CoreForce

sorry CoreForce, I don't like the interface. Don't want to spend a whole week configuring programs access to get my PC back online normally. Adding, almost none of the predefined profiles work well (community issues...), and Skype was not detected at all. Could connect with no permission at all. There was also this host file issue with MSN messenger, and the BSOD related to CoreForce drivers, that's it for now, will wait for Comodo Firewall 3.0, or something else.

CoreForce

First I want to thank Alg for this article. I can only advise new users of CoreForce to read it carefully. I confirm it's better to first deactivate Coreforce on first use, until you're done with some settings. Otherwise you'll get into issues without knowing what did what. And if you're worried about being hacked while you do that, just put windows firewall back on in the meantime. And don't forget to turn it off once CoreForce is active again!(that's a joke again Alg). I intended to reinstall CoreForce today, after my last bad experience with Comodo Firewall. More on it as it comes.

Think I solved the issue between CoreForce and MSN messenger. The error message I got after no being able to sign in with messenger while coreforce was active, was host file related. What I did is remove the entries put in the host file by Spybot S&D. After that I could just sign in again normally with msn messenger, and CoreForce active. That could mean that CoreForce has an entry in the host file that Spybot S&D doesn't like. I have not found which one yet. The list shown in Spybot is huge with no tool to edit or to search. As soon as I've got a host file utility installed, I will investigate.

Now going into new problems: can't have windows update running while CoreForce is on. Just found that interesting link about a user's experience with CoreForce and Cyber Hawk (Online Armor forum).

setting up MSN messenger with CoreForce

I just found that useful link in the CoreForce website.The document though does not seem to give special instructions for establishing special rules for MSN Messenger, but just takes it as an example on how to deal in general with CoreForce whenever you want to create a new profile for an application. Gonna go through the procedure anyway and see how it works. More as it comes. Many other technical documents included there.

BSOD this morning

just had a BSOD with message: PFN list corrupt.The blue screen came as I just rightclicked on the desktop (empty area). Don't know if it's related to CoreForce driver. CF was unloaded as it happened. That's what I got from my event viewer, no minidump was to be found where it should have:

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 1/20/2007
Time: 12:48:56 PM
User: N/A
Computer: xxxxxxx
Description:
Error code 0000004e, parameter1 00000007, parameter2 0008c35c, parameter3 00011337, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 34 0000004
0020: 65 20 20 50 61 72 61 6d e Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 37 2c 20 000007,
0038: 30 30 30 38 63 33 35 63 0008c35c
0040: 2c 20 30 30 30 31 31 33 , 000113
0048: 33 37 2c 20 30 30 30 30 37, 0000
0050: 30 30 30 30 0000


Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 1/20/2007
Time: 12:46:36 PM
User: N/A
Computer: xxxxxxx
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000004e (0x00000007, 0x0008c35c, 0x00011337, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini012007-01.dmp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

also found that link

coreforce issues with msn messenger

that's what I got when I try to launch MSN Messenger with CoreForce activated. Already tried to lower the security level but still get the same results. Might have to edit the host file to seen what's in it that coreforce might have added. See if I can post that in their forum. (if anyone could tell me how I could move these bloody pictures in the post, instead of just being able to resize them, just to get a nicer layout once posted, that would be great!) Could that be that the predefined rules from Coreforce for MSN don't apply, for a reason of file signature, because I'm running MSN Messenger 8.1 beta instead of release 8.0? Sounds it does not work even if I create the rules myself, by not loading the msn profile (predefined profile deleted), and just allowing what's got to be allowed during alerts while creating my own profile for the application (wizard).

CoreForce: part 4 (forum)

the guys at CoreForce run a forum. Here is the link
otherwise as mentioned before, you can always mail the dev team
at support@force.coresecurity.com
(make sure you read the FAQ , user's manual and help file, or post a question in the forum before you do that)
I'll leave it there for now with my posts about CoreForce, Please leave your comments if you have any. Thanks.

p.s. one last thing: Coreforce seems to be able to run unsafe programs (?) in sandboxes, which I suppose means in a secure environment for the PC. Have not tried it yet...

CoreForce : part 3

I have now reinstalled CoreForce, so far so good. Got a few alerts, forgot to take some screenshots (lol). I'll do that next time I've got one. I probably made a mistake when switching one program from it's rule to trusted programs. Well the whole purpose of CoreForce seems to consist in establishing those rules, so getting rid of them just does not make sens. Shame on me one more time (lol).More as it comes...
Had some issues with connecting to gmail via thunderbird, went to the setup wizard from CoreForce UI to reconfigure the ports (for some reason I had not been prompted to do it at installation time..hmm.. because Coreforce kept some tracks from my first install,when I did not want to configure this first).
New issue, cannot get Windows Live Messenger running while CoreForce is activated. I get an error message from MSN telling me that some entries in the host file were modified; been ask if I wanted the wizard to clean these entries, answered yes, but it still doesn't work. I had to deactivate CoreForce to get MSN messenger running again. There's probably something about the profile of Messenger in CoreForce to change that I haven't found yet. Yes as you notice, applications have more than rules in CoreForce, they have a profile integrating much more parameters than the usual firewall rules. More on it as it comes...

CoreForce: part 2

CoreForce definitely runs at kernel level, monitoring registry entries and the file system access by the operating system and applications. So it's definitely a HIPS. It's firewall component also works at kernel level, with a driver interacting between your network card drivers and windows tcp/ip .
I strongly advise to uninstall any other HIPS program that you might have on your system, BEFORE you install and run Coreforce. I think the problems I got yesterday came from conflicts between Coreforce and Spyware Terminator. I will now totally deactivate ST and run CoreForce install again. More on it as it comes...

p.s.: shame on me, I just noticed in the GUI that CoreForce defines itself as a HIPS (lol).

Coreforce

thanks for posting Alg. I won't install cpf again, at least not before version 3.0. I found the link to Coreforce really interesting. The software looks extremely sophisticated, but not that easy to handle. I downloaded it yesterday, and when I rebooted, I started to get quite a few problems. System freezing shortly again and again, but no crash. Just the alerts reacted too slowly to my clicks. I had to uninstall to get my system work normally again, but I will reinstall, after I've read the user's manual carefully. The software seems to be a high-end mixture of a firewall and a HIPS,even if at the moment, I'm not even sure it can be called a HIPS; it reminds me a bit of System Safety Monitor (which I use); the big difference is that Coreforce is also a firewall, and from the type of alerts that I've noticed, a very efficient one. Also Coreforce works with profiles, with one profile dedicated to each application known from Coreforce; these profiles can be updated; I suppose that's why they call it a community software: the updates seem to come from other user's optimized config. Sounds like very, very new stuff.I said yesterday to someone that in compare, cpf looks like a toy for babies. I'm just a bit worried about this windows drivers warning during installation. Hope it doesn't matter.They're just not listed and tested by Microsoft. OK, for those who'd be interested, here is the link again. Just be advised, this program is really not for everyone.See here first for the pdf user's guide.Good luck !

more on this program later in this blog...

p.s.: CoreForce is still a beta. Consider watching the FAQ on their web site; there's also this address for support: support@force.coresecurity.com