Process Termination Protection

Discussion in 'other anti-malware software' started by RedZero, Oct 27, 2007.

Thread Status:
Not open for further replies.
  1. RedZero

    RedZero Registered Member

    Joined:
    Oct 22, 2007
    Posts:
    34
    Is there a stand-alone app that strictly focuses on protecting against process termination?

    Thanks!
     
  2. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,408
    Task Catcher is one.
     
  3. RedZero

    RedZero Registered Member

    Joined:
    Oct 22, 2007
    Posts:
    34
    Thanks, that looks good but...

    Is there a free alternative to Task Catcher?
     
  4. farmerlee

    farmerlee Registered Member

    Joined:
    Jul 1, 2006
    Posts:
    2,585
    I believe something like prosecurity free is able to protect against termination attempts. You can even set it up to just monitor termination and nothing else if you prefer.
     
  5. LUSHER

    LUSHER Registered Member

    Joined:
    Feb 28, 2007
    Posts:
    440
    From the description it seems Task Catcher doesn't protect process from termination but rather it restarts the process once it is stopped. Not quite the same thing. And not as secure.
     
  6. solcroft

    solcroft Registered Member

    Joined:
    Jun 1, 2006
    Posts:
    1,639
    That is debatable.

    The fact remains that, with admin rights, ANY process can be terminated if the attacker tries hard enough. Restarting a terminated process is a very viable option.
     
  7. LUSHER

    LUSHER Registered Member

    Joined:
    Feb 28, 2007
    Posts:
    440
    Of course it is. Isn't everything?

    As a backup option, if termination protection fails, maybe. I believe SSM has or used to have a similar option for this - keep process in memory or something.

    And the fact remains, you would prefer the process not to be terminated at all, compared to being terminated, and then being restarted with a window of opportunity...
     
  8. solcroft

    solcroft Registered Member

    Joined:
    Jun 1, 2006
    Posts:
    1,639
    It still does. I use this on one of my setups with Winpooch, and they complement each other perfectly (as Winpooch is somewhat weak in the self-defense department).

    That depends a lot on what is being terminated, doesn't it?

    Not to mention that the first preference, as mentioned before, isn't always possible.
     
  9. MaB69

    MaB69 Registered Member

    Joined:
    Dec 9, 2005
    Posts:
    540
    Location:
    Paris
  10. LUSHER

    LUSHER Registered Member

    Joined:
    Feb 28, 2007
    Posts:
    440
    Don't you use Eqsecure?

    Well, since we are talking about being more "secure", I guess we are talking about security related processes?

    We only can use what is possible yes. But one wonders if restarting a process that has being terminated might be too late and if so the whole point of restarting the process is moot.
     
  11. LUSHER

    LUSHER Registered Member

    Joined:
    Feb 28, 2007
    Posts:
    440
    Well the original question talked about a standalone that "strictly focuses" on process termination protection , so I don't know if the things already mentioned (except Taskcatcher which is disqualified as alluded earlier since it doesn't protect proceses from termination), count since they do more than just process termination protection?
     
  12. solcroft

    solcroft Registered Member

    Joined:
    Jun 1, 2006
    Posts:
    1,639
    To be honest, I cannot at the moment think of an instance where restarting a terminated security process is a moot point. Perhaps you would care to provide examples?
     
  13. RedZero

    RedZero Registered Member

    Joined:
    Oct 22, 2007
    Posts:
    34
    I agree. All it takes is a small window of opportunity, and the time that it takes between termination and the restarting process could be a sufficient amount of time for the malware to gain control.

    It's funny that solcroft should mention Winpooch, because that's exactly what I'm trying to protect. ;)
     
  14. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,408
    Then you may need a HIPS program.

    I believe GeSWall does this.........please correct me if i'm wrong.

    But then again it does more then this and the OP is interested in a stand alone app who's sole purpose is to protect from termination.
     
    Last edited: Oct 28, 2007
Loading...
Thread Status:
Not open for further replies.