Process Protection

[LoneWolf]

Without installing a full blown hips,is there a program out there who's only job is to protect process's?aka security apps.

[bellgamin]

-{ Quote: "Without installing a full blown hips,is there a program out there who's only job is to protect process's?aka security apps." }-Are you referring to protecting security apps against being shut-down by malware? If so System Safety Monitor will do that job. Of course SSM IS a "full blown HIPS" -- however, you can UN-full-blown it by disabling all rules except those for applications.

Concerning which, you might want to read THIS thread (http://www.syssafety.com/forum/viewtopic.php?t=797) on the SSM support forum.

[LoneWolf]

Thanks for the reply Bellgamin. I've thought about SSM but setting up that app scares the hell out of me,seems very confusing.:wacko: I've learned alot over the last few years but this one has me confused on setting it up. But if I start out just using the process protection feature and slowly set it up proper like I should be allright..?? ??? I have used PG in the past which did a good job,just did'nt want to use something that is still not being developed or supported. I wonder how others are(Pro Security,App Defend,Anti Hook and so on) not that that was really what I was looking for but it will do if theres no good dedicated app that just protects one's process's.So if I try SSM is the free version good enough for this or do I need the paid version?

[fcukdat]

Golden oldie:thumb:

http://www.diamondcs.com.au/processguard/index.php?page=download

[LoneWolf]

-{ Quote: "Golden oldie:thumb:

http://www.diamondcs.com.au/processguard/index.php?page=download" }-

I've tried that link for ver. 3.410 but I get an error on install. The version I had was an older one.

[Atomas31]

I would suggest Prosecurity at http://www.proactive-hips.com/

This application looks and feels a lot like Process Guard and it is what replaced PG on my system...

[bellgamin]

-{ Quote: "Thanks for the reply Bellgamin. I've thought about SSM but setting up that app scares the hell out of me,seems very confusing.:wacko: I've learned alot over the last few years but this one has me confused on setting it up. But if I start out just using the process protection feature and slowly set it up proper like I should be allright..?? ???" }-Before installing SSM make every effort to ensure that your computer is clean of any & all malware. Then...

1- Install SSM -- By the way, I recommend you NOT be connected to the internet until you get to step #7 below.
2- Reboot
3- (a) Start SSM. (b) Right-click SSM icon in system tray & be sure it's in Learning mode THEN (c) on that same right-click menu click "Preferences" (which will get you SSM's GUI) THEN (d) click "Process Monitor" tab AND right click any listed process. On the resultant right-click menu select "Trust all running processes" THEN (e) click Options" tab and check following 4 boxes...

Start automatically
Connect user interface at startup
Show icon in system tray
Confirm exit

4- Click "Apply" then exit SSM's GUI.
5- Make sure that SSM is still in learning mode and reboot your PC.
6- Now start-then-exercise-then-close each & every one of the applications that you use most often each day. (a) Be sure & include your browser & email programs (even though you must still remain unconnected). (b) If you use a launcher to open programs, then be sure and use it -- so SSM can make note of parent-child relationships. (c) Don't forget to include Windows goodies such as Task Manager & Explorer & Control Panel.
7- Once you have exercised all your programs THEN reboot, THEN (a) connect to the internet (still in learning mode) THEN (b) update all your security programs that require daily updates, THEN (c) disable Learning mode.

After that, you should get very few SSM pop-ups. To research those few pop-ups, here are the 3 links I use most often...

ProcessLibrary (http://www.processlibrary.com/)
ProcessInfoCentral (http://www.whatsrunning.net/whatsrunning/ProcessInfoCentral.aspx)
StartUpList (http://sysinfo.org/startuplist.php)

[LoneWolf]

Thanks again Bellgamin.Very informative post.I will give SSM a try this weekend when I have time.Now the instructions that you gave are for the paid or free version? Or does it not matter?

[bellgamin]

-{ Quote: "Thanks again Bellgamin.Very informative post.I will give SSM a try this weekend when I have time.Now the instructions that you gave are for the paid or free version? Or does it not matter?" }-Those instructions are based on the paid version. However, I am 99.9% certain that they are fully valid for the free version as well.

[LoneWolf]

Thanks;D :thumb:

[farmerlee]

An easy way would be to use any normal hips and just disable everything except process protection.

[LoneWolf]

-{ Quote: "Those instructions are based on the paid version. However, I am 99.9% certain that they are fully valid for the free version as well." }-

Up and running fine.:thumb:
Thanks again Bellgamin.;D