Failure of Defence+ against shut down protection

Learn about Computer Security Leak Testing/Attacks/Vulnerability Research
1

restart system.exe
force.exe

These two application if allowed to execute can shut down system inspite of denying shutdown privilages/ all other actions by these appliocations.
These has been discussed here in the past and Defence+ was supposed to intercept them but on my system both latest and previous versions failed.

Also i don,t like the way shut down protection is implemented in Defence+. Infact all these Privilage options are annoying and very boring. I get popups for so many applications about trying to get this and that privilage and I am really going to hate these type of pop ups. Seems so irritating. Why Defence+ not giving pop up laert like all other HIPS only when an application tries to do actual shut down of the system. I wish that developers change this behavior.

http://rapidshare.com/files/90767913/restart_system.exe.html
http://rapidshare.com/files/90768029/force.exe.html

2

Hello can any one from Comdo throw some light on this issure?

Thanks

3

Hi Aigle,

Defense+ does not intercept system shutdown requests. We may introduce this feature in the future though. Privilege elevation may sometimes provide protection but it is still possible to shutdown the system witout those necessary privileges.

4

Hi, thanks for the explanation. I thought it was already implemented in Defence+.

5

:o :o :o :o

6

Few privilege elevation prompts can be removed.
Other ones can be added (look for pseudo com objects).
Privilege elevation prompts are just another way to harden a system without creating different usergroups.
IMHO they are useful.

I guess it would be better to keep them and add additional features.

7

I agree, pal, especially since both Online Armor Free and Outpost Pro kill the processes mentioned in the original post dead in their tracks!!

8

Do they terminate those POCs without any alert or do they ask the user if he want to terminate them?