WSA - Protected Application Query

Discussion in 'Prevx Betas' started by Fad, Nov 8, 2011.

Thread Status:
Not open for further replies.
  1. Fad

    Fad Registered Member

    Joined:
    Feb 25, 2009
    Posts:
    378
    Location:
    England
    I`ve been quiet recently about the WSA Beta as there`s been no problems to report ! :thumb:

    I do however have a question today.

    When checking "View/Edit Protected Applications" on the Identity Shield Tab, the entry for Firefox I see (my only browser) is something like this:

    firefox.exe in d:\temp\7zs6315.tmp\core

    My temp files are redirected to d:\temp, but the location and file suggested by WSA that`s being protected doesn`t appear to even exist.

    Is this correct or normal - and the actual Firefox.exe is not mentioned on the protected list ?

    (W7x64 - WSA 8.0.0.66 beta - Firefox 7.01)
     
  2. Geri

    Geri Registered Member

    Joined:
    May 18, 2010
    Posts:
    41
    I've noticed something similar. When trying to add eqgame.exe (EverQuest) to the list, testeqgame.exe is added instead. Even when deleting testeqgame.exe first, and even cleaning it from the recycle bin. It always seems to find testeqgame.exe. Both have the same file size.
     
  3. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    That's normal - it will pick the last filename that was seen during the scan which is a duplicate of the program. If you add notepad.exe and a copy of notepad.exe, you'll also see it "move" between locations.
     
  4. Geri

    Geri Registered Member

    Joined:
    May 18, 2010
    Posts:
    41
    That's what I figured. But how to I add eqgame.exe to the application list, instead of testeqgame.exe? The executables have the same size, but aren't the same. Since EverQuest links to a server, the testeqgame.exe probably uses a different URI to connect.
     
  5. Techfox1976

    Techfox1976 Registered Member

    Joined:
    Jul 22, 2010
    Posts:
    749
    The list is based on MD5. The executables for EQ are identical in content, but have different configuration files that they look at. So having either EXE listed will work just fine. Even though they use different configs, they have identical MD5s, so having the MD5 listed covers both of them.

    The Firefox one is likely a "Portable Firefox" that was run on the system at some point, or an installation.
     
  6. Geri

    Geri Registered Member

    Joined:
    May 18, 2010
    Posts:
    41
    Indeed. They seem to be identical (they generate the same hash).
    Thanks!
     
  7. Fad

    Fad Registered Member

    Joined:
    Feb 25, 2009
    Posts:
    378
    Location:
    England
    Thanks, as long as Firefox is protected, I just didn`t know what it was doing.
     
Thread Status:
Not open for further replies.