fax

Behavior Blocker Logs filled-in by MS Livecomm.exe "new process"

Recommended Posts

As per subject, I see the Behaviour Blocker Logs filled-in by the same entry every few minutes. Is this normal?

For the rest everything seems to work perfectly fine...

 

See below a small extract of the logs...

24/11/2014 23:47:16	6572	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
24/11/2014 22:09:26	1244	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
24/11/2014 21:51:46	4708	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
24/11/2014 21:46:17	1476	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
24/11/2014 20:48:43	3748	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
24/11/2014 20:24:53	6768	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
24/11/2014 19:53:35	4348	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 23:26:40	8732	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 23:20:23	4496	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 22:50:23	7804	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 22:20:23	8096	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 22:06:18	3428	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 21:50:23	8936	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 21:23:40	4572	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 21:19:47	7812	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 20:50:23	6880	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 20:42:47	4228	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 20:30:14	7724	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 20:19:29	6420	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 20:16:17	3592	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 19:50:22	844	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 19:20:22	4808	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 18:50:22	3620	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 18:45:46	4348	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 13:27:27	6444	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 12:24:29	3584	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 12:17:25	1292	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
23/11/2014 12:13:01	4328	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess

Thank you in advance for any info or explanations you may have.

 

I am on windows 8.1 64bit

Emsisoft Internet Security v.9.0.0.4570

No other security tool installed.

 

Cheers,

Fax

Share this post


Link to post
Share on other sites

Hello,

 

the log looks normal. If you not want this log entries you can exclude the livecomm.exe process from monitoring. To do this please open Emsisoft Internet Security and go to the section Protection subsection File Guard. Press the button Manage whitelist. Select Process on the Type column and click in the empty field on the Item column. Now click the 3 dots to open the Open File dialog. Select the process

C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe and press OK.

Share this post


Link to post
Share on other sites

Thanks a lot! Ok, done that... a bit problematic as the folder is with limited access, so I had first to take ownership to be able to add it to the whitelist.

If I have additional problems I will come back otherwise...problem solved.

 

Cheers,

Fax

Share this post


Link to post
Share on other sites

I spoke too soon... Still getting logs.

Emsisoft Internet Security - Version 9.0
Behavior Blocker Log

Date	PID	Application	Action	Detection
25/11/2014 21:08:00	3940	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
25/11/2014 20:47:27	3424	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess

Is what I added correct or I miss something?

 

post-34417-0-49053400-1416946656_thumb.jpg
Download Image

 

Thanks,

Fax

Share this post


Link to post
Share on other sites

Update: It seems that now the "new process" is finally not logged anymore.

I am not sure if this is due to a reboot I did or from whitelisting at your end.

 

Anyway, issue finally solved.

 

Thanks a lot for the prompt support.

 

Cheers,

Fax

Share this post


Link to post
Share on other sites

Well... sorry for this LOL.... but, just for your information, it started again. I tried also to update to latest beta but same results.

Lets say its not at all crucial but it would be nice to know why it does this and why exclusion does not work. 

 

Thanks and again sorry for this "it is fixed".... "It is not fixed" Ping-Pong

 

Cheers,

Fax

Emsisoft Internet Security - Version 9.0
Behavior Blocker Log

Date	PID	Application	Action	Detection
28/11/2014 19:48:41	2740	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
27/11/2014 22:35:12	1164	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
27/11/2014 22:24:51	4528	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
27/11/2014 22:09:51	4200	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess
27/11/2014 21:51:06	2696	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe	Allowed by rule	Behavior.NewProcess

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.