Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 795519" data-attributes="member: 32260">It allows a kind of very simple parent checking, but not advanced one as in Excubits Bouncer.Furthermore, you cannot allow/block anything by path. For example:[CODE]&nbsp; &nbsp; &lt;Deny ID=&quot;ID_DENY_D_1_1&quot; FriendlyName=&quot;scrobj.dll FileRule&quot; FileName=&quot;scrobj.dll&quot; MinimumFileVersion=&quot;65535.65535.65535.65535&quot; AppIDs=&quot;REGSVR32.EXE&quot; /&gt;&nbsp; &nbsp; &lt;Deny ID=&quot;ID_DENY_WMIC&quot; FriendlyName=&quot;wmic.exe&quot; FileName=&quot;wmic.exe&quot; MinimumFileVersion=&quot;65535.65535.65535.65535&quot;/&gt;[/CODE]The first rule will block scrobj.dll when loaded by REGSVR32.EXE .The second will block execution of wmic.exe.The rules apply to all local users and can recognize the file name from the file properties (hardcoded during compilation). So, if you rename the file a.exe to b.exe then both files will be blocked.</blockquote>

[QUOTE="Andy Ful, post: 795519, member: 32260"] It allows a kind of very simple parent checking, but not advanced one as in Excubits Bouncer. Furthermore, you cannot allow/block anything by path. For example: [CODE] <Deny ID="ID_DENY_D_1_1" FriendlyName="scrobj.dll FileRule" FileName="scrobj.dll" MinimumFileVersion="65535.65535.65535.65535" AppIDs="REGSVR32.EXE" /> <Deny ID="ID_DENY_WMIC" FriendlyName="wmic.exe" FileName="wmic.exe" MinimumFileVersion="65535.65535.65535.65535"/>[/CODE] The first rule will block scrobj.dll when loaded by REGSVR32.EXE . The second will block execution of wmic.exe. The rules apply to all local users and can recognize the file name from the file properties (hardcoded during compilation). So, if you rename the file a.exe to b.exe then both files will be blocked. [/QUOTE]

Verification