Working with Application Rules, Bug?

Discussion in 'Ghost Security Suite (GSS)' started by siliconman01, Sep 5, 2005.

Thread Status:
Not open for further replies.
  1. siliconman01

    siliconman01 Registered Member

    Joined:
    Mar 6, 2003
    Posts:
    780
    Location:
    West Virginia (USA)
    Windows XP-SP2, Regdefend V2.0

    When working with the programs that end up under Application Rules:

    1. Select the Application
    2. Select the Rule for that application.
    (example: HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run**
    Value *
    3. Under "Allow these events", change ALLOW to BLOCK.

    It changes every program in the list that has HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run**
    Value * from ALLOW to BLOCK....not just the selected program.

    So it appears to be working on key/value basis instead of an Application basis.
    This is not correct, is ito_O? o_O
     
  2. gottadoit

    gottadoit Security Expert

    Joined:
    Jul 12, 2004
    Posts:
    601
    Location:
    Australia
    siliconman01,
    If you look very carefully at the GUI you will realise that it just isn't behaving in the way you expect and the problem is just a matter of getting used to the behaviour. The Allow or Block display options should really be *outside* of that box because they affect what is being displayed not what actions are being taken

    The GUI is remembering which display mode you were in last and showing that again, I must say that I found it confusing at first as well until the penny dropped

    If you click on "Allow" just above you will see "1. Allow these events"
    If you click on "Block" just above you will see "1. Block these events" and also see a "2. Perform these actions on block" box appear

    Regards
     
Thread Status:
Not open for further replies.