Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 699905">Seems to monitor process creation and I assume that is it, and it uses this one thing for a variety of things. If you look at all the log reports so far, all of them share similarities because its related to process creation log reports being created when the start-up is blocked. The command line details are comprehended by the product and this is used to determine block/allow from the configuration. Since it uses kernel-mode for process monitoring, it&#039;ll be using PsSetCreateProcessNotifyRoutineEx 99% certain of that; VoodooShield uses this too but they won&#039;t conflict because you can use multiple callbacks among products at the same time, it was designed with compatibility in mind by MicrosoftIt can be quite effective depending on situation, doesn&#039;t appear to be intrusive but very easily worked UI which is nice. But I don&#039;t see it as a behaviour blocker like from actual vendors like Emsisoft, I don&#039;t even know why people are comparing such. Because this product doesn&#039;t work like the others, it isn&#039;t a full blown BB. BBs like Emsisoft will inject and monitor and use a wide variety of callbacks from kernelmode, this app relies on process monitoring for now it would seem to block actions.so this is more of a HIPS, it doesnt know real bad to good. It just monitors for X and blocks, which is what HIPS does. except other HIPS will have so much more, but this is for monitoring built in OS stuff like bcdedit.exe, wscript.exe, etc.The app is really goodmaybe the dev will explain exactly how it works for you guys but i dont think it should be compared to Emsisoft BB, Dr.Web Katana, or anything alike. because this app has a different purpose. it doesnt care for code injection attacks but it cares for what wscript.exe does and bcdedit.exe command line on spawn, etc</blockquote>

[QUOTE="Deleted member 65228, post: 699905"] Seems to monitor process creation and I assume that is it, and it uses this one thing for a variety of things. If you look at all the log reports so far, all of them share similarities because its related to process creation log reports being created when the start-up is blocked. The command line details are comprehended by the product and this is used to determine block/allow from the configuration. Since it uses kernel-mode for process monitoring, it'll be using PsSetCreateProcessNotifyRoutineEx 99% certain of that; VoodooShield uses this too but they won't conflict because you can use multiple callbacks among products at the same time, it was designed with compatibility in mind by Microsoft It can be quite effective depending on situation, doesn't appear to be intrusive but very easily worked UI which is nice. But I don't see it as a behaviour blocker like from actual vendors like Emsisoft, I don't even know why people are comparing such. Because this product doesn't work like the others, it isn't a full blown BB. BBs like Emsisoft will inject and monitor and use a wide variety of callbacks from kernelmode, this app relies on process monitoring for now it would seem to block actions. so this is more of a HIPS, it doesnt know real bad to good. It just monitors for X and blocks, which is what HIPS does. except other HIPS will have so much more, but this is for monitoring built in OS stuff like bcdedit.exe, wscript.exe, etc. The app is really good maybe the dev will explain exactly how it works for you guys but i dont think it should be compared to Emsisoft BB, Dr.Web Katana, or anything alike. because this app has a different purpose. it doesnt care for code injection attacks but it cares for what wscript.exe does and bcdedit.exe command line on spawn, etc [/QUOTE]

Verification