[Dshield] Re: wormguard

[Russ Washington]

Doesn't sound any different from your standard bit of AV software that
provides real-time protection-- sticks itself in the middle of all file I/O.

But I am a bit lost as to what this thread is/was about... :?

----- Original Message -----
From: "Ellen Clary" <ellen at dgi.com>
To: <list at dshield.org>
Sent: Monday, January 20, 2003 2:55 PM
Subject: [Dshield] Re: wormguard




> http://wormguard.diamondcs.com.au/howdoes.htm
>
> "...When WormGuard is installed and you try to execute a file, the
> operating system will ask WormGuard if the file is ok to run. For the
> file to run, WormGuard must answer with "yes". There is no time limit
> for WormGuard to do this - the operating system will simply wait until
> WormGuard has responded with yes or no. This type of low-level hooking
> means that when a file is executed, WormGuard has the power to block
> the execution if the file is deemed hostile.

Not that this is an OS design list, but...
I know nothing of Wormguard, but this type of "low-level hooking" sounds
like an
excellent way to make all other processes starve.  Sort of a local DOS in a
way.
   I thought Windows was trying to get away from a process being able to
take
over the whole system.

Ellen Clary
Senior System Administrator
Dynamic Graphics

_______________________________________________
Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list