Albatross18

Hi, i'm starting this topic as i haven't found anything related to it with the search function.

Here is the subject :

I have this game called Albatross18, a multiplayer golf game. I've created rules using the FAQ : 1 Server Rule placed between 'Identification (ident) Service' and 'Remote Desktop' default rules, 1 Client Rule placed between 'www-http-1=80' and 'SYN Time' default rules.

The problem is this application uses a specific shell designed by microsoft. The exe's signature of the game seems to be changing constantly resulting in lns popping up the allow/deny window permanently.

I'm using a temporary solution which is to alt tab each time it pops up and then just hiding the lns pop up when the game has reached his connected status.

Is there any way i can allow a changing signature exe in lns using a specific rule ?


Thanks,

-dan

 

Hi,

Do you mean the signature changes each time you start the game ? or does it change even after you have started the game and allowed it once ?

It would be surprising the exe file change so often.

If you are not using the 2.06b2 version, I suggest you try it first.

If the problem is there with the 2.06b2, could you send us (at looknstop@soft4ever.com and in a zipped format) the exe file for which Look 'n' Stop detected a signature change (for two different occurrences).

Thanks,

Frederic

 

Hi,

I've Tried the 206b2 my problem is the same with it.

Do you mean the signature changes each time you start the game ? or does it change even after you have started the game and allowed it once ?

In fact the game exe itself isn't changing but is creating new instances detected by lns as unrecognized applications (after the game is started and allowed).

http://pix.nofrag.com/32/71/61399c52c73e360243ca11c6ca93t.jpg

http://pix.nofrag.com/bc/79/3f699ac9baba5867cda46a6d8d97t2.jpg

As you can see the path is hidden.


Thanks,

-dan

 

Hi,

Thanks for the information.

So actually it is not a signature issue but a problem with the parent application which starts PROJECTG.EXE. This parent application is not detected by Look 'n' Stop because it is using a non standard extension (different from .exe, .com, .bat...).

With the Look 'n' Stop 2.06 there is a way to add non standard extension for parent applications, but you know this extension first.
Do you know which application starts PROJECTG.EXE ? probably it is another file from the same folder.

Also with the 2.06 version normally "UNKNOWN" parent are displayed once, and Look 'n' Stop remember the choice (allowed/blocked) the next time the same alert is to be displayed (this was not the case with the 2.05 where "UNKNOWN" alerts were displayed each time). Do you confirm that with the 2.06 you still have the "UNKNOWN" alert, even after you allowed or blocked it ?

Thanks,

Frederic