Advice Request VoodooShield and parent process

[TheMalwareMaster]

Good evening, can you think of any programs of which the "allow by parent process" feature, enabled in VoodooShield free, can cause a user to be able to run malware without VoodooShield monitoring it? (similar to the one we found about WinRAR)

 

[Wave]

Well it'll literally apply to any program that spawns a child process which is already trusted/allowed. Even a malware sample -> you allow it -> now it spawns more processes as child without alert.

 

[erreale]

To be honest, I do not understand the meaning of this option. I would not put it as a possibility if I were the developer

 

[TheMalwareMaster]

Well it'll literally apply to any program that spawns a child process which is already trusted/allowed. Even a malware sample -> you allow it -> now it spawns more processes as child without alert.

Can you think of some commonly used programs?

 

[ozone]

To be honest, I do not understand the meaning of this option. I would not put it as a possibility if I were the developer

when updating or installing programs, installer will usually spawn child processes so it can cause annoyance or program will not work correctly

 

[Davidov]

To be honest, I do not understand the meaning of this option. I would not put it as a possibility if I were the developer

Exactly .-) probably fight a lot of warnings.

 

[Winter Soldier]

Interesting, for what I remember of my (old) studies
Usually both processes share the same code but they run in competition with each other, with the rest of the job processed on the system in question. Normally parent and child are running different instructions.
The child process open files from parent process. These can constitute a means of interaction between the 2 processes.
Otherwise the data (program variables), the stack and the environment of the parent process are duplicated for the new process and put into an area of memory reserved to it and not visible to other processes, parent inclusive.
Normally, the parent process executes the instructions of the program to meet the call to fork() and at this point, the parent process spawns a new process.

By this time the 2 processes have independent life, and the result returned from the fork() is different for each process and it is normal that the 2 processes run different paths within the same program.

 

[TheMalwareMaster]

Do email clients, such as Microsoft outlook and mozilla thunderbird create child processes to open email attachments?

 

[Deleted member 178]

To be honest, I do not understand the meaning of this option. I would not put it as a possibility if I were the developer

really? what about FUD malware wrapped in legit apps?

 

[erreale]

really? what about FUD malware wrapped in legit apps?

Perhaps I explained bad. I would set permanently disabled "allow by parent process"

 

[Deleted member 178]

Perhaps I explained bad. I would set permanently disabled "allow by parent process"

i would to o, but it was a choice made by the Developer to reduce prompts for average users; which is the goal of his product: be simple.

 

[Av Gurus]

Replay from developer - VoodooShield ?

 

[TheMalwareMaster]

Replay from developer - VoodooShield ?

@Av Gurus thanks a lot for the share! Thanks a lot also to Voodooshield for the interest! Hope you will read this post, I can't reply there

 

[TheMalwareMaster]

I wanted to address a question from this post

What was the question?

 

[Av Gurus]

question?
Is your first post (this thread)...didn't you ask about "allow by parent process" feature?

 

[Wave]

Also, if a developer is going to not sign their work, utilize hacker tools, obfuscate and encrypt the heck out of their binaries, etc... then their software does not deserve to run on your system.

Absolute nonsense. If only he didn't add that into his post I would have Liked it if Wilders Security had such functionality.

 

[TheMalwareMaster]

question?
Is your first post (this thread)...didn't you ask about "allow by parent process" feature?

I probably misunderstood the meaning. I thought he wanted to ask me a question. EDIT: yes, now I understood the real "address" word meaning