2.05p3 Package Available

Hi All,

Here is finally the 2.05p3.
Sorry for being late to deliver this package.

The links for downloads:
- En: http://looknstop.soft4ever.com/Beta/Beta-2.05p3/LooknStop_Setup_205p3.exe
- Fr: http://looknstop.soft4ever.com/Beta/Beta-2.05p3/Installation_LooknStop_205p3.exe

Again, this package is only to put together all existing beta versions (drivers, service) in one beta package.
This is not a normal version, only beta-testers should use it.
Like for some other announces I did, it contains some experimental stuff and it is not sure everything will be included in the next release.

However, it contains some fixes, mainly in the application and in lnsfw.sys, which are not experimental and will be in the next release of course.
Also, if the experimental features of the lnsfw1 driver are not activated (a .reg file is provided to activate them), the driver is supposed to work as normal.
About these experimental features, we know they are not working when the DEP/Nx protection is enabled on recent processors.

To know more about the beta content, please consult the following threads:
- about Application Filtering: https://www.wilderssecurity.com/showthread.php?t=54543
- about Internet Filtering: https://www.wilderssecurity.com/showthread.php?t=68514
- about Service start mode: https://www.wilderssecurity.com/showthread.php?t=46088

Some pre-beta testers of this package reported a strange issue which is called "unknown alert" (application filtering reporting some alerts without a valid information). Unfortunately, this issue has not been understood, so you may experience it. When it has appeared, it was mainly just after the update and strangely it seems to disappear a bit after.

Here is the list of changes (no change compared to the first list I've communicated):

Fixes:

• The "extra save" feature now saves the filename paths correctly with 2 '\' when needed, so the import of the .reg file is working for the list of Applications.
• Confirm on Exit now works also when using the Quit from the Trayicon menu.
• Help key (F1) correctly handled in all dialog boxes.
• Memory leak in the icon handling for the list of connected applications.
• Yellow icon not refreshed when the Edit button was used.
• Internet filtering (Win2000/XP only): fix in the driver about the Different And criteria which was not working.
• Internet Filtering: TCP SPI (Win2000/XP only): better handling of timeouts and closing connections.
• Internet Filtering: Fixed some problems with rules handling IP fragmentation flags.
• Application Filtering (Win2000/XP only): the handling of port & IP ranges was not working.
• Application Filtering (Win2000/XP only): new installation of the driver to avoid the problem of load order which caused lnsfw1 to be disabled.

Added:

• Service automatic uninstall when Look 'n' Stop in uninstalled.

Changes:

• When the password is deactivated, its value remains and is no longer reset to null.
• The automatic log cleanup removes 10% of the items when the limit is below 1000 (instead of removing by default 100 items).
• When a ruleset filename has been translated by a plugin, a check is performed to verify the file exists, if not, the default ruleset filename is used.
• Internet Filtering: TCP SPI (Win2000/XP only): the number of simultaneous connections is now 256.
• Protocols handling (Win2000/XP only): a modification through the dialog box (addition/removal/blocking/allowing a protocol) has now an immediate effect.

As usual, please report any issue to lnssupport@soft4ever.com, join minidump file in case of BSOD, and a DrWatson log in case of an application crash.

Thanks,

Frederic

 

Thanks Frederic,

I´m going to try this beta version.

Best Regards,

DonKid.

 

It says to me that can't load lnsw driver...

 

Frederic,

First of all "Thank you very much for the new version!!"

Could you give some advice for the installation? Can we install it just on top of an already installed version 2.05p2 ? Or could this new version may interfere with some of my manually added tools (like "LnSSvc.exe") ??

Thomas

 

Hi Thomas,

Yes, it can be installed on top of the 2.05p2, or on top of an already patched 2.05p2 version + beta drivers + LnsSvc, or as a fresh install.

If LnsSvc was already present, normally it should not interfer if you don't re-enable the new LnsSvc (this is a manual optional step). Depending where you originally put the LnsSvc it could happen you have two versions (or at least two locations with the same file). In that case, you should uninstall the first LnsSvc, remove the old location and use the new location.

Frederic

 

Was Look 'n' Stop 2.05p2 working correctly before ?
What kind of installation of the 2.05p3 you did: update or fresh install ?

Thanks,

Frederic

 

2.05 p2 works great... i've uninstalled old version and installed the new one. lnsfw.sys is in the right folder but the program can't load it, and if i try to start i can't do application filtering

 

Now it's ok, i've tried to install unless uninstalling old version and works. thanks

 

If the first time you uninstalled and re-installed without rebooting in between, yes, this problem may happen.

Frederic

 

What is LnsSvc ?
How does it work ?

 

DonKid,
First try reading this thread:
https://www.wilderssecurity.com/showthread.php?t=31536

followed by this:
https://www.wilderssecurity.com/showthread.php?t=46088

Regards,
Thomas

 

Thank you Thomas.

 

Hi all,

I'm not sure if this is the right place to post, 'coz is something to do with Proxomitron.

Installed LnS 2.05p3 yesterday (clean installed + .reg + LnsSvc 1.01b3 applied). During the leak test (PcAudit2) LnS failed if Proxo running but it passed the test if Proxo not running. While the other tests (copycat and DNSTester) had no problem with or w/o Proxo running, LnS always passed that test.

If i'll remember correctly this not happens to LnS 2.05p2 + beta driver + .reg + LnsSvc 1.01b2.

Can anyone confirm this ?.

ps- Any thought highly appreciates.

TIA

 

Hi storm119,

Could you verify all blocking features are enabled, as explained here:
https://www.wilderssecurity.com/showpost.php?p=311509&postcount=64


Thanks,

Frederic

 

Hi Frederic,

I'm happy to report, before i post here i did another test with Proxo running. This time LnS passing the PCAudit2 test without problem. I'm not sure why on the other day its failed the tests. Still puzzle me though, maybe its my end problem or perhaps LnS not working properly (i assumed this be'coz LnS doesn't detect PCAudit2 try to injected to .Dll and failed to inform user..i hope i was wrong on this).

Back on your original question. Here what i saw in LnS driver logs :-

FW1:
ReSLIN!
FO2_Ok
FO2_2_Ok
FO4_KO1
FO5_Ok
<SYSTEM>
<SYSTEM>
UFO3_Ok

I hope its nothing wrong with the driver logs.

Btw..thx for your superb! application's. Highly recommend,though.

ps- I hope to see a new GUI in future release.

TIA

 

Hi,

The same issue was encountered by SSK with the previous beta driver (FO4_KO1 => PCAudit2 protection is not enabled).
For more information, you can read the following thread
https://www.wilderssecurity.com/showthread.php?t=54543&page=4&pp=25
starting with message #95.

Unfortunately, I've still no idea on how to fix that

I think it's not related to the 2.05p3 package, maybe a coincidence if your wininet.dll file was just updated since the last time you tried PCAudit2.
You can put back the old driver (indicated at the beginning of the former thread, just rename your current lnsfw1.sys into lnsfw1.new before copying the old file) in case you want to re-test anyway.

Frederic

 

I need to reinstall LnS to see if the problem is still there, but if it is maybe Storm and I can compare setup's to see if we have something in common.

 

The particular thing to be checked is the version of wininet.dll, if 6.0.2900.2598 => the problem appears.

Frederic

 

Version 6.0.2900.2713 at the moment. So there should be no problem.
Storm, are you up to date with all Windows / Office SP's / Patches?

 

Equal or Greater, I believe Frederic meant...

 

@Frederic

Thx for your confirmation. I'm just wondering why its works on the other day but failed by the following day..? . And regardless the wininet.dll, this file was updated since August'05. Anyway i will do some test and give you my report later.

@Phant0m

Any update for your current rules set.?

Yup!. WinXP Pro SP2 all patches applied (up to August'05) = all update.Those included wininet.dll version 6.0.2900.2713

..and here another confirmation

Well..i will do some test later on those include downgrade the wininet.dll and give my report ASAP!.

@SSK & RetupmocSoft

Are you guys using "FlyakiteOSX" emulating software.?.

TIA

 

Ach so...

No.

 

@SSK,

TQ.

Btw..i was doing some experimental. Replacing the wininet.dll from 6.0.2900.2713 to 6.0.2900.2668 still no joy. Reinstalling LnS 2.05p3 return with same result = FO4_KO1 (testing with both wininet.dll version).

What puzzle me although with FO4_KO1 appeared and not running proxo, LnS will passed the PCAudit2 test.

Btw.. i'll keep testing. If i catch something interesting will report here

 

PCAudit2 test is not 100% accurate. Sometimes it happens it can't send packets to the outside whereas the vulnerability is there anyway.

Frederic

 

Hi!

Is it only me, but help button in the GUI does not work? Just curious.

Cheers,

Technic