Sister Carrie

NTCurrentVersionWindows” />

<itementry param=“value” operator=“equalnocase” type=“ansi” value=“Load” />

</ruleentry>

</rulegroup>

<rulegroup name=“askdel-run4”>

<ruleentry event=“registry” match=“all” ask=“true” customtext=“4004”>

LDBX

<!— Windows AutoRuns Registry Values —>

<itementry param=“key” operator=“equalnocase” type=“ansi” value=“HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon” />

<itementry param=“value” operator=“equalnocase” type=“ansi” value=“Userinit” />

</ruleentry>

</rulegroup>

<rulegroup name=“askdel-run5”>

<ruleentry event=“registry” match=“all” aLDBX

sk=“true” customtext=“4004”>

<!— Windows AutoRuns Registry Values —>

<itementry param=“key” operator=“equalnocase” type=“ansi” value=“HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon” />

<itementry param=“value” operator=“equalnocase” type=“ansi” value=“Shell” />

</ruleentry>

</rulegroup>

<rulegroup name=“askdel-run6”>

<ruleentry eLDBX

vent=“registry” match=“all” ask=“true” customtext=“4011”>

<itementry param=“key” operator=“equalnocase” type=“ansi” value=“HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotify” />

</ruleentry>

</rulegroup>

<rulegroup name=“askdel-appinit”>

<ruleentry event=“registry” match=“all” ask=“true” customtext=“4013”>

<itementry param=“key” operator=“equalnocase” tLDBX

ype=“ansi” value=“HKLM SOFTWAREMicrosoftWindows NTCurrentVersionWindows” />

<itementry param=“value” operator=“equalnocase” type=“ansi” value=“AppInit_DLLs” />

</ruleentry>

</rulegroup>

<!— AskSDenyD delete registry protection —>

<ruleset name=“rs-regd-asdd” allow=“true”>

<rulerefentry rulegroupref=“askdel-run1”/>

<rulerefentry rulLDBX

egroupref=“askdel-run2”/>

<rulerefentry rulegroupref=“askdel-run3”/>

<rulerefentry rulegroupref=“askdel-run4”/>

<rulerefentry rulegroupref=“askdel-run5”/>

<rulerefentry rulegroupref=“askdel-run6”/>

<rulerefentry rulegroupref=“askdel-appinit”/>

<rulerefentry rulegroupref=“protourreg”/>

<rulerefentry rulegroupref=“protourreg1”/>

LDBX <rulerefentry rulegroupref=“protourreg2”/>

<rulerefentry rulegroupref=“protourreg3”/>

<rulerefentry rulegroupref=“protourExecs”/>

<rulerefentry rulegroupref=“protAvDatVersion”/>

<rulerefentry rulegroupref=“protAvEngVersion”/>