GeSWall Blocks Trojan.KillDisk

05/25/06 Posted by geswall

Link: http://wilderssecurity.com/showpost.php?p=755854&postcount=23

Trojun.KillDisk is a dangerous trojan that damages badly the disk content. GeSWall’s access control policy stops it by denying low-level write an access to the disk.

GeSWall access control log entries:
Test.exe REDIRECT access to \Device\Harddisk0\DR0 (File)

Note: Trojan.KillDisk poses no threat when run on behalf of non-administrative user account

Posted in GeSWall's Security Tests