Plans for a new version??

Ok, thanks for the clarification.
I reproduced this problem. Will be fixed in the 2.06.

Frederic

 

No, supporting Windows x64 bits plateform will be another story.

Frederic

 

I know that v2.06 is expected to be released in a “few weeks”, sometime in 2007.
Current customers of Look ‘n’ Stop will be happy to know that they won’t be charged to upgrade, upgrade to what would normally be considered ‘major update’…

Anyways, you might want to consider implementing list boxes to allow multiple entries for Protocols, MACs, IPs and Ports with the same rule...

P.S: Raw Rule Plug-in doesn’t work with multiple maskings…

 

There is hype with the release to soon be, v2.06, now you can correct me if I’m wrong, normally isn’t such a version fall under the class ‘MAJOR’ release? Normally a ‘MAJOR’ release was known as a repurchasing of the product, however for this version it’ll be available free to registered users of previous versions.

That is all good but the thing is, basically what will be introduced with this version 2.06 are tested stable beta features, some more bug/issues fixes along with some enhancements, and not to fancy but some minor additional features.

Anything good and fuzzy is likely not to be seen until a beta which is likely not near the corner.

 

What would make this here v2.06 interesting is the quick TCP SPI enhancement, as mentioned on post #17 https://www.wilderssecurity.com/showpost.php?p=906777&postcount=17, just a thought…

 

One of the MSN Messenger Live versions I run encounters a crash and closes, like my previous reports, it has to-do with ‘Watch Thread injection’, any fixes available?

 

No unfortunately, this feature is no longer supported so far. Need to find a better implementation, so it will be also compatible with DEP.

Is Thermite properly detected with no Crash ? It is strange the problem would be specific to MSN Msg.

Frederic

 

Isn’t compatible with DEP on XP 32-bit systems?

Yes Thermite is properly detected and no crashing as a result of it…

This is like my previous reports, ‘Watch Thread injection’ and normally with updater software…

The description for Event ID ( 1000 ) in Source ( Windows Live Messenger ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: msnmsgr.exe, 8.0.812.0, 44cc1896, wininet.dll, 7.0.5730.11, 45353e23, 0, 000ce000.

 

My system doesn’t have hardware-based DEP, and as I have previously said I’m running Windows XP 32-Bit.

I’m finding more and more often client applications (and not specific anymore to just updaters) that crashes, normally linked to wininet.dll being at fault, and re-launching as many times wanting wont help unless I deactivate the feature ‘Watch Thread injection’.

 

In that case probably the problem is more with the CheckHSRE flag in the registry (this one was for PCAudit2 detection which uses some Wininet API).
If "Watch Thread Injection" is disabled, then it disables also this detection (because PCAudit2 detection requires both activations: "Watch Thread Injection"+CheckHSRE). This would explain why Thermite is detected without a crash, and why you have a crash when some other application use the Wininet API.

Frederic

 

You are absolutely right! I should have known this!!!

 

Just last week or the week before I was testing PCAudit2 v6.3 (which was recent to-date) and Look ‘n’ Stop passing, and passing several times always with repeated re-tests, and no problems come from that… Now disabling CheckHSRE flag required which makes Look ‘n’ Stop not detect & block applications from this sort of used method.