colinp

Given that my application's process printservice.exe is only ever launched by my application's service autoprintservice.exe, is there a way I can stop Immunet blocking printservice.exe's access to lsass.exe?

Is the process blocked?

I have blocking mode turned off, but the notification message makes me think Immunet is blocking this particular action, is that right, or can I ignore the notification? If it is blocking can I stop it? My actual message is: Warning! Process Blocked. The System Process Protection engine prevented unexpected access to lsass.exe (PID nnn) by printservice.exe (PID nnnn) printservice.exe is a file I know about it is part of an application suite, it is started from time to time by a Windows service whose executable is named autoprintservice.exe that is part of the same application suite. I scanned both files and they are clean. I have SignTool on another PC so I copied the two files to that PC and SignTool reports that neither file is signed.

In my case some-exe is Isass.exe. I should have said: blocking mode is off, I added an exception for some-other-exe in the settings, and I re-started the Immunet service, but the blocking action continued after this. A 3rd party service yet-another-exe starts some-other-exe in the background from time to time. After your reply I added another exception for yet-another-exe in the settings, and re-started the Immunet service again, but the blocking continued after this, also. Are there some blocking actions that cannot be prevented or is there always some way to prevent a blocking action? How can I tell if an exe is not clean or not signed?

How do I prevent the Immunet system process protection engine from blocking access to a process by another process that I want to allow? Several times each day Immunet reports: Warning! Process Blocked. The System Process Protection engine prevented unexpected access to (some-exe).exe (PID nnn) by (some-other-exe).exe (PID nnnn)