ProSecurity v1.20 released

[PSDeveloper]

Website:http://www.proactive-hips.com/
Screenshots: http://www.proactive-hips.com/screenshot.php
Download:http://www.proactive-hips.com/download.php

October 12, v1.20
1. [New] Protect process from terminating as part of a job.
2. [New] Protection disk from low level disk accessing.
3. [New] Restrict process from debuging at system level.
4. [New] Provide "Verify Checksum" option for application rule.
5. [Fix] The activation state of application's registry/hook rules wouldn't been set when importing rules.
6. [Fix] ProSecurity wouldn't delete application rule's registry/hook rules when this application is deleted.
7. [Fix] ProSecurity didn't check whether a rule existing already while adding a new hook rule of an application.
8. [Fix] ProSecurity can't been uninstall in normal mode of Windows after the trial-time expired.
9. [Fix] Prosecurity shows warning box with wrong process information in a very few cases.
10. [Improve] Remember all columns' size of lists in Advanced Settings page.
11. [Improve] Support on Windows 2003 and 2003 SP1.

Any feedback will be appreciated!

[TECHWG]

Oh sweet . .
whats this low disk level access >? what is that used for?

My guess would be the ability to lock files from other process using them ?

Thanks

WG

[PSDeveloper]

"Low level disk access" is used to protect disk from writing by malware, some malwares use this function to destory datas of disk.

[bellgamin]

I couldn't get the website's screenshot of the Application Rules to work. It just showed the very top of the screenshot.

[PSDeveloper]

Thanks bellgamin, this has been fixed.

[bellgamin]

Yes, it's fixed! Mahalo nui loa.

The more I see of PS, the better it looks to me. Would it be possible to post its Help file online, or else provide a downloadable pdf copy?

Also, has PS been tested for possible conflicts with other security programs that use *hooks* -- such as System Security Monitor, Process Guard, WindowsDefender, etc? If so, can you tell us which apps should be deactivated before testing your program?

[PSDeveloper]

bellgamin:
its online help url: http://www.proactive-hips.com/manualbook

ProSecurity can work with SSM, PG and other security softwares, but if it runs with SSM, there will be a very small compatible problem, this problem cause ProSecurity's screenshot and password protection function lose effectiveness.

If you have found any bug or compatible problem, please tell us, thanks for your testing!

[Kenjin]

-{ Quote: "The more I see of PS, the better it looks to me." }-
I fully agree. While the 1.0 version had some issues, PS in my opinion has now matured into a very good, stable and feature-rich product. I think it could still use some improvement or clean up in the GUI area, but functionality wise it is on par with the best HIPS software around - and even better in some areas.

The new version e.g. comes with dll/library load control, a feature that I have not seen in any other HIPS so far (except for the almighty Tiny Firewall). New unique features combined with support of all the well known "standard" HIPS features like process termination/modification protection, driver/service load control and so on, make PS IMHO far better than e.g. AppDefend/RegDefend or ProcessGuard which look more and more obsolete to me.


I am unsure why PS has not attracted more attention up to now, however I can only encourage everyone who is interested in such type of HIPS to give it try. In my experience the author is also open for any constructive feedback and implemented many of my proposed enhancements or new features very quickly.


-{ Quote: "Also, has PS been tested for possible conflicts with other security programs that use *hooks* -- such as System Security Monitor, Process Guard, WindowsDefender, etc?" }-
I have run the 1.20 betas for a few weeks now together with the latest SSM betas on the same machine and I had not a single problem with it, apart from what the author already stated above. According to my experience, PS basically plays nicely with other system software and for the moment I can live with losing the 2 minor functions in PG when SSM is installed. But probably in the long term one would decide between these two anyway, i.e. which one to keep, as they are overlapping a lot feature wise.

[bellgamin]

Excellent manual! Now... why couldn't I find it on my own?:wacko:

Reference the manual as to Registry Rule Group where it states:-{ Quote: "Note: Be cautious in removing rule groups - when a rule group is removed, all the rules within this group will be removed at the same time, and can't be recovered." }-For those of us who are fumble-fingered, or who like to try stuff before we RTFM, may I suggest a "Restore Default" button?

Also,is PS's registry rule default list consistent with hojtsy's list (http://www.wilderssecurity.com/showpost.php?p=179721&postcount=1)?

[PSDeveloper]

Thank you for your suggestion, the "Restore Default" function is a good idea, I will add this in the next version.

Actually it's my first time saw the "hojtsy's list", anyhow I will check this list and add rules that don't exist in ProSecurity's protection list. Thanks!