Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1013199" data-attributes="member: 32260">The rules you have added are incorrect.<ol>
<li data-xf-list-type="ol">In the EXE section, the Command prompt executable has got brackets. I assume that you did it due to Malware Tips restrictions and you remember that in CMD[.]EXE the [ ] brackets must be omitted.</li>
<li data-xf-list-type="ol">In the rules for CMD[.]EXE and HH.EXE you use the same GUIDs. So you have to change one of these GUIDs. For example in the rule for CMD[.]EXE : 
f493e22c-63a9-4811-ab94-c5d8a8a9600d -----&gt; f493e22c-63a9-4811-ab94-c5d8a8a96002 
I checked and the changed GUID will be unique in your script.</li>
<li data-xf-list-type="ol">In the DLL section you have forgotten to add the asterisk in the path: 
&lt;FilePathCondition Path=&quot;E:\&quot;/&gt; should be &lt;FilePathCondition Path=&quot;E:\*&quot;/&gt;</li>
</ol>Be safe. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Andy Ful, post: 1013199, member: 32260"] The rules you have added are incorrect. [LIST=1] [*]In the EXE section, the Command prompt executable has got brackets. I assume that you did it due to Malware Tips restrictions and you remember that in CMD[.]EXE the [ ] brackets must be omitted. [*]In the rules for CMD[.]EXE and HH.EXE you use the same GUIDs. So you have to change one of these GUIDs. For example in the rule for CMD[.]EXE : f493e22c-63a9-4811-ab94-c5d8a8a9600[COLOR=rgb(184, 49, 47)][B]d[/B][/COLOR] -----> f493e22c-63a9-4811-ab94-c5d8a8a9600[COLOR=rgb(184, 49, 47)][B]2[/B][/COLOR] I checked and the changed GUID will be unique in your script. [*]In the DLL section you have forgotten to add the [COLOR=rgb(184, 49, 47)][B]asterisk[/B][/COLOR] in the path: <FilePathCondition Path="E:\"/> should be <FilePathCondition Path="E:\[B][COLOR=rgb(184, 49, 47)][SIZE=5]*[/SIZE][/COLOR][/B]"/> [/LIST] Be safe. :) [/QUOTE]

Verification