Add "Physical Drives" group to HIPS Protected Files[M2326]

[umesh]

Can an unknown app do it? Answer is no.

And if you monitor each and every activity of all system level processes via HIPS in Paranoid mode, it will be nightmare of alerts.

@futuretech post:20

But you can by using the CreateService function and setting the lpServiceStartName parameter to NULL which tells createservice to use the local system account. Which is what happened with flexnet being installed as a windows service to run in the context of the SYSTEM account. HIPS should be as strong if not more effective as the sandbox, so HIPS should monitor all actions of a process regardless of what account it is running under as.

[qmarius]

@umesh post:21

Can an unknown app do it? Answer is no.

And if you monitor each and every activity of all system level processes via HIPS in Paranoid mode, it will be nightmare of alerts.

doesn’t sound that bad. any other explanation? was it tested? does it break apps? oh well.