RegDefend Allow Once Only....?

Discussion in 'Ghost Security Suite (GSS)' started by dja2k, Jan 25, 2006.

Thread Status:
Not open for further replies.
  1. dja2k

    dja2k Registered Member

    Joined:
    Feb 15, 2005
    Posts:
    2,040
    Location:
    South Texas, USA
    I know this is a really technical question which might have different resualts, but I want to compare them.

    Which programs specifically and\or windows components should be handled with allow once option instead of allways allow to minimize threats? Knowing that the program wont run until allow once is pressed each and every time repeatedly and may become annoying for some users.

    dja2k
     
  2. redwolfe_98

    redwolfe_98 Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    581
    Location:
    South Carolina, USA
    on my computer, the only thing that i worry about, as far as "always allow" rules go, is "services.exe".. however, you can use information from the logs to customize the "always allow" rules that you create so that they will only "always allow" specific things that are OK to "always allow"..

    other than that, i think you can just use your own judgement about what you want to always allow, or not.. it is not hard to delete any of the "always allow" rules, if you decide to do that, or to recreate them..

    sometimes, if i am installing something and getting a lot of alerts, i will click "always allow", as necessary, and then delete the rules later, after finishing what i was doing..

    i have "always allow" rules, as necessary, for the various programs/utilities that i frequently use, and for processes that occur in the normal operation of my computer.. most of the rules have been "tightened" to only allow specific actions..

    incidentally, i do not have an "always allow" rule for "rundll32.exe".. with "rundll32.exe", i "allow once", as necessary.. the only time i see a "rundll32.exe" alert, that i can recall, is when i adjust my display settings..

    "rundll32.exe" is another process that i would be concerned about (in addition to "services.exe")..
     
    Last edited: Jan 27, 2006
Thread Status:
Not open for further replies.