Appart from the fact that the Behavior Blocker is an old feature and it’s usefullness is very limited in today’s Windows environment (it may be best to remove it completely), your conclusions are wrong. It is a blocker of suspicious behavior (thus preventing an unknown virus to spread or perform its payload), not a protector of system files.

Almost all the actions on your computer are performed by .exe files. If you prevent .exe files from executing their actions (such as opening a file for writing), you block almost everything - Word won’t be able to write the .doc file, e-mail client won’t be able to save the downloaded e-mail, programs won’t be able to store their settings. The operation “opening a file for writing, performed by an .exe file” is very common and there’s nothing suspicious about it. On the other hand, the operation “opening an .exe file for writing” is much less common and more suspicious (actually, I think it’s even more suspicious when it’s performed by a file with .xyz extension - that cannot even be started in an ordinary way - than by an .exe file).

It’s the operation “opening the file for writing” that is blocked - so it doesn’t matter if you say “Dumb_ass.src file was blocked”, or “Opening exeplorer.exe was blocked” - it’s the same action. The same holds for deleting the system folder. If you mean the announcement window should show something else (or some more info), you may be right - but it’s rather a cosmetical issue :wink: