Reply to thread

Message

<blockquote data-quote="Dreams&amp;amp;Visions" data-source="post: 1112436" data-attributes="member: 118225">On the one hand, I kinda support the idea to autoallow trusted services, however, this should be limited to Windows Update related services IMO.I&#039;ve blocked explorer.exe in Evorim Free Firewall as well as in K7 (in K7 manually, it was trusted; wscript.exe nor powershell weren&#039;t active yet, it would result in a firewall alert by Evorim), and did not observe any inconvenience so far.IMO K7 should not make a difference whether a file is trusted or not if the user decides to switch to &quot;prompt for action&quot;. IDK why they disabled &quot;Learn mode&quot;, I once asked, I do not remember the full answer, but they did not state a reason, but they told me it is disabled in Home user environment - which is obvious.P.S. As far as I remember, QuickHeal &#039;s firewall module works similar, it also does autoallow certain processes.As for scriptors, I threw some on the only machine still at Win10 w/ SD yesterday, powershell might have called out, however, one script was shut down doing something with powershell by the BB (suspicious program). The others did autoclose instantly after run. It was #lockbit. Seems all were droppers, unlike #netwalker, which hollowed explorer.exe to perform encryption as per my observation and was hard to tackle.</blockquote>

[QUOTE="Dreams&Visions, post: 1112436, member: 118225"] On the one hand, I kinda support the idea to autoallow trusted services, however, this should be limited to Windows Update related services IMO. I've blocked explorer.exe in Evorim Free Firewall as well as in K7 (in K7 manually, it was trusted; wscript.exe nor powershell weren't active yet, it would result in a firewall alert by Evorim), and did not observe any inconvenience so far. IMO K7 should not make a difference whether a file is trusted or not if the user decides to switch to "prompt for action". IDK why they disabled "Learn mode", I once asked, I do not remember the full answer, but they did not state a reason, but they told me it is disabled in Home user environment - which is obvious. P.S. As far as I remember, QuickHeal 's firewall module works similar, it also does autoallow certain processes. As for scriptors, I threw some on the only machine still at Win10 w/ SD yesterday, powershell might have called out, however, one script was shut down doing something with powershell by the BB (suspicious program). The others did autoclose instantly after run. It was #lockbit. Seems all were droppers, unlike #netwalker, which hollowed explorer.exe to perform encryption as per my observation and was hard to tackle. [/QUOTE]

Verification