Reply to thread

Message: <blockquote data-quote="Andy Ful" data-source="post: 836104" data-attributes="member: 32260"><p>BAFS could not block it. Files on flash drives cannot have MOTW, because they usually have not NTFS file system. Normally (without CF), the malware could be stopped by ASR rule "Block untrusted and unsigned processes that run from USB" or some other ASR rules depending on script or WMI usage. SRP can easily block such malware by blocking shortcuts in User Space (like in H_C).</p></blockquote><p></p>

Top