BehaviorShield asks about services.exe

[cska133]

hallo,

I just upgradet to 5.1.889 from 5.0. I dont remember if 5.0 did have option to change settings in behavior shield, but I changed the setting there to always ask about intrusted applications.

after that I got notification from Behavior shield (see attachment). Target is Registry\Machine}system\Controlset001\services\TrustedInstaller\start
Is this normal? Which action to take?
Why services.exe is not trusted?

[danny96]

hallo,

I just upgradet to 5.1.889 from 5.0. I dont remember if 5.0 did have option to change settings in behavior shield, but I changed the setting there to always ask about intrusted applications.

after that I got notification from Behavior shield (see attachment). Target is Registry\Machine}system\Controlset001\services\TrustedInstaller\start
Is this normal? Which action to take?
Why services.exe is not trusted?

Allow and add to trusted processess.

This is normal process that you can safely allow 

[spg SCOTT]

AFAIK, I think the main point is avast! is picking up on the changing of the reg key, causing the alert.

This is why avast! have elected to have the behavior shield in a "passive" mode for a while so that the lists can be populated and the shield can be calibrated better.

[CraigB]

I myself would just leave the setting's of the BhS on allow untill the shield is fully working in version 6, that way alot more of the system program's will have been added to the white list's.

What spg SCOTT  said 

[Charyb-0]

I leave mine set to allow. Even when the behavior shield is fully functional I think I will keep it on allow unless there are any strange problems on my computer. I would have to get comfortable with it first.

This is interesting from pk in another post regarding the internal workings of the behavior shield.

New behavior shield in 5.1 monitors processes activity. This is done by using DLL injection into the most running processes and it monitors suspicious activity (several API functions are hooked: e.g. NtProtectVirtualMemory, LdrLoadDll, ...). Rapport checked the running process (web browser) and it found out it was somehow modified. Yes, it could be done by malware, keylogger, etc. Rapport doesn't know which application did it.

I don't know Rapport so I'm not really sure how to set it right... please tell me:
- The error is only in Rapport log and you can still use web browser for banking operations, Rapport doesn't block it. Is that correct?

It would be hard for Rapport to identify that the process was modified just by avast. I think the only remedy lies in avast's fix. Firstly, I'll need to install Rapport and get to know it better.

[spg SCOTT]

You want to change it back to allow? (and not get the alerts?)

Open avast! --> 'Real Time Shields' tab --> 'Behavior Shield' tab --> 'Expert Settings' Button --> Main Settings --> Change the action to 'allow'

Scott

[cska133]

you mean change to "allow"

[spg SCOTT]

Yep, sorry about that