PDA

View Full Version : File protection doesn't work properly


developers
April 1st, 2009, 04:54 PM
Hi,
I have noticed an issue/bug with File protection.
This function doesn't stop folders from being deleted, but it works only with file inside that folder.

I have also noticed that this issue doesn't always apply, sometimes it works fine and sometimes it doesn't work properly (perhaps a function's hook problem)

There are others users affected by this issue.

System:
Windows XP SP3 with Returnil 2.0.1.9002

Coldmoon
April 1st, 2009, 04:59 PM
Hi developers and welcome :)

Are you saying you added the file to the FP list and were able to delete it or did you add only the files in that folder while leaving the folder out of the list?

developers
April 1st, 2009, 05:09 PM
Hi,
I have added a folder with some file inside to the FP list and i have noticed this issue (I was able to delete the folder)

then I have added the entire drive partition (D)to the FP list and I have noticed this issue (I was able to delete the folder)

but sometimes FP works fine, and files and folders aren't deleted

developers
April 2nd, 2009, 07:30 AM
I am able to rename the "protected" files also ???

Coldmoon
April 2nd, 2009, 08:45 AM
Where are the files and the folder located? Also, what happens when you try to open something on the FP list?

developers
April 2nd, 2009, 09:23 AM
Files and folders are in D (Returnil is in C)

When I try to open files, access is denied, but I can delete the folder containing these files (and sometimes files inside the folder too).

There are others users with this issue (another forum), so please correct this bug, because non system partition result vulnerables.

Coldmoon
April 2nd, 2009, 09:49 AM
{QUOTE-> There are others users with this issue (another forum), so please correct this bug, because non system partition result vulnerables. <-QUOTE}

I follow what you are reporting now and appologize for my confusion here. This is related to Windows itself and is not due to a defect in FP.

How is it a vulnerability? The feature is working as designed by denying access which means that any mailicious processes or unauthorized users would be similarly restricted from accessing the content other than the fact that the content itself could potentially be deleted...

Mike

developers
April 2nd, 2009, 11:09 AM
An user believes he is protected both in C and D because File protection is ON, and meanwhile a malware in C deletes all files in D (or in a USB flash drive).

In the manual this limitation is not mentioned

Returnil developers can implement NTFS ACL, this is just an idea, but I think there are others solutions. Yes you can :)