Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 543929" data-attributes="member: 32260">In Windows 8+, You can also consider forcing SmartScreen (App on the Run) to check all executable files in the User Space on NTFS hard disk. It can be done by the Reg tweak and simple vbs script.The Reg tweak adds the new element in Explorer context menu (right mouse click) due to:[HKEY_CLASSES_ROOT\*\shell\Run with SmartScreen\command]@=&quot;C:\\Windows\\RunAsSmartscreen.vbs \&quot;%1\&quot; %*&quot;The RunAsSmartscreen.vbs script adds the proper alternate data stream to the file that is going to be run and triggers SmartScreen check. I think that SmartScreen Filter gives less false positives than Voodoo Shield in AUTO-PILOT. In the real world, both solutions give similar protection.If You want to disable Windows Script Host, the SmartScreen solution is still possible by wrapping RunAsSmartscreen.vbs to RunAsSmartscreen.exe with Sordum &quot;Exe From Vbs&quot; (<a href="http://sorsof.blogspot.com/2013/01/exe-from-vbs-v13.html" target="_blank">Exe From Vbs v1.3 ~ Sordum software Blog</a>). This wrapper adds script interpreter to the exe file, so WSH is not needed when using RunAsSmartscreen.exe&nbsp; .The RunAsSmartscreen.exe starts with Administrator rights, so automatically can bypass SRP protection.By the way, thanks for all Your posts about Windows built in security solutions.</blockquote>

[QUOTE="Andy Ful, post: 543929, member: 32260"] In Windows 8+, You can also consider forcing SmartScreen (App on the Run) to check all executable files in the User Space on NTFS hard disk. It can be done by the Reg tweak and simple vbs script. The Reg tweak adds the new element in Explorer context menu (right mouse click) due to: [HKEY_CLASSES_ROOT\*\shell\Run with SmartScreen\command] @="C:\\Windows\\RunAsSmartscreen.vbs \"%1\" %*" The RunAsSmartscreen.vbs script adds the proper alternate data stream to the file that is going to be run and triggers SmartScreen check. I think that SmartScreen Filter gives less false positives than Voodoo Shield in AUTO-PILOT. In the real world, both solutions give similar protection. If You want to disable Windows Script Host, the SmartScreen solution is still possible by wrapping RunAsSmartscreen.vbs to RunAsSmartscreen.exe with Sordum "Exe From Vbs" ([URL="http://sorsof.blogspot.com/2013/01/exe-from-vbs-v13.html"]Exe From Vbs v1.3 ~ Sordum software Blog[/URL]). This wrapper adds script interpreter to the exe file, so WSH is not needed when using RunAsSmartscreen.exe . The RunAsSmartscreen.exe starts with Administrator rights, so automatically can bypass SRP protection. By the way, thanks for all Your posts about Windows built in security solutions. [/QUOTE]

Verification