CLOSED BB and notepad.exe

[stapp 130]

Windows 10 1809 - EAM 8988

Frank if I go to BB and select ''add application rule'' browse to notepad.exe, select it  and choose blocked, I can still open notepad.

When I do open notepad I get 2 entries in BB list one listed as monitored, and one listed as blocked

See screenshot.

(Also why does it say n/a when you go to add an application rule?)

 

Download Image

[Frank H 91]

you added a block rule for c:\windows\notepad.exe, right?

when you start notepad from the windows start menu,  it still runs, right ?

when you check the shortcut in the w10 start menu, you will notice it starts %windir%\system32\notepad.exe, which is a different exe than the one you excluded, right ?

so yeah, notepad, and some others have twin brothers in a different folder.

this indeed is a highly confusing thing in Windows.

[stapp 130]

3 minutes ago, Frank H said:

 

so yeah, notepad, and some others have twin brothers in a different folder.

I hope malware doesn't too

What about the n/a when you go to add an application rule?

[Frank H 91]

1 minute ago, stapp said:

What about the n/a when you go to add an application rule?

UI bug