Hello John Davis, took some days off, sorry for the delayed reply. it did not seem to work - what is it , how did you test? Please note that the lookup is case sensitive and the string must match the process name exactly. Changes in the list are picked up only when the driver is loaded (usually on reboot). Haven't tested on Win8 and above, though I think the behaviour is still the same. You can verify the basic function using savtst32.exe (from the sec_5xx\tools\ directory): Create an ExcludedProcess0 value, say SavTst.eXe , reboot. Run savtst32.exe , File -> On-Access Test . You should get the correctly pop-up. Close it, rename (exactly) to the registry value, run again. It should now pop-up not correctly . Christian
↧