Advice Request What process spawns "Delta patch"?

[shmu26]

On Windows 10, you often get newly-spawned files such as this:
AM_Delta_Patch_1.245.777.0.exe
I understand that they are updates for Windows Defender.
What process spawns these files?
I want to mark that process as a trusted installer, so the delta patches won't be classified as "unrecognized".
(I am using Comodo firewall, with trusted vendors disabled)

 

[509322]

It's already a Trusted Installer > Windows Update

wuauclt.exe

"C:\windows\softwaredistribution\download\install\am_delta_patch_1.145.209.0.exe" antimalware /q

These might come through via Manual Update of Defender also, but I haven't checked.

I wouldn't go to any extraordinary lengths to make something a Trusted Installer. If there are problems, submit it as a bug report as they need to get this kind of issue sorted out.

 

[shmu26]

It's already a Trusted Installer > Windows Update

wuauclt.exe

"C:\windows\softwaredistribution\download\install\am_delta_patch_1.145.209.0.exe" antimalware /q

Yes, I see you are right.
So why do my delta patch files fall into "unrecognized", if I have enabled "trust files installed by trusted installers"?

 

[509322]

Yes, I see you are right.
So why do my delta patch files fall into "unrecognized", if I have enabled "trust files installed by trusted installers"?

You'll have to ask Melih.

 

[509322]

Yes, I see you are right.
So why do my delta patch files fall into "unrecognized", if I have enabled "trust files installed by trusted installers"?

Do the Delta patches get sandboxed ?

If no, then the file rating of the Delta Patch is not changing, but C isn't messing with it = allowing Windows Update doing its thing.

Remember, every single file via Windows Update = Unrecognized to C. They don't see those files before they are distributed by Microsoft, so when they hit your system = Unrecognized.

The local file rating = Unrecognized, but C is not sandboxing or blocking or whatever the user has the settings adjusted to when dealing with Unrecognized files. So, Trusted Installers are installing those Unrecognized files as if they were Trusted.

Make sense ?

 

[shmu26]

Do the Delta patches get sandboxed ?

If no, then the file rating of the Delta Patch is not changing, but C isn't messing with it = allowing Windows Update doing its thing.

Remember, every single file via Windows Update = Unrecognized to C. They don't see those files before they are distributed by Microsoft, so when they hit your system = Unrecognized.

The local file rating = Unrecognized, but C is not sandboxing or blocking or whatever the user has the settings adjusted to when dealing with Unrecognized files. So, Trusted Installers are installing those Unrecognized files as if they were Trusted.

Make sense ?

I have autosandbox disabled. HIPS is not throwing prompts for the delta patches.
Either the updates are working, even though the file is unrecognized, or they are failing, and I just don't know about it.

 

[509322]

I have autosandbox disabled. HIPS is not throwing prompts for the delta patches.
Either the updates are working, even though the file is unrecognized, or they are failing, and I just don't know about it.

L0L... enable the sandbox and verify that they won't be sandboxed; they should not.

HIPS is not going to generate any alerts involving a designated Trusted Installer when it is installing something. If an Unrecognized process, that has not been excluded from monitoring by other policy, attempts to launch Trusted Installer, then there would be an alert.

If there are failures you generally will see it in Windows Update or Windows Defender will throw an error.

Eventually you will abandon C...

 

[Deleted member 178]

Yes, I see you are right.
So why do my delta patch files fall into "unrecognized", if I have enabled "trust files installed by trusted installers"?

Welcome to th buggy world of Comodo

More seriously surely because the file name changes every time. so you have to use wildcards.

 

[shmu26]

Welcome to th buggy world of Comodo

More seriously surely because the file name changes every time. so you have to use wildcards.

Unfortunately, the file list does not accept wildcards.

The issue seems to have to do with the way Comodo categorizes files.
"Trusted" status has to come either from the trusted vendor list, or from cloud lookup, or from the user's decision to "trust" that file. Just being spawned by a trusted installer does not automatically bestow "trusted" status on the file.

In order to make life easier for myself, I went back to using my custom list of trusted vendors.
The main thing that irks me about it is that Comodo forces itself back on the list, even if you delete it. If they only signed their own products, I wouldn't mind, but they seem to issue a lot of 3rd party certificates.