Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 954760" data-attributes="member: 32260">The detailed features of CFA are not well tested. CFA does not work in a common way. For example, I can see on my computer:<ol>
<li data-xf-list-type="ol">If Notepad is executed from Explorer (as a child process of explorer.exe) then it is allowed by CFA.</li>
<li data-xf-list-type="ol">If Notepad is executed by Total Commander (running as a child process of Explorer) then it is allowed by CFA.</li>
<li data-xf-list-type="ol">If Notepad is executed from CMD (child process of cmd.exe) then modifications made by Notepad in protected folders are blocked.</li>
<li data-xf-list-type="ol">If Notepad was executed as a child process of Atlantis (document editor) then changes were initially blocked. But, changes have been allowed next time (not blocked now anymore). I could repeat this behavior also for Notepad++ as a parent process of Notepad.</li>
</ol>From the CFA description, the applications that are recognized by Microsoft as benign will be allowed by CFA</blockquote>

[QUOTE="Andy Ful, post: 954760, member: 32260"] The detailed features of CFA are not well tested. CFA does not work in a common way. For example, I can see on my computer: [LIST=1] [*]If Notepad is executed from Explorer (as a child process of explorer.exe) then it is allowed by CFA. [*]If Notepad is executed by Total Commander (running as a child process of Explorer) then it is allowed by CFA. [*]If Notepad is executed from CMD (child process of cmd.exe) then modifications made by Notepad in protected folders are blocked. [*]If Notepad was executed as a child process of Atlantis (document editor) then changes were initially blocked. But, changes have been allowed next time (not blocked now anymore). I could repeat this behavior also for Notepad++ as a parent process of Notepad. [/LIST] From the CFA description, the applications that are recognized by Microsoft as benign will be allowed by CFA [/QUOTE]

Verification