Application to prevent process termination

Okay, I nearly have my security setup complete. I'm relying heavily on Sandboxie, as I am now going with a scannerless setup. But I'm not that worried about it. SBIE has always been great. But I am a little weary of its process being terminated, thus my security compromised. I'm looking for an app that can prevent process termination without having to use a classical (rule based) HIPS. Is there such a thing?

I've heard of taskcatcher but was never able to install it; whenever I tried the installer would launch yet nothing would happen.

Any ideas?

 

Hello there n8chavez

I sympatize with your interest in something like that. TaskCatcher just doesn't cut it with me either, but i'm trying my darnest to see if i can make a HIPS protect apps from termination because i don't know of a single app thats been given attention to keeping programs from termination short of the way System Safety Monitor is been able to do, but i since moved away from it for EQS.

Very good question n8chavez and a very valid topic and i'm also curious just what if anything might be suggested that can help make that possibility finally a reality without having to add a whole security program.

A nice standalone would be great.

EASTER

 

I'm tempted to go with EQSecure again and I know that would solve my issue. But I don't like the idea that woth classical HIPS you need to set rules for everything. It's very hard to remember everything that you might eventually need to do so the rule(s) can be created before I make an image. Also, at least this is the case with EQS 4b2, I've never been able to get the sandbox to work right. But that's why I have SBIE.

 

Hi n8chavez

You're not missing what your discovering with EQS Sandbox, it's not complete even though it is a nice feature IF they repair it's issues and finally have it perform as we expect it to. I don't use it although i have tried it and it shows promise!

Thats why i'm very impatient and anxious for EQS 4.0 final because if they fix that sandbox and it works to everyone's satisfaction, that will change everything. I still want them (if they will) to use like SSM's "keep this process in memory" so we can LOCK apps from being terminated.

EQS representative posted tonight but on ProSec, but i sent a PM and a post asking when we might expect to finally experience EQS at it's best.

 

Is this software terminated ? Is it still good enough ?
http://www.diamondcs.com.au/advancedseries/apt.php

 

Ask Tsuk !

 

OK. Thanks for the explanation.

 

I guess I'm worried for no reason. But there have been a couple of times when I noticed that Opera wasn't sandboxed and it was supposed to be. I have it set up so that it is forced, so that means that the process wasn't running. At least I think that's what it means. That's my worry. Is SBIE is in any way bypassed then I'm completely vunerable.

I am trying out AnVir's Security Suite. I like it, it's a good replacement task manager. I was on their forum the other day and suggested to them that they implement process protection into their application. They responded by saying that it was a good idea and that they'll discuss it, whatever that means.

 

You can use Processguard from Diamond CS and add different process to the list to protect against termination. You will be stuck using the free version as you can't get a license for the full version any more.

 

It is interesting, if you run Apt not sanboxed, will SBIE prevent sanboxed browser from termination by Apt ?

 

You could always e-mail Bill at support@WinPatrol .com (with out the space of course)
I know it says WinPatrol but its the same Bill.
I'm sure he would be happy to help.
Myself i've never have any problems with either WinPatrol or TashCatcher, ever.

 

Have you considered using a HIPS with monitoring turned off for all item types you don't care to monitor?

Comodo Firewall 3 could achieve such a setup, I believe. Turn off monitoring of all items except process termination. Specify those programs you wish to protect from process termination. Also, in Computer Security for item 'All Files' (or 'All Applications' or something similar), allow all process terminations, and make sure this entry is moved to the beginning of the list. This setup, I believe, will protect only those programs you specified from termination, without other alerts.

 

No, if i understand you correctly, SBIE can prevent process termination only from sandboxed applications. Of course the application you want to protect have to be listed as protected. Please see below for further explaination.

 

The only security program that i've had plenty of positive experience with in protecting full closure of running processes is been System Safety Monitor. If for what ever reason any app you set it to "keep process in memory" happens to either crash or is forced closed, SSM immediately restarts it again and again to infinitety.

I don't know of any standalone app that can do that, and all other HIPS to my knowledge don't bother to impliment this protective procedure except SSM, and of course it's a HIPS.

EASTER

 

You are correct Peter. However, if you are using SBIE as your main security application, especially to protect against process termination, then you have essentially made the SBIE process(es) extremely valuable and vunerable, as there is nothing in place to prevent them from being terminated. That's where I am, and why I'm looking for help in addition to SBIE.

Let me just expand on a few things:

That is a very good idea. I admit I like SSM better than any other HIPS both because it was the first one I used and because it has an option to restart terminated processes. That sounds like exactly what I'm looking for, right? Well, it is. Except that there seems to be some sort of compatability issue between SBIE and SSM; progras that are lauched as sandboxed take about ten minutes to load, if they ever do. I've tried installing SSM five time, each with the same result. If it comes down to SBIE or SSM I'll choose SBIE every time.

Correct. Let me clarify what I meant. One of two things has to be in place; either the program doing the terminating must be sandboxed or the programs you want to prevent from being terminated must be protected via SBIE's settings.

 

That's weird. I wonder why it doesn't function correct;y on my system. Do you have the paid version? Are all the modules enabled?

 

Hey Peter, I know Mike wont mind but from the OA home page,
"Online Armor also provides powerful protection against keystroke records and even filters your email messages to weed out banking scams. While you're surfing the web, Online Armor filters web pages that you visit to remove potentially dangerous content."

Now that sure as heck is close to "scanning" as you can get in my view point. Just having some fun my friend. I figure as long as Avira is not set to do a pre-scheduled scan, then I dont use a scanner either.

 

cant argue with a honest man.