deleting protected executables

Are you protected against deletion of the security apps?
Withouth termination of the running processes the executable files can be removed with zap.exe from:

http://helpdesk.kixtart.org/KixUtilsTasks.asp
(Source code is public)

It can remove AT, AV and firewall executable files while these softwares are actually running. Then all you need is a reboot to terminate all.

Anybody know some protection from this?
-hojtsy-

 

I was not talking about kill.exe published there: that is stopped by PG. I was specifically talking about zap.exe. It is just a demonstration of a method to delete running exes. The same method could be used by trojans, which of course will not have the name zap.exe.

GoBack does not protect you:
Is there a protection against robbers stoling your TV? Yes, hide some money to buy a new TV, and then you are protected from stoling it!
Could work, but what about also perfecting your locks?

 

Well yes the all-powerfull execution protection. If we have this we don't need privileges, we don't need the generic protections, we don't need TDS, we don't need personal firewalls. And we don't need to protect the files.
Because no malware will ever be started with it. Glad you mentioned, i will sleep well now.

I never advocated against GoBack, I only say that prevention is also needed. I also don't think that perpect prevention is possible, but we can get nearer than this. The analoge of money in my example is the efforts and time needed to always keep GoBack up to date, and to restore it.
-hojtsy-

 

Hi hojtsy,

i don't think there is anything we can do about it, as soon as i start a malware, if it attacks my protected processes, well, PG is here, but if it wants to delete files on my HDD, i can't do anything, unfortunaly.

I think that viruses and trojans wants to live the longer possible, which mean to remain stealth and undetected, and to delete critical files is all but stealth (above all security apps).

However, if they wants to delete, they can delete, whatever it is already running or not, you can't protect against logic bomb.
If your post is "why not to add file access allowances" to Process Guard, why to not call it like that ?

 

Peter2150,
OK then GoBack is a fine piece. Still:

Why have I purchased Process Guard?

Have I purchased it to protect me from known viruses (demonstarted by the eicar test file)? No, I already have AV for that.
Have I purchased it to protect me from known trojans? No, I have already TDS for that.
Have I purchased it to protect me from running new or changed executables? No, because there are free tools doing this! I am not paying for a feature which is also provided by a free tool.
Have I purchased it to limit what certain executables can do while executing? YES!

In particular a half-trusted app should be blocked from:
1) external and internal communication
2) read or write access to designated memory areas
3) read or write access to designated hard disc (+cd,floppy) areas.
4) read or write access to designated registry areas

Personal Firewall provides number 1.
PG provides number 2.
These softwares are dedicated to limit the privileges of a running software. If you have purchased one of them, you are suspecting that malicious software can actually be executed on you machine. If you are not suspecting that, then you have not installed these.

In previous threads it was said that PG also partially provides number 3, because executables files of running security software can not be modified. But zap.exe proves that this assumption was false.

Number 3 or 4 is not provided yet. There are some inital attempts for these by Tiny firewall, but no dedicated software. It is like a keep guarded from 2 sides and wide open on the other two, and if any of these defenses fail it can ruin the other 3.

gkweb,
my post is: "why not add file + registry allowances to PG or some other DCS product" and "does anybody know of some existing software for this".

-hojtsy-

 

Process Guard will expand it's features overtime to include things like file and registry protection. If a trojan has to delete all security EXE's and reboot, to get around Process Guard then that is better than having those EXE's running on your system compromised.

If all your security apps get deleted dot you think that it isn't highly obvious something is wrong with your system? Trojans are designed to blend into your system not destroy it. Process Guard covers the worst attacks, but it will expand to include a lot of other things in the near future.

-Jason-

 

Hmm, still only user-level granularity of file access control, and not process-level, but a good start with own file system driver:
http://www.softstack.com/fileprotpro.html
Oops.

-hojtsy-