Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 820056" data-attributes="member: 32260">Guys, I had the same problem. So, I made a quick test (in Shadow Defender) and I noticed that the difference is for files from the TAM snapshot. When TAM is activated, it makes a snapshot of executables by path. Those paths are excluded from reputation checking. If you copy the executable to the new location it will be checked by TAM. Also, all new executables are checked by TAM. For new executables, TAM works as default-deny if the file is not on the Kaspersky TAM whitelist.For example, all executables from yet unpublished version of Hard_Configurator installed in my system, were automatically excluded from TAM, but recognized as Untrusted. I could run any of them. After copying to another folder, all of them were blocked by TAM.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 820056, member: 32260"] Guys, I had the same problem. So, I made a quick test (in Shadow Defender) and I noticed that the difference is for files from the TAM snapshot. When TAM is activated, it [COLOR=rgb(184, 49, 47)][B]makes a snapshot of executables by path[/B][/COLOR]. Those paths are excluded from reputation checking. If you copy the executable to the new location it will be checked by TAM. Also, all new executables are checked by TAM. For new executables, TAM works as default-deny if the file is not on the Kaspersky TAM whitelist. For example, all executables from yet unpublished version of Hard_Configurator installed in my system, were automatically excluded from TAM, but recognized as Untrusted. I could run any of them. After copying to another folder, all of them were blocked by TAM.:giggle:(y) [/QUOTE]

Verification