Run by Smartscreen utility

[HarborFront]

Hi I was testing RBS v4.0.0.1 using adwcleaner.exe on my desktop running Win 11 Pro.

When I RBS, Smartscreen kicks in and the file is being analyzed in the WhitelistCloud. If I just leave it the analyzing seems infinitely ongoing and after a certain time the 2 screens just faded off without activating adwcleaner. Is this normal? Or should it be that after the Whitelisting is completed, the adwcleaner.exe file should open?

Another app, OOAPB.exe, also the same.

 

[Andy Ful]

Hi I was testing RBS v4.0.0.1 using adwcleaner.exe on my desktop running Win 11 Pro.
...
When I RBS, Smartscreen kicks in and the file is being analyzed in the WhitelistCloud. If I just leave it the analyzing seems infinitely ongoing and after a certain time the 2 screens just faded off without activating adwcleaner. Is this normal? Or should it be that after the Whitelisting is completed, the adwcleaner.exe file should open?

The WhitelistCloud feature prevents RunBySmartscreen from running the adwcleaner.
It can be also that WhitelistCloud blocks just adwcleaner - you can check it by running adwcleaner without RunBySmartscreen.

 

[Gandalf_The_Grey]

Just choose one or the other WhitelistCloud (part of VoodooShield) or RunBySmartscreen.

 

[Andy Ful]

WhitelistCloud works in real-time and RunBySmartscreen works on demand. Choose the solution that suits you best.

 

[Freki123]

@HarborFront I had it quite a few times that whitelistcloud got in an infinity checking loop for files. It never got an result at all.
The problem was never Smartscreen it was always WLC for me.

 

[HarborFront]

The WhitelistCloud feature prevents RunBySmartscreen from running the adwcleaner.
It can be also that WhitelistCloud blocks just adwcleaner - you can check it by running adwcleaner without RunBySmartscreen.

Yes, I can run adwcleaner without RBS. So there's some sort of incompatibility between RBS and WhitelistCloud?

One question. Can RBS be automated to detect the downloads from the net rather than as on-demand?

Thanks

 

[Andy Ful]

One question. Can RBS be automated to detect the downloads from the net rather than as on-demand?

Thanks

No, it can work only on demand.

 

[Andy Ful]

RunBySmartscreen ver 4.0.1.0

https://github.com/AndyFul/Run-By-Smartscreen/raw/master/RunBySmartscreen_4010.exe

Added several new extensions (archives, disk images).

 

[pxxb1]

RunBySmartscreen ver 4.0.1.0

https://github.com/AndyFul/Run-By-Smartscreen/raw/master/RunBySmartscreen_4010.exe

Added several new extensions (archives, disk images).

I use H_C with "Install by Smartscreen", what are the difference between the 2?

 

[Andy Ful]

I use H_C with "Install by Smartscreen", what are the difference between the 2?

There are several differences - they are explained in the help for the option <Forced SmartScreen>.
The main differences are as follows:

• "Install By SmartScreen" is used only for EXE and MSI files. Depending on SRP settings it can run EXE/MSI files with standard or high privileges to safely bypass SRP restrictions. Other unsafe file types are blocked by SRP.
• "Run By Smartscreen" works independently of SRP. It can be considered an "on-demand" file checking for unknown files. The EXE/MSI/SCR/COM files are checked by SmartScreen and automatically executed if recognized as safe. Other files with unsafe extensions (over 250 file types) are not executed and the alert is shown.
  Safe files like media files, photos, videos, etc. are opened without checking and alerts.

 

[pxxb1]

There are several differences - they are explained in the help for the option <Forced SmartScreen>.
The main differences are as follows:

• "Install By SmartScreen" is used only for EXE and MSI files. Depending on SRP settings it can run EXE/MSI files with standard or high privileges to safely bypass SRP restrictions. Other unsafe file types are blocked by SRP.
• "Run By Smartscreen" works independently of SRP. It can be considered an "on-demand" file checking for unknown files. The EXE/MSI/SCR/COM files are checked by SmartScreen and automatically executed if recognized as safe. Other files with unsafe extensions (over 250 file types) are not executed and the alert is shown.
  Safe files like media files, photos, videos, etc. are opened without checking and alerts.

Interesting. Why is not Run by implemented in H_C instead of Install by?

 

[Gandalf_The_Grey]

Interesting. Why is not Run by implemented in H_C instead of Install by?

It is implemented in H_C only if you use something else or the less complicated SWH you can/need to install it separately.

 

[pxxb1]

It is implemented in H_C only if you use something else or the less complicated SWH you can/need to install it separately.

Ahh, sometimes it actually helps to read the Help files .
Thanks.

 

[Kongo]

Would be appreciated if you could update your first post in this thread with the updated version of Run By SmartScreen @Andy Ful

 

[Andy Ful]

Would be appreciated if you could update your first post in this thread with the updated version of Run By SmartScreen @Andy Ful

Thanks. I have rewritten and shortened the OP. The idea of RunBySmartscreen is very simple and I think that it is now properly reflected in the OP. The details are included on GitHub.

 

[Andy Ful]

RunBySmartscreen ver. 4.0.1.1

https://github.com/AndyFul/Run-By-Smartscreen/raw/master/RunBySmartscreen_4011.exe

Added a new certificate. No functional changes.

 

[Andy Ful]

RunBySmartscreen ver. 4.1.1.1
https://github.com/AndyFul/Run-By-Smartscreen/raw/master/RunBySmartscreen_4111.exe

Added the warning for ONE file extension (OneNote document).

 

[Andy Ful]

RunBySmartscreen ver. 5.0.0.0

https://github.com/AndyFul/Run-By-Smartscreen/raw/master/RunBySmartscreen_5000.exe

Added new digital certificate.
Some code was adjusted to the upcoming version of SimpleWindowsHardening.

 

[Andy Ful]

RunBySmartscreen ver. 5.0.1.1

https://github.com/AndyFul/Run-By-Smartscreen/raw/master/RunBySmartscreen_5011.exe

Some code was adjusted to work with WindowsHybridHardening Light.

 

[pxxb1]

RunBySmartscreen ver. 5.0.1.1

https://github.com/AndyFul/Run-By-Smartscreen/raw/master/RunBySmartscreen_5011.exe

Some code was adjusted to work with WindowsHybridHardening Light.

Hi Andy.

Against what data base, is RunBySmartscreen checking the files?