To avoid problems associated with AP rule violations, add the following exclusions to the previously mentioned AP rules:

**\smss.exe
c:\windows\csrss.exe
c:\windows\explorer.exe
c:\windows\system32\services.exe
c:\windows\system32\smss.exe
c:\windows\system32\svchost.exe
c:\windows\system32\userinit.exe
c:\windows\system32\winlogon.exe
c:\windows\syswow64\csrss.exe
c:\windows\syswow64\explorer.exe
c:\windows\syswow64\svchost.exe
c:\windows\syswow64\userinit.exe

To recover systems that have been affected by AP rule violations:

IMPORTANT: The following steps apply only to systems already adversely affected by the AP rules.

1. Correct the AP rules policies as detailed above.
2. Hard reboot the system (turn off the system, and then turn on).
3. Log on as usual.

• Prevent common programs from running files from the Temp folder
• Prevent svchost executing non-Windows executables
• Prevent programs registering to autorun
• Prevent Windows Process spoofing (Antivirus Standard Protection: Prevent Windows Process spoofing)