Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 729797" data-attributes="member: 32260">I cannot see this in my system - the only DLLs are related to AppLocker (not supported in Windows Home and Pro) and OneDrive..Anyway, is not easy to stop thinking that you are not using default-allow setup. Indeed in default-allow setup, the applications are usually allowed to run and then the security program has to decide if the application is going to do something malicious. Controlling DLLs can be important to recognize the danger.In the default-deny setup, all new applications are simply blocked, and controlling DLLs is not so helpful anymore. One should only remember to close the infection vectors related to the potential exploits via: web pages, useful files which can have embedded active content (like MS Office documents, PDF documents, etc.), unpatched Windows, and unpatched applications. When using the ideal default-deny setup, there should be nothing in the system that could load/inject malicious DLLs. In the real world scenario, the probability of such events, while using default-deny setup, should be very low.It would be nice to have the ability to control only some special DLLs to block PowerShell etc., but there is no such possibility on Windows Home (and Pro).</blockquote>

[QUOTE="Andy Ful, post: 729797, member: 32260"] I cannot see this in my system - the only DLLs are related to AppLocker (not supported in Windows Home and Pro) and OneDrive. . Anyway, is not easy to stop thinking that you are not using default-allow setup. Indeed in default-allow setup, the applications are usually allowed to run and then the security program has to decide if the application is going to do something malicious. Controlling DLLs can be important to recognize the danger. In the default-deny setup, all new applications are simply blocked, and controlling DLLs is not so helpful anymore. One should only remember to close the infection vectors related to the potential exploits via: web pages, useful files which can have embedded active content (like MS Office documents, PDF documents, etc.), unpatched Windows, and unpatched applications. When using the ideal default-deny setup, there should be nothing in the system that could load/inject malicious DLLs. In the real world scenario, the probability of such events, while using default-deny setup, should be very low. It would be nice to have the ability to control only some special DLLs to block PowerShell etc., but there is no such possibility on Windows Home (and Pro). [/QUOTE]

Verification