Geswall problem

Discussion in 'other anti-malware software' started by overangry, Aug 16, 2009.

Thread Status:
Not open for further replies.
  1. overangry

    overangry Registered Member

    Joined:
    Apr 4, 2009
    Posts:
    309
    I recently ran a test (see screens).

    I seem to have passed this test, and I just have a few questions.
    All of my security applications were shut down, I assume this would be expected and normal, as this test is to see if you are protected after/during the shut-down process.

    Prevx was able to reactivate its process after termination:thumb:

    To my question; I opted for termination using the shutdown tab on the SSS GUI, now this application is being run isolated, how was it able to disable all of my security apps except for prevx.

    Above all, how was this isolated application able to terminate (Geswall),it effectively self destructedo_O

    No more the option, terminate isolated applications, no more Geswallo_O

    If I had of used start/turn off computer, I would have expected this behaviour.
     

    Attached Files:

  2. overangry

    overangry Registered Member

    Joined:
    Apr 4, 2009
    Posts:
    309
    Sorry for bumping:D
    I may not have expressed myself correctly.

    Firefox was isolated, the downloaded file was isolated, and was executed isolated.
    All security applications were disabled. Prevx managed to restart.

    I am only asking if this should be expected behavioro_O

    Shouldn't Geswall prevent this from happening? What if malware loaded after my AV's are disabled? I know I pressed shutdown computer but I may have just as easily clicked a link to this malware.(Yes, No, Collect Prize)

    I had no option to terminate this process as Geswall was disabled. I find this behavior rather odd...

    Any help in understanding why this happened would be appreciated:)
     
  3. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    GesWall passes this test.

    Test simulates a system shut down just like normal; system shutdown and geswall is not supposed to intercept it. So all applications are shutdown just like all applications are shutdown on normal system shutdown. GesWall GUI disappears too but protection is there. If u run test isolated. It creates a file Eicer that is isolated. It produces an auto-start reg entery that is not created infact( virtualized). Test goes for outbound that is allowed however as geswall doesn,t stop outbound unless u make a custom rule in which case geswall will stop that also.
     
  4. overangry

    overangry Registered Member

    Joined:
    Apr 4, 2009
    Posts:
    309
    Thank you agile, for your detailed explanation.
    What I am unable to understand is that this application was isolated, Geswall had no way of knowing it was a test, as such I assumed my system would be safe and that any application I run isolated would not be able to do what this application did.

    Other tests when run isolated, failed to start as I expected.

    How did it access the required resources(running isolated) to do this?
     
  5. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    I don,t know technical details. Test is a pass as I explained. U need to understand the test first, then it will be clear to u. It,s not just a system shutdown test.
     
  6. overangry

    overangry Registered Member

    Joined:
    Apr 4, 2009
    Posts:
    309
    Thank you aigle, I realise the nature of this test what it is meant to simulate and that geswall passed this test.
    I just can't comprehend how it does this isolated.

    Thanks all the same aigle, I'll post on the geswall forum and see if I can get some help understanding this.
     
  7. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    U run the test. Reboot ur PC and then see the eicer file, u will find it isolated. See GW log, autorun reg entery was virtualized. That must be OK for u.

    U can make a custom rule for network and can see that net acces will be blocked.
     
Loading...
Thread Status:
Not open for further replies.