Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1012787" data-attributes="member: 32260">I added additional fake rules in the configuration script:&nbsp; &nbsp; A:\DLL_FakeWhitelistedPath\*&nbsp; &nbsp; A:\DLL_FakeBlockedPath\*&nbsp; &nbsp; A:\MSI_FakeBlockedPath\*These rules had got the unused drive letter A:&nbsp; , so they are always inactive, except when the fake path is replaced by the real folder/file path. Fake whitelisting rules require unique GUIDs. Fake blocked rules are added via exceptions (new GUID is not required).I think that for casual users, one can add block DLL rules for users&#039; folders like Downloads, Desktop, Documents, and maybe also for USB drives. This will not block the application installers.In my real system, I use also a block rule to block the command prompt, but I had to remove it in my post because Malware Tips rejects posts that include cmd[.]exe . <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Post updated.</blockquote>

[QUOTE="Andy Ful, post: 1012787, member: 32260"] I added additional fake rules in the configuration script: A:\DLL_FakeWhitelistedPath\* A:\DLL_FakeBlockedPath\* A:\MSI_FakeBlockedPath\* These rules had got the unused drive letter A: , so they are always inactive, except when the fake path is replaced by the real folder/file path. Fake whitelisting rules require unique GUIDs. Fake blocked rules are added via exceptions (new GUID is not required). I think that for casual users, one can add block DLL rules for users' folders like Downloads, Desktop, Documents, and maybe also for USB drives. This will not block the application installers. In my real system, I use also a block rule to block the command prompt, but I had to remove it in my post because Malware Tips rejects posts that include cmd[.]exe . :) Post updated. [/QUOTE]

Verification