GentleSecurity

[Andrew]

GeSWall isolates applications that may serve as entry points for malicious software or intrusions. Viruses, trojans, spyware, keyloggers and exploits cannot pass through an isolated application and so cannot cause damage. By default only applications in its application database are isolated. So to see GeSWall's prevention mechanism you have to try run malware from an isolated application or download it by an isolated application, so GeSWall tracks that has untrusted source. If you start a malware from CD it will be nor tracked in default mode.
GeSWall tracks an untrusted application data-flow: files, registry, etc. For example, GeSWall doesn't prevent a new file to be created by a browser, but it will isolate (restrict) an application that uses that file. Such approach allows GeSWall policy to work in real-life environment non-intrusively.