Question Everything.exe blocked due to certificate revoked

[MikeGiann]

Hello,

Long time reader of this forum but just decided to join and see if I can hep others and be helped as well.

My first issue: I have used Windows Hybrid Hardening Light_1111 for some time and have not run into many issues, many were fixed by looking at the blocked events and either adding them to the exceptions or decided that I did not need that software. This error does not show up in blocked events so I don't know what is causing the issue, with the WDAC on off, it works and with on, it gives me an error about the certificate. I have used the portable version and the installation version and both give that error.
I can't even disable the WDAC temporarily to make it work, I have to restart the PC in order for the program to run.
I have added the folder where the executable is at to the whitelist of WDAC, but still blocks with the same error message.
Can anything be configured for this to run?

Thanks
Mike

 

[Bot]

Hello Mike,

Welcome to the forum! It sounds like you're dealing with a certificate issue. The certificate of the executable might have been revoked or expired, which is why WDAC is blocking it. Unfortunately, whitelisting the folder won't help in this case. I would suggest contacting the software developer to check if they have a new version with a valid certificate.

Best,
Forum Bot

 

[MikeGiann]

Hey Bot,

Thanks for the assist. I did go and re-download the installer again and installed it. With WDAC activated, I couldn't install as I got the same error, with it disabled, I was able to install and run.

Does Windows not look at those certificates when installing and give a warning about the certificate regardless of it WDAC is active or not? Or am I confusing certificates with the publisher couldn't be validated message that we sometimes see?

 

[lokamoka820]

I think @Andy Ful can help with this.

 

[TairikuOkami]

When you check properties of Everything.exe, what does the certificate say? You can also re-install the certificate, if present.

Does Windows not look at those certificates when installing and give a warning about the certificate regardless of it WDAC is active or not?

Windows updates/revokes certificates daily via svchost.exe, sometimes people block it using "privacy" tools. You can reset them and force them to update.

How to Purge the Catroot2 Folder on Windows 11

Learn how to rename or purge the Catroot2 folder on Windows PC. You may even delete this folder, however, do stop update services first.

howtoedge.com

 

[Andy Ful]

Hello,

Long time reader of this forum but just decided to join and see if I can hep others and be helped as well.

My first issue: I have used Windows Hybrid Hardening Light_1111 for some time and have not run into many issues, many were fixed by looking at the blocked events and either adding them to the exceptions or decided that I did not need that software. This error does not show up in blocked events so I don't know what is causing the issue, with the WDAC on off, it works and with on, it gives me an error about the certificate. I have used the portable version and the installation version and both give that error.
I can't even disable the WDAC temporarily to make it work, I have to restart the PC in order for the program to run.
I have added the folder where the executable is at to the whitelist of WDAC, but still blocks with the same error message.
Can anything be configured for this to run?

Thanks
Mike

Hi,

Microsoft documents the issue as ID=3033:

This event may occur with or without an App Control policy present and should occur alongside a 3077 event if caused by App Control policy. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. Presence of the Lifetime Signing EKU is the only case where App Control blocks files due to an expired signature. Try using option 20 Enabled:Revoked Expired As Unsigned in your policy along with a rule (for example, hash) that doesn't rely on the revoked or expired cert.

This event also occurs if code compiled with Code Integrity Guard (CIG) tries to load other code that doesn't meet the CIG requirements.

The certificate seems OK, so the problem can be caused by the Code Integrity Guard. Only the developer can make Everything compatible with WDAC in such a case.
I emailed the developer about this problem.

 

[MikeGiann]

Hello all and apologies for the late reply,

Thank you TairikuOkami for the reply, I did check that (forgot to mention it) and it seemed that it was still valid, as I did try to install without WDAC active and it installed without issue or warning from Windows.

Thank you as well Andy Ful, hoping that the developer is aware ot that your email at least makes him aware of the issue that people will be facing as they begin to start activating the WDAC features of Windows.

 

[Andy Ful]

@MikeGiann,

I have got an email from the vendor. He is aware of the issue and trying to reach out to Microsoft for answers.

 

[MikeGiann]

That is good news, hopefully the issue will be resolved quickly.

 

[bobdoe]

Are there any answers regarding this yet? I am sorely missing Everything.

Edit: I just discovered that the previous version (portable) Everything-1.4.1.1005.x64.zip works for me...

 

[Digmor Crusher]

Are there any answers regarding this yet? I am sorely missing Everything.

Edit: I just discovered that the previous version (portable) Everything-1.4.1.1005.x64.zip works for me...

Nice to know, thanks.