Reply to thread

Message

<blockquote data-quote="ForgottenSeer 95367" data-source="post: 1000350">Blocking these processes on the basis that they are Microsoft digitally signed will result in a &quot;black screen system&quot;:<ul>
<li data-xf-list-type="ul">system (ntoskernel.exe)</li>
<li data-xf-list-type="ul">smss.exe</li>
<li data-xf-list-type="ul">winnit.exe</li>
<li data-xf-list-type="ul">services.exe</li>
<li data-xf-list-type="ul">csrss.exe</li>
</ul>[ATTACH=full]268747[/ATTACH]Whatever you are using to block processes might not apply its block rules early enough in the system boot sequence to quash processes such as smss.exe, csrss.exe and services.exe. (NOTE: winlogon.exe is not digitally signed). Consequently, a partially bootable system might still happen even if you are blocking critical Windows processes that are signed.Additionally, if you test in a virtual machine, you might get unexpected results whereby system boots despite blocking critical Microsoft signed processes.In your testing, you can try a single &quot;catch-all&quot; block rule that will block everything unsigned and unsigned:block= *</blockquote>

[QUOTE="ForgottenSeer 95367, post: 1000350"] Blocking these processes on the basis that they are Microsoft digitally signed will result in a "black screen system": [LIST] [*]system (ntoskernel.exe) [*]smss.exe [*]winnit.exe [*]services.exe [*]csrss.exe [/LIST] [ATTACH type="full" alt="1661432896574.png"]268747[/ATTACH] Whatever you are using to block processes might not apply its block rules early enough in the system boot sequence to quash processes such as smss.exe, csrss.exe and services.exe. (NOTE: winlogon.exe is not digitally signed). Consequently, a partially bootable system might still happen even if you are blocking critical Windows processes that are signed. Additionally, if you test in a virtual machine, you might get unexpected results whereby system boots despite blocking critical Microsoft signed processes. In your testing, you can try a single "catch-all" block rule that will block everything unsigned and unsigned: block= * [/QUOTE]

Verification