First technique
(the good)
The first technique is the one I’m using commonly and works
very well for me. In this case we’ll try to temporary “coax”
WFP only killing the explorer.exe process and
replacing the system files located in the Dllcache folder
first, so when Windows try to replace our tweaked copies in fact
it will replace them with a tweaked copy too. Here we go:
Step One. Right-click the task bar and select
“Task Manager”. Select the
"Processes" tab and then select
the “Explorer.exe” process,
now click over the “End process”
button. Your desktop icons, the taskbar and any opened explorer
window will disappear. That's ok, we've killed the main
process in the system, so nothing works at this moment. That's
what we need, a vulnerable WFP.

Step Two. Now select "File
-> New task (Run...)" from the main menu
in the Windows Task manager window. This will launch a dialog
box ("Create New Task"), select
"Browse" and go to the folder
where the tweaked files are located. Select only one of them,
(i.e. shell32.dll) right-click it and select "Copy"
from the menu. Now go all the way down (don't click over the "Open"
button yet!) to your Dllcache folder. Select the file
that's called exactly the same (shell32.dll in this example) and
rename it to “shell32.bak”. With this you'll save
a copy of your original file. Now right-click any empty area and
select "Paste" from the menu.
The deceit is done.
Step Three. Go up one level (to System32
folder) and repeat the same process, renaming your original file
to .bak and right-click -> "Paste".
Click the "Cancel" button
in this window, and you'll be back to the "Create
new task" dialog. Type “explorer”
in the "Open" text field and
hit "Ok". You’ll get
a couple of warning messages. Click “Cancel”
to the dialog:

And click “Yes” to the
dialog:
These messages will appear because Windows is recognizing both
copied files, in Dllcache and System32 folders,
as modified files. So, if you see the messages, your file has
been properly replaced.
Advantages of this technique: You’ll keep a copy
of your original files. If something goes wrong, you’ll
be able to fix it using your back up copy. You won’t make
big (and risky) changes to your system. After some time using
this technique, I can tell you that it’s very safe and reliable.
Disadvantages: Take some time to replace every file.
If you’re replacing a bunch of them, the process can be
really tired and boring.
 Second
Technique (the bad)
|