Winpooch - Free & OpenSource Firewall Guide

[DigeratiPrime]

Nice! BTW I went and updated the guide to be sure it still applies.

Winpooch 0.6.2 beta

-------------------

* Date : 03/11/2006

* From version 0.6.1

* Added reason Sys::KillProcess.

* Added compatibility with many kernel version (36 new builds)

* Added support of Windows Vista 32bits.

(Not fully supported: for now Winpooch doesn't catch process creation).

* Restored a feature for branch 0.5: can now hook and unhook processes.

* Now save configuration in registry each time a setting is changed.

* Fixed BSOD due to ExFreePool(NULL).

* Fixed BSOD occuring when running out of memory.

* Fixed memory leak in Winpooch.sys.

* Fixed wrong error codes returned by hooks on NtQueryValueKey and NtSetValueKey.

* Bug fix: scanning pattern weren't updated correctly.

* Bug fix: now closes app-link if an IRP is cancel.

This should fix system freeze at shutdown.

* Bug fix: uninstaller now removes freshclam.log

Next evolutions

---------------

What you may expect for next versions :

- 64-bit support.

- Improvement of filters :

- Regular expression support

- Value list (useful for network ports)

- Value range (also useful for network ports)

- A service process (planned for branch 0.7)

[GeneralMandible]

FYI

0.6.3 was released today.

[Slimy]

FYI

0.6.3 was released today.

It sure was: http://www.msfn.org/comments.php?shownews=19057

Great guide, thanks for putting in the time!

[DigeratiPrime]

havent tried it yet

http://sourceforge.net/project/showfiles.php?group_id=122629

Winpooch 0.6.4

--------------

* Date : 07/01/2007

* From version 0.6.3

* Added compatibility with many kernel version (24 new builds)

* Bug fix: WatchObjs_Lock() used to always return STATUS_SUCCESS.

This should fix bug 1622709.

* Added a filter to allow csrss.exe to kill processes.

Added a filter to ask user before writing a .sys in system32.

You have to reset filter to add them.

[Jeremy]

http://www.matousec.com/projects/windows-p...sts-results.php

Thanks, Tarun.

Edited January 18, 2007 by Jeremy

[glentium]

Castlecops HIPS review

current version is 0.6.6: Very light in terms of resource usage and stable too.

I use it in combo with SSM (System Safety Monitor) Free Edition and you're pretty much covered.

@DigeratiPrime: Were you able to run WinPooch as a SERVICE successfully?

[weEvil]

Winpooch works with XP SP3? I've been having issues. Says this version of windows is not supported.

XP Pro SP3 v3264