Application Filtering Bug?

I noticed that without an application filtering rule for a given program, I can still access the web (online documentation) within that program without being prompted by LnS for authorization if my web browser (Firefox) is already running. If I close Firefox and try again, then the LnS prompt will appear as expected.

I'm guessing that's a bug. I'm using 2.07 on Vista64.

 

You are suppose to re-boot the computer after the Look 'n' Stop Installation.

 

My computer has been rebooted perhaps a hundred times since I first installed 2.07 months ago.

I'll cross my fingers for reboot #101.

 

hehe...

So to be clear, we talking about the Look 'n' Stop prompt to alert of an application launching another one which will connect?

 

Yes.

I'd like someone to test it out on their system by disabling/removing the application rule for a program and then accessing a feature that needs to connect to the internet through a web browser, with the web browser already running.

I get a prompt with no browser instance running beforehand, but no prompt when the browser is already open.

 

I tried reproducing it with Internet Explorer (which is my default and only browser), I didn’t succeed. I downloaded and installed firefox and configured it as my default browser and tested, I didn’t succeed here either in reproducing your experiences.


Running Windows 7 x64, and Look ‘n’ Stop v2.07

 

Thanks for going to that trouble, Phant0m!

If I make IE7 my default browser, then under no circumstances do I ever get an LnS prompt when an undefined program accesses the web.

I re-installed 2.07 after having the uninstaller delete everything, and even with the default configuration options, LnS will not detect when an application accesses the internet through a web browser unless the default browser is something other than IE and it isn't currently running, as outlined in my other posts. Yes, I rebooted.

This is a serious problem. I will continue to do testing to narrow down the possible causes if it isn't simply a 2.07 bug with Vista64.

 

To detect applications starting another application that will connect..., you have to enable ‘Advanced Mode’ by visiting Look ‘n’ Stop - ‘Options’ screen/Tab and clicking ‘Advanced options’ button.

Is there anything set for Internet Explorer LAN settings under ‘Connections’ Tab?

 

I always run in Advanced mode with all other options checked under Miscellaneous except Raw Log, with protocol filtering enabled. I'm also using some guy's Deluxe v1 Build 006 ruleset.

No, there's nothing checked or configured in LAN settings.

I've found that LnS 2.06p4 exhibits the same problem in Vista64.

In XP (multi-booting with XOSL), LnS is working as expected. Vista64 is completely independent on a different drive.

I have a license of Win7 Pro that I haven't installed yet for another drive's partition. I'll install it at some point and see if it works as expected.

 

I’m not certain why you experiencing this strange behavior, and I’ve still haven’t been able to reproduce this with my setup.

 

There is something wrong with my particular hardware/software configuration.

I tested fresh installations of Windows 7 64 and Vista 64 in their own virtual machines in which LnS behaved properly.

I have imaged many states of my configuration since the OS was installed so I am confident that I can track down the problem with the help of the excellent Total Uninstall monitoring program.

I'll post back when I find the cause. Thanks for your help, Phant0m!

 

I jumped to conclusions too soon.

There is most definitely a problem with application filtering in Vista64, which does not exist in Windows 7 64.

When IE7 is the default browser, any application that connects to the web through it is detected by LnS as IEUSER.EXE rather than the app's own executable (full path: C:\Program Files (x86)\Internet Explorer\ieuser.exe).

Therefore, if ieuser.exe is given permanent access, then any program will automatically connect to IE to launch a web page.

In my case with Firefox as the default browser, the result is as I explained. When Firefox is not running, LnS will correctly detect the program requesting web access. If Firefox is running, then LnS will not offer any prompt.

I tested this on a fresh installation of Vista 64 SP2 on my computer, and in a virtual machine.

I hope I can get confirmation of this problem and that there will be a solution.

 

Even though you not using Internet Explorer as your default browser, I’d still recommend upgrading to IE v8, this may address the anomaly.

 

Okay, I've managed to reproduce the problem on the Windows 7 64 VM also.

IE8 on Vista64 solves the problem when IE is the default browser. LnS correctly detects each application as it tries to connect to the web through IE8.

Both OSes exhibit the problem of no LnS prompt appearing when Firefox is default and already running.

I will install all updates associated with IE8 and see if anything changes.

 

We getting there!

 

This is not something new, if a process A has been already allowed to connect because started by an allowed process B, then when another process C starts a web link and process A is reused for that, the connection is allowed.

Some other posts:

https://www.wilderssecurity.com/showthread.php?t=226516
https://www.wilderssecurity.com/showthread.php?t=200690
https://www.wilderssecurity.com/showthread.php?t=179160

Regards,

Frederic

 

Thanks for the clarification, Frederic.

I was embroiled by ieuser.exe always being the host process for IE7 in Vista but not in XP, which led me on a wild goose chase to account for inconsistencies between IE7 and IE8/Firefox.

Hehe.