Ticket #138 (new issue)

Description

Capture has a whitelist for IE temp file directories, but has a blacklist entry for filenames ending in .exe, and as such, if you browse to a URI which is specific to an exe (i.e. http://bla.com/download/file.exe) it will still flag the creation of the file since the blacklist trumps the whitelist.

For now we have disabled the blacklist entry related to .exes but I think the simplest solution will be to have the integrity check piece compare the last URI visited to any file events, and ignore entries where the two match.

The longer term solution is that Capture needs a rework of it's whitelist/blacklist capabilities, as they're not extensible, and have implementation limitations which shouldn't exist (see ticked #131)