Reply to thread

Message

<blockquote data-quote="Adrian Ścibor" data-source="post: 978178" data-attributes="member: 71496">[USER=83059]@MacDefender[/USER] [USER=32260]@Andy Ful[/USER] We can test MD on 1. default settings and 2. the user settings - to compare both configuration. The next edition in May 2022 will be fine, therefore please contact me in April to discuss the configuration and help me with that.Based on this screen shoot it should be disabled or disabled? <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> There appear to be two conflicting pieces of information... Additional, to be clear, the UAC is disabled as you can read our methodology to bypass the user prompt. So, finally the MOTW marked is disabled, becasue the file proporties do not have the MOTW information - seems to be necessary to bypass a user prompt. As far as I remember we implemented it, because it gives the same results as Powershell a Unblock-File / Remove-Item from PS command line to run file without a prompt:[URL unfurl=&quot;true&quot;]https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2[/URL]This is the only method I know of to use native Windows processes to run malware/any-untrusted-file downloaded from the Internet. We use the explorer.exe command-line process to run the downloaded file - as if the user was doing it from a Windows file manager and 2-click on the file. Do you know of another method that can be used to bypass the promt message?</blockquote>

[QUOTE="Adrian Ścibor, post: 978178, member: 71496"] [USER=83059]@MacDefender[/USER] [USER=32260]@Andy Ful[/USER] We can test MD on 1. default settings and 2. the user settings - to compare both configuration. The next edition in May 2022 will be fine, therefore please contact me in April to discuss the configuration and help me with that. Based on this screen shoot it should be disabled or disabled? :) There appear to be two conflicting pieces of information... Additional, to be clear, the UAC is disabled as you can read our methodology to bypass the user prompt. So, finally the MOTW marked is disabled, becasue the file proporties do not have the MOTW information - seems to be necessary to bypass a user prompt. As far as I remember we implemented it, because it gives the same results as Powershell [B]a Unblock-File / Remove-Item[/B] from PS command line to run file without a prompt: [URL unfurl="true"]https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2[/URL] This is the only method I know of to use native Windows processes to run malware/any-untrusted-file downloaded from the Internet. We use the explorer.exe command-line process to run the downloaded file - as if the user was doing it from a Windows file manager and 2-click on the file. Do you know of another method that can be used to bypass the promt message? [/QUOTE]

Verification