Yes, i saw that article (was posted on rM too). Without the info on
how it should be done the post looks like a rant against all HIPS products. The author seems to disprove the fact that they need to inject their own custom monitoring DLL into all running processes which potentially may affect overall system performance and stability. Nevertheless, he also created a tool that can bypass TF's protection and disable TF completely. So all that hooking, aside from affecting system performance, seems to be inefficient in the case of ThreatFire.
He also mentions that the insability of TF determined him to start this experiment.
I used TF some time ago and in my own experience it was a bit buggy. After a long time they've released a new version (4.7.0.48) but when I installed it it proved to be incompatible with sandboxie. I reported this to sandboxie and tzuk said that it will be fixed in 3.53.01. Currently the 3.53 version of sandboxie is in beta. At that time I wasn't able to register on TF-s forum to report this problem (the registration email never got to me)
Note that a tool created especially to kill a security app has nothing to do with real malware.
On the same forum they posted a
tool that can bypass PrevX self protection.
