Q: Is there anyway to restrict process
A: Process creation is not restricted because it doesn't make sense with GeSWall. Just start an IE as isolated and any spawned process will be inherently isolated as well. So even if somebody starts a malware through IE tricks it will not make damage. Whenever an isolated IE creates a file GeSWall tracks it down. Next time you try to run that file, GeSWall will pop up a dialog saying that file source is untrusted and suggesting isolate it as well. When "Orange security level" is used, isolation comes automatically without pop-ups http://www.gentlesecurity.com/docs/seclevels.html If file is a DLL, that DLL will be prevented to be loaded into trusted process. If file is a driver it will be blocked to load into kernel, if file is vbs "Windows Script Host" gets isolated while translating the script, etc..
Q: Is there a way to restrict network traffic coming
from a program, such as denying network access altogether?
A: No, that is job for Personal Firewall. That is principal, instead of blocking network traffic GeSWall isolates an application itself. In order to prevent leaks, GeSWall additionally blocks an access to confidential files. Though there are products which restrict files/processes creation and network traffic, GeSWall works in opposite direction. You may run what ever you want, but it will be isolated. That makes GeSWall is less intrusive and doesn't introduce a hole.
Q: When a log entry reads \"Deny C115 message
to...\" what does that mean? What is a C115 message? Are there other Deny
codes I might see?
A: "DENY C115 message to" means that windows message directed to specified process was blocked. C115 is a hex number of message code. Messages are blocked in order to prevent Shatter attacks
(http://security.tombom.co.uk/shatter.html). You may see log entries with different messages codes from 0 up to 0xffff.
Q: Why do we need to block some messages? Is it dangerous?
A: Usually windows applications and core components send plenty of various messages. GeSWall blocks only
potentially harmful messages from an isolated application. Those messages are optional and blocking them
doesn't affect normal application functionality. Please note, the log in GeSWall Console particularly useful for debugging application problems while authoring specific rules for new applications. If you are interested in more technical details on how harmful messages could be, and how GeSWall blocks them, you can check the demo we provide http://www.gentlesecurity.com/demo.html . It works as VBS script which simulates various intrusions. So you may study the script code and change it for your tests.