Detect if program is directly run from download

[Emiel Wieldraaijer]

Hi All,

It's possible to run a program directly from a download without saving the file to a folder.

Is there a way to detect this ? because i don't want allow a program to be run directly.

Thnx

[JohnOne]

Generally when you download a file from the internet it is saved to your HDD.

It would be very unusual and highly suspicious if a file were to download to

and execute from memory.

[wyzzard]

I think what he is referring to is if you click on an exe and a few other types of links you usually get the option to "save file to drive" or "run/open"... he wants to disable the option to "run/open" it from the download request I'm guessing...

Don't know how to do it but just clarifying the request hopefully.

[Blue_Drache]

As to why ... it makes absolutely no sense. What's the difference between scripting something to run after download and double clicking it yourself when it does? Other than the manual step?

Also ... I believe you can disable the "open/run" via security policy options.

Edited August 28, 2012 by Blue_Drache

[Emiel Wieldraaijer]

Hi,

Thanks all

Like valik would say "I'm not a noob" muttley i know the program isn't run from memory.

I don't want to disable the open/run option from internet explorer or other browers..

i think i'm going to block running the program from temporarily internet folder

Probally would fix my problem

[Kendall]

Most commonly when a program setup is ran it extracts most commonly to the @tempdir (%% windows/temp) folder. As far as downloading it that depends on where the browser places the downloaded file (by default) ultimately if you would really like to stop a program from running you could do an ocopiouse amount of things to stop it.

My suggestion: Stop it from running using a antivirus or make a script to continually search for the programs exe name.

[Blue_Drache]

What I used to do was have an auto-it script running in the background to automatically cancel any download window that popped up in IE and FF.

[Emiel Wieldraaijer]

Thnx all

I'm using the following

$internettempfolder = RegRead(HKey_Current_UserSoftwareMicrosoftWindowsCurrentVersionExplorerUser Shell Folders", "Cache")
$internettempfolder =StringReplace($internettempfolder, "%USERPROFILE%", @UserProfileDir)
$result = StringInStr(@WorkingDir, $internettempfolder)
If $result >0 then
Msgbox (16, "Info", "Run directly from download or manually for Temporary Internet Files location")
Exit
EndIf