Reply to thread

Message

<blockquote data-quote="AtlBo" data-source="post: 716406" data-attributes="member: 32547">Below is block of legit attempt to delete a task by Revo Uninstaller uninstall (I will use portable instead) module.&nbsp; Excluded hoping the uninstaller would ask for the opportunity to try again but it did not.&nbsp; Luckily, I guess the task wasn&#039;t in Task Scheduler, because I don&#039;t see it there now.&nbsp; I would have just deleted it myself no problem.&nbsp; However, it did bring to mind another scenario.&nbsp; If the uninstaller had tried to create a scheduled task or perhaps a .tmp file had done so, then the task would not have been created.&nbsp; If the routine was a one and done, could there be a problem (rare and sounds like a bad idea I know...)?&nbsp; What if the task points to a delete on boot routine or something?&nbsp; O/C an uninstaller removes itself once it is done, and .tmp may not function as .exe after running.&nbsp; Maybe some boot time setting could get messed up in an unlikely scenario idk.When you do your fine tuning, might you consider perhaps adding a disclaimer or notification of some kind to indicate when a write from a .tmp file or uninstaller of a legit application to a Windows area was blocked that could produce an undesirable result?&nbsp; This being an uninstall routine...removing Revo itself, don&#039;t know how this might be handled.&nbsp; Maybe there are other OS Armor rules that block writes to formal Windows areas that could also cause an epsode of some kind.Personally, I certainly like to know when a scheduled event is being created.&nbsp; I like all the settings <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />.&nbsp; Anyway, whether the scenario points to any potential risk when blocking uninstall routines and maybe any legit one run routines that delete/modify/add windows files or data too, I cannot say.&nbsp; If they are run from a .tmp, it might only get one chance.&nbsp; Because of the log, maybe the disclaimer after the block would be good enough for scheduled tasks (created by legit or legit .tmp).&nbsp; User can know about the problem from the log at least.Oh, what about a pause for these (some blocks) rather than a block?&nbsp; Or is that happening already?&nbsp; Then the choice to exclude could be the allow unpause?&nbsp; I mean pause the parent.&nbsp; As I mentioned, I didn&#039;t see the task in the task scheduler so I don&#039;t know how that is handled now.&nbsp; Seems to me that might be useful for some of the protections though LOL idk...Date/Time: 3/7/2018 10:32:40 AMProcess: [11780]C:\Windows\System32\schtasks.exeParent: [7748]C:\Users\ME USER ACCOUNT <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />\AppData\Local\Temp\_iu14D2N.tmpRule: BlockSchtasksExeRule Name: Block execution of schtasks.exeCommand Line: &quot;schtasks.exe&quot; /Delete /TN &quot;Revo Uninstaller Pro Hunter Mode&quot; /FSigner:Parent Signer:No idea how to accomplish this command line or if I need to do anything.&nbsp; Does it just delete a scheduled task?&nbsp; It&#039;s not in Task Scheduler already if that is what this does...</blockquote>

[QUOTE="AtlBo, post: 716406, member: 32547"] Below is block of legit attempt to delete a task by Revo Uninstaller uninstall (I will use portable instead) module. Excluded hoping the uninstaller would ask for the opportunity to try again but it did not. Luckily, I guess the task wasn't in Task Scheduler, because I don't see it there now. I would have just deleted it myself no problem. However, it did bring to mind another scenario. If the uninstaller had tried to create a scheduled task or perhaps a .tmp file had done so, then the task would not have been created. If the routine was a one and done, could there be a problem (rare and sounds like a bad idea I know...)? What if the task points to a delete on boot routine or something? O/C an uninstaller removes itself once it is done, and .tmp may not function as .exe after running. Maybe some boot time setting could get messed up in an unlikely scenario idk. When you do your fine tuning, might you consider perhaps adding a disclaimer or notification of some kind to indicate when a write from a .tmp file or uninstaller of a legit application to a Windows area was blocked that could produce an undesirable result? This being an uninstall routine...removing Revo itself, don't know how this might be handled. Maybe there are other OS Armor rules that block writes to formal Windows areas that could also cause an epsode of some kind. Personally, I certainly like to know when a scheduled event is being created. I like all the settings :). Anyway, whether the scenario points to any potential risk when blocking uninstall routines and maybe any legit one run routines that delete/modify/add windows files or data too, I cannot say. If they are run from a .tmp, it might only get one chance. Because of the log, maybe the disclaimer after the block would be good enough for scheduled tasks (created by legit or legit .tmp). User can know about the problem from the log at least. Oh, what about a pause for these (some blocks) rather than a block? Or is that happening already? Then the choice to exclude could be the allow unpause? I mean pause the parent. As I mentioned, I didn't see the task in the task scheduler so I don't know how that is handled now. Seems to me that might be useful for some of the protections though LOL idk... Date/Time: 3/7/2018 10:32:40 AM Process: [11780]C:\Windows\System32\schtasks.exe Parent: [7748]C:\Users\ME USER ACCOUNT :)\AppData\Local\Temp\_iu14D2N.tmp Rule: BlockSchtasksExe Rule Name: Block execution of schtasks.exe Command Line: "schtasks.exe" /Delete /TN "Revo Uninstaller Pro Hunter Mode" /F Signer: Parent Signer: No idea how to accomplish this command line or if I need to do anything. Does it just delete a scheduled task? It's not in Task Scheduler already if that is what this does... [/QUOTE]

Verification