[webmedic]

as for the file monitor mentioned above. There is already a clamav plugin for pe and with that you could use this:

http://sourceforge.n...lease_id=359753

it does file monitoring and such. with on write access to both the registry and also to the hard drive. And if you have clamav installed it will actively monitor using clamav definition files.

Just a thought. I'm getting ready to try and put this stuff on my cd since all the other virus scanners have very restrictive license policies that make it really illegal to use them in my shop.

I have talked to many others also like lavasoft, webroot, acronis, esafe, etc. So if anybody would like to know their responce let me know.

[lawson23]

Quote

file monitor

Yes Clamav could work for AV type things. I'm more thinking though complete write protection. This would be great for all sorts of things. It would also make users feel 100% safe when booting this project on someones else's PC knowing nothing will be written/modified to the HD without authorization.

I have been trying to look at the forensic sites for a utility but unable to find anything yet.

[SteelTrepid]

Yeah, the forensics stuff is going to be fun. I'm trying to organize my to-do list and prioritize everything. Other issues with the project have more priority, I feel since I have 20 more days until the presentation I have plenty of time to do more work for it. Hopefully there are some easy solutions out there, if not hopefully I can figure out a few things on my own.

[webmedic]

um did you look at winpooch as I suggested. It is primarily exactly what you were asking about. If you have clamav installed it just so happens that it can also use clamav. Check it out I think you find it is more or less what you are looking for. Well if I understand correctly.

[lawson23]

Sorry,
I didn't know you were pointing to a different app because the name winpooch wasn't mentioned in the orginal article. I thought this was a link to clamav.

YEs this looks like it maybe exactly what I'm discussing. I will get more into it real soon because this will be sweet if it works as they are suggesting.

[Joshua]

in next PE-Builder version 3.1.5 bart integrated a firewall / paketfilter.
this version is availiable in german computer magazin ct.
for firewall info see this:
http://samlin2004.my..._on_windows.htm

inf file for firewall:

Quote

; PE Builder v3 plug-in INF file
; created by Bart
; 07/2005 mofifications for CT Magazin by Markus Debus - www.pecd.net - [email protected]

[Version]Signature= "$Windows NT$"

[PEBuilder]
Name="APP: WIPFW Firewall"
Enable=1

[SourceDisksFiles]
files\autorun9wipf.cmd=2,,1
files\wip_fw.sys=4,,1
files\wipfw.exe=2,,1
files\wipfw.cmd=2,,1
files\wipfwoff.cmd=2,,1
files\wipfw.conf=2,,1
files\wipfwoff.conf=2,,1
files\protocol=17,,1  ; directory-id 17 is system32\drivers\etc

; Deps
ipfltdrv.sys=4

[Software.AddReg]
; Add to start menu
0x2,"Sherpya\XPEinit\StartMenu","Netzwerk\Paketfilter wipfw\Einschalten","%SystemRoot%\system32\wipfw.cmd||%SystemRoot%\system32\wipfw.exe"
0x2,"Sherpya\XPEinit\StartMenu","Netzwerk\Paketfilter wipfw\Ausschalten","%SystemRoot%\system32\wipfwoff.cmd||%SystemRoot%\system32\wipfw.exe"
0x2,"Sherpya\XPEinit\StartUp","WIPF Paketfilter","%SystemRoot%\system32\wipfw.cmd||%SystemRoot%\system32\wipfw.exe"

[SetupReg.AddReg]

[SetupReg.AddReg]

; Deps
[SetupReg.AddReg]
0x1,"ControlSet001\Services\IpFilterDriver","DisplayName","IP Filter"
0x1,"ControlSet001\Services\IpFilterDriver","Description","IP Filter"
0x7,"ControlSet001\Services\IpFilterDriver","DependOnGroup",
0x7,"ControlSet001\Services\IpFilterDriver","DependOnService","Tcpip"
0x4,"ControlSet001\Services\IpFilterDriver","ErrorControl",0x1
0x2,"ControlSet001\Services\IpFilterDriver","ImagePath","System32\drivers\ipfltdrv.sys"
0x4,"ControlSet001\Services\IpFilterDriver","Type",0x1
0x4,"ControlSet001\Services\IpFilterDriver","Start",0x3

[Append]
nu2menu.xml, wipfw_nu2menu.xml

Joshua

[SteelTrepid]

3.1.5 I can't wait for an English version, would love to check it out!!!

[webmedic]

webmedic, on Sep 29 2005, 01:21 PM, said:

um did you look at winpooch as I suggested. It is primarily exactly what you were asking about. If you have clamav installed it just so happens that it can also use clamav. Check it out I think you find it is more or less what you are looking for. Well if I understand correctly.

<{POST_SNAPBACK}>

No sorry I really had intentions to put winpooch in there. Oh well I hope it does what you are looking for.

[safger]

I Go the Ghostwall firewall plugin to work, and added the fire*.fir in SYSTEM32, but when startibng the plugin i get the error " unable to load firewall friver " anyone know what is this about and how to rectify it. Regards./SAF

[seriouswrong]

I am intrested in getting Ghostwall to work, I made a real simple plugin, but I am not that adept at plugins yet and anything needing reg entries etc. is beyond me. I too got the driver error you did.

Would you mind posting your code for the ini so we can hopefully get this Ghostwall going.

Thanks!

safger, on Oct 16 2005, 02:43 AM, said:

I Go the Ghostwall firewall plugin to work, and added the fire*.fir in SYSTEM32, but when startibng the plugin i get the error " unable to load firewall friver " anyone know what is this about and how to rectify it. Regards./SAF

[SteelTrepid]

This could possibly be something that we could work on. However, with beta versions of PE Builder including something similar and really the personal feeling that it isn't necessary....it might not happen. If anyone wants to work on this on their own time that would be nice. But like many others have said and I personally feel.....a firewall isn't necessary in a "preinstall" or temporary environment. Hacking and viruses picked up from surfing and placed in the ramdrive shouldn't be able to infect the HDD connected to the system. Unless of course virus authors started targeting PE CD's?? That would be difficult anyways.

[lawson23]

Well I have been using and toying with this for some time and it is working great.

Winpooch as suggested by webmedic.

winpooch plugin

Please have a try and let me know what you think.

Notes:
I have updated the plugin to now include the newest version .5.9

Still only issue:
The CMD window to start Winpooch isn't closing and you get a Starting Winpooch at the bottom of the screen. Doesn't go away until you exit winpooch.

enjoy!

[webmedic]

larson I fixed that and posted the updated version here:

ftp://ftp.ibiblio.or...inux/PE/extras/

[SteelTrepid]

Yeah, that's something I haven't really had the chance to test and play with yet. I do have the plugin downloaded, but really I thought this was more of a "forensics" type of tool. When more beta testing is done for other stuff in the project I will find time to test this more myself. Also from what I understand this really isn't a "firewall" type of application.

[lawson23]

No in my eyes you don't need a firewall in PE. What you need is something to protect the hard drive of the pc you are loading on. A firewall is really not needed because anything that happens to the PE environment is erased once you reboot or shutdown but you still need to protect the harddrive of the machine you are on.

Winpooch does this. Really a firewall is a waste of resources and doesn't protect the harddrive.