, and will also un-immunize any immunized areas. Only if you answer Yes.

[wmmiller]

Thanks for that information Fred. I don’t recall reading that anywhere on the UVK site but there is much information on the site and it may very well be somewhere. I don’t know how you keep everything straight with program updates, the web site and all the questions and suggestions you get. You must keep good notes.

[Charger440]

I was thinking that was happened but had not had time to research it. I wanted to research it and make sure that was actually happening before I commented. Now I don't have to research it

[Fred]

Hey guys, have you seen the new List affected files feature? This was really a great feature request, because it allowed me to easily get the affected files myself and add the important ones to the ignore list.

[Charger440]

I have not Fred but I will sure check it out and see how cool it is

Jim

[wmmiller]

Hi Fred,

I did see the List affected files feature. I find it to be very handy and appreciate that you added it.

Bill