GentleSecurity

[Andrew]

Process creation is not restricted because it doesn't make sense with GeSWall. Just start an IE as isolated and any spawned process will be inherently isolated as well. So even if somebody starts a malware through IE tricks it will not make damage. Whenever an isolated IE creates a file GeSWall tracks it down. Next time you try to run that file, GeSWall will pop up a dialog saying that file source is untrusted and suggesting isolate it as well. When "Orange security level" is used, isolation comes automatically without pop-ups http://www.gentlesecurity.com/docs/seclevels.html If file is a DLL, that DLL will be prevented to be loaded into trusted process. If file is a driver it will be blocked to load into kernel, if file is vbs "Windows Script Host" gets isolated while translating the script, etc..