Mamutu and Process Explorer

[Adam Kadmon 0]

When launching Sysinternals Process Explorer on Windows 7 64 Bit, Mamutu will alert the behaviour of procexp64.exe.

The file procexp64.exe only exists during Process Explorer runtime.

Mamutu automatically deletes rules for nonexistent files.

It's not possible to use Process Explorer without Mamutu alert on every program start. (Same goes for Process Monitor)

[GT500 873]

Have you enabled "Paranoid Mode" in Mamutu? It shouldn't be prompting on a file that is digitally signed by Microsoft.

[Adam Kadmon 0]

Yes, indeed I have paranoid mode enabled.

It usually works fine for me. Only ProcessExplorer is a puzzler.

I tried to exclude procexp64. Sometimes the rule sticks until reboot, but sooner or later it vanishes.

[GT500 873]

Paranoid Mode causes Mamutu to ignore the digital signature from Microsoft, and report all behavior regardless of whether or not the file is known to be safe.

In this case, since Process Explorer deleted the 64-bit executable while it is closing, you could try copying it to another folder, and then you would have a backup of the file that doesn't need to be extracted from the 32-bit EXE every time you run it.

[Adam Kadmon 0]

Sorry it took a while...

yes, that works. The 64 executable extracted at runtime can actually be run by itself when copied to another place.

Thanks for that...

[GT500 873]

You're quite welcome.