DefenseWall FW- some questions!

Hi,

As far as I understand DefenseWall FW sandboxes untrusted processes and apps. But it does not delete the contents of a sandbox like sbie does. Simply restricts the access by process to certain areas of Windows.

What will happen if a malware infects my pc? System will not be damaged as malware is sandboxed and perfectly safe. But it will remain there right? And the moment I uninstall DefenseWall FW the malware sees the light of my system right? What happens if that malware of a keylogger type? Or screen grabbing type? Does DefenseWall FW protect browser from MITB and MITM?

Best Wishes,
Amit

 

Has Defensewall lost its rollback feature? You have tried using Defensewall right?

 

Yes it sandboxes any untrusted (usually Internet facing) programs and with the firewall option does not all it to call out (it has both inbound and outbound application control). To empty the sandbox either use delete or rollback functions.

I have not seen any malware that can get around it. If malware runs within its restricted zone just hit "stop attack" button and it will stop/freeze. You can then rollback or do scan with something like HitmanPro to get ride of the malware. It can not affect your computer or send any information out.

 

I'm currently using DefenseWall FW. I didn't know it had a rollback feature. I could not find it mentioned anywhere on the interface.

 

How do I rollback or delete to empty the sandbox? I could not find them mentioned anywhere on the interface.

 

Yes.

Yes, but remains inactive, only the "dead body" of the malware.

No, since it failed to really infect the system and to run the process. You got only a dead remnant of the malware in the HD.

Afaik it's the same as I told before. I have never seen that DW somehow fails any antimalware test.

Though its creator insists on multilayer protection - add some free av even if its not resident, just for detection and cleaning of dead remnants of malware.



[MOVE]DefenseWall Personal Firewall is GREAT ! ! ![/MOVE]


.

 

You can't empty the sandbox as there is no sandbox (virtualization container, in fact). There is rollback, its onto the "Stop attack" sheet, "File and Registry Rollback", but it's a partial solution.

The main idea of DW is to prevent users from being infected with 0 to 6 hours malwares, taking into account that an average user will fail with properly operating virtualization container. Because, after this time, anti-virus is entering this "cat-mouse" game (referring to MRG Flash Test) and can clean up malware files from untrusted zone automatically, without user's interaction.

 

Okay got it.

 

Ah I understand now. So I've to use an AV with DefenseWall FW to get proper protection. Okay thanks.

 

You may not need an AV as DW is that good. I use what's in my signature because I love to be paranoid

 

Okay thanks.

 

it is very strong i tell you just learn how to use the roll back feature and you have some thing like sandboxie

 

Thanks. I don't need Rollback and Ilya said it's a partial solution. I'm safe and secured with my setup I guess.

 

If the rollback feature is never used ,how much history accumulates,isnt that a problem

 

Nope as this list saves entries only for 30 days (can be switched off).

 

What do you mean? Kindly elaborate.

 

DW automatically deletes entries from Rollback list after 30 days (read more about rollback feature)
Here is full DW help file: http://www.softsphere.com/online-help/defensewall/

 

I mean that 30-days old entries in the list removes by the program in case "Automatically remove items from rollback list" is on (it is by default).

 

@Creer and @Ilya Rabinovich

Thanks a lot guys.

 

Is LnS a carry over from an old love affair or is there benefit in keeping it running alongside DW?

(Just asking as I've yet to delve into DW)

 

A little of both. LnS is a true firewall with SPI and DW is more of an application permission. There is some overlap with application control, but they have no conflicts with each other.

 

Thanks never knew that,i will buy when a 64 version is out

 

me too