A computer-implemented method, comprising: monitoring, by a first computer, a generation of a link file that includes a target path that points to an object; in response to monitoring the generation of the link file: identifying, by the first computer, a process that caused the link file to be generated; determining, by the first computer, whether the process is a prohibited process; in response to determining that the process is a prohibited process, performing, by the first computer, one or more protection processes on the process and the link file; in response to determining that the process is not a prohibited process, determine, by the first computer, whether the target path is a uniform resource locator and the link file generates a request to a uniform resource locator; in response to determining that the link file generates a request to the uniform resource locator, determining, by the first computer, whether the uniform resource locator addresses a malicious website or file; and in response to determining that the uniform resource locator addresses a malicious website or file, performing, by the first computer, one or more protection processes on the link file. monitoring, by a first computer, a generation of a link file that includes a target path that points to an object; in response to monitoring the generation of the link file: identifying, by the first computer, a process that caused the link file to be generated; determining, by the first computer, whether the process is a prohibited process; in response to determining that the process is a prohibited process, performing, by the first computer, one or more protection processes on the process and the link file; in response to determining that the process is not a prohibited process, determine, by the first computer, whether the target path is a uniform resource locator and the link file generates a request to a uniform resource locator; in response to determining that the link file generates a request to the uniform resource locator, determining, by the first computer, whether the uniform resource locator addresses a malicious website or file; and in response to determining that the uniform resource locator addresses a malicious website or file, performing, by the first computer, one or more protection processes on the link file. identifying, by the first computer, a process that caused the link file to be generated; determining, by the first computer, whether the process is a prohibited process; in response to determining that the process is a prohibited process, performing, by the first computer, one or more protection processes on the process and the link file; in response to determining that the process is not a prohibited process, determine, by the first computer, whether the target path is a uniform resource locator and the link file generates a request to a uniform resource locator; in response to determining that the link file generates a request to the uniform resource locator, determining, by the first computer, whether the uniform resource locator addresses a malicious website or file; and in response to determining that the uniform resource locator addresses a malicious website or file, performing, by the first computer, one or more protection processes on the link file.