New Beta Driver addressing additional vulnerabilities/Leaktests.

Hello, Frederic.

After installation LnSfw1-d2 beta-driver (03 dec 2004) all programs, started by me it is direct (with Desktop, from menu...), became children processes of a explorer.exe.

And after closing programs, they do not disappear from the left window on page "App filtering": http://artlonger.fromru.com/temp/beta2app.gif

It not problems, to work do not prevent. But has decided to tell

 

Hi ArtLonger,

Do you mean you were using the Lnsfw1-d1 before with no problem (this would be strange) ? or did you try the lnsfw1-d2 directly (this is Ok).

If you added the ActivatedSoon Flag, it is normal to have now explorer.exe seen as starting the other applications. This is not the case in standard mode because explorer.exe is started before Look 'n' Stop and the driver is not yet configured.

Try reinstalling Look 'n' Stop on top of your current installation.

Frederic

 

No, beta 1 driver i did not use. I have understood.
But for Explorer.exe special control children programs probably are necessary. Otherwise is necessary to resolve ALL...

And installation on top current has helped - doubles in the list are not present.
Thanks!

 

After several reboot, doubles appear again... :-(

 

You may have a virus, changing looknstop.exe.

Frederic

 

Hello, Frederic.

Oh. It not the virus, it's my experiments...
The program very excellent, but interface not so beautiful... (i'm sorry)
I have made new icons, look:
http://artlonger.fromru.com/temp/bitmap.zip

Thanks

 

sorry guys..but where is this d2 beta driver you're talking about? I couldn't find it mentioned anywhere else in the forum!

 

To manuangi

I had small problems:
https://www.wilderssecurity.com/showthread.php?t=57849

Frederic has given the new link:
http://looknstop.soft4ever.com/Beta/lnsfw1/LNSFW1-d2.zip

 

thank you, I think the new d2 should be published at the beginning of this thread as well!

 

Frederic - Can you make this thread a sticky please.

 

"DNSTester" & "TooLeaky" are still getting past me fior some reason...
Can someone please suggest how I can configure LNS to stop this please??

 

One computer has all of the above. The other only has:
"FO2_Ok
FO2_2_Ok
FO3_Ok

Should I see all the lines in the driver log?

 

Do you exclusively see these entries, or do the other driver logs come out like:
FOx_KOy

Correction:
I remember that only machines running WinXP-SP2 or Win2K-SP4 get full protection for these leak tests.

Thomas

 

I must have been asleep when I posted my last thread because I never noticed the beta driver was updated from d1 to d2. I agree with with manuangi that the beginning of this thread should have the link for d2 instead of d1. Can you change it Frederic.

 

I have some strange characters in my console driver logs after FW: and before FW1: as shown on attached image. Why are they there ?

Another thing is that I don't see the line

FO_Ok

in my logs. It just lists

FO2_Ok
FO2_2_Ok
FO3_Ok
FO4_Ok
FO5_Ok

How come ?

EDIT: I'm on XP Home SP2 using the latest LnS beta drivers and LnSSvc.

 

One more thing re. the Console - the scroll position is set to the end every time a new entry is added. This can make it difficult to analyse some of the entries near the beginning because it keeps moving to the newly added entries at the bottom. Would it be possible to add a checkbox to the console so that this behaviour could be enabled/disabled by the user.

 

Good point! In this thread Frederic is the only one to report this driver log! I do not see it either.

Maybe Frederic can help ??

Thanks,
Thomas

 

"Too Leaky" is still getting past LNS for me..
What am I doing wrong please peoples??

 

On one computer I am missing FO_OK. The other lines are there.

On the other computer I only have FO2_Ok, FO2_2_Ok and FO_Ok.

Neither computer has "FOx_KOy!".

 

Just checked my LnS, with both the beta-drivers installed, LnSService and Phant0m``'s ruleset:

FO2_OK
FO2_2_OK
FO4_KO1
FO3_OK
FO5_OK

So FO4 seems troubled. And I'm missing FO_OK?

 

My driver log says:

FW:
Driver Entry Win2k/XP p1
WAN Miniport (IP) - Look 'n' Stop Driver
VIA Rhine III Fast Ethernet Adapter - Look 'n' Stop Driver
FW1:
Driver Entry Win2k/XP d2.
FO2_Ok
FO2_2_Ok
ReSLIN!
FO4_Ok
FO3_Ok
FO5_Ok

I'd like to know the meaning of ReSLIN! and the absence of FO_Ok .
Thanks

 

Hi,

"FO_Ok" is present when the feature "Watch DNS Calls" (from advanced options) is enable and correctly activated.
But this feature has to be deacticated when the flag CheckDNSQ is enabled. So it is perfectly normal to have "FO3_Ok" and no "FO_Ok".

"ReSLIN!" is the detection of an internal event that should not occur.
Having one at the beginning is not so problematic. If many of these events would occur it will be annoying.
In case of another major issue, it is just interesting to know if just before, this event occured.

Frederic

 

yeah!!!
been waiting for it too long!
thx a lot!
waiting for the Final one~~~

 

Hi Frederic, thanks for the explanation of FO_OK.
Can you tell what is the matter with FO4_KO1?

 

This is linked to the following activation and detection:

"CheckHSRE"=dword:00000001 => for PCAudit type detection

The driver was not able to install the detection routine (for an unknown reason).

I would be interest to know if you are the only one with this error.
What is your Windows version ? did you install all SP and IE updates ?

Frederic