PrevX 2

[Hyperion]

Anyone uses it?I downloaded it today and i was a bit disappointed by the resource usage.Otherwise i m sure it's very nice,although i don't like this need to update.I used to have the beta 1 version for a while,but this one uses min 3-5% of my CPU with peaks of 13% (Athlon 2500+) which for me are unacceptable for a second layer of defence programme.The protection options are wonderful,but it became a resource hog.

Anyone else had better luck with version 2?

[richrf]

HI Hyperion,

I just installed Prevx 2.0. I think it is extremely well done. I'm waiting to see how stable it is on my system. So far, so good. The prior version caused to many crashes. Process Guard, in contrast, has run withour causing any problems except that I always get explorer.exe errors when I close down the system. I am pretty sure it is somehow related to PG, since I have not had this problem together. Other than this, both programs are cooperating with each other nicely right now.

As far as CPU is concerned, I am running a scan of my system right now and Prevx is the least of my worries. In order of resource usage:

KAV 4.5 (by far the)
Giant AS (also quite substantial)
Ewido (about the same as BOClean)
BOClean
Prevx (a bit more than PG - at about 2 -5%
ProcessGuard

I am not going to keep all these safeguards running long term, but I am running them side-by-side to see which programs provide the best protection over a protracted period. If they behave well, and they do not impact my browsing, then I will keep them all since each has its individual strengths.

Rich

[the mul]

I was just wondering if u can supply a link to prevx 2 for me.

Many thanks

THE MUL ;)

[puff-m-d]

-{ Quote: "I was just wondering if u can supply a link to prevx 2 for me.

Many thanks

THE MUL ;)" }-It is posted in the updates forum ;) ...

[the mul]

Thanks for the help, sorry but I never looked in the updates today.

Your friend

;D THE MUL ;D

[Weber]

doh, i keep getting "Internal Error 2738" when i try to install the new version.
i already uninstalled the old version before, but it's not installing

edit: does any one know if it needs some windows services to run? because i use nlite to customize my windows

[flyrfan111]

I think something is wrong here. They are giving this away? It sounds like the solution that everyone has been looking for, for a long time, almost the perfect security solution. Yet they are giving it away to home users, to ISP's and to Enterprise businesses in 25 users blocks(22 clients and 3 servers). It sounds to good to be true. It must connect to THEIR server to identify attacks and see how to handle them, aloowing you to see what other users did with the same program. To me this sounds like a trojan, maybe someone with much greater knowledge than I sould take a look with a packet sniffer or something and see just what Prevx sends back HOME. For now I think I will stay with version 1. Maybe I am just being paranoid but this just sounds to good to be true and my mother taught me that when something sounds to good be true and it's free, there is usually something not up to snuff. Just my two cents.

[puff-m-d]

chew,

I split off the posts dealing with your possible update problems to HERE (http://www.wilderssecurity.com/showthread.php?t=53650). We basically had taken over this thread 8) .....

[chew]

Thanks Puff-m-d

I didn't want to start a new thread just now thinking that I might as well stay with the same thread.

New thread is better now.

:)

[Meltdown]

I’m far from convinced about this upgrade. Firstly, what does Prevx2 offer that Prevx1 doesn’t? They’ve ‘extended’ the buffer overflow protection, and introduced protection from ‘Uncontrolled Program Execution’ – you get the same from the free version of PG3 – and ‘Process Hijacking’. No idea what that is, and I’m not about to install Prevx2 to find out. Like flyrfan111, I think there is something wrong here.

On the Prevx website there’s a report, available here (http://www1.prevx.com/PrevxHomeAudit.pdf) in PDF format, which among other things details what Prevx sends home. It points out that Prevx does not store any information that can identify individual users; each individual Prevx installation can be identified for regular monitoring, but no data that would identify the user is retained. However: -{ Quote: "Prevx Home does gather information about the user’s system, and this is reported to the Prevx data centre… The information gathered includes the operating system name, revision, and a list of the currently executing processes. The process list is used to identify other protection software running, in particular which antivirus software and personal firewall software is installed." }-
There’s some irony in the fact that something that presents itself as ‘intrusion prevention’ software is so intrusive… and then there’s the question of what Prevx does with that data. Their website says: -{ Quote: "Prevx Home anonymously and automatically transmits threat data each time an attack is made on your PC. This threat data is used to drive the new “ask the audience” feature that helps users make the decision to accept or deny each security event alert." }-
Which sounds reasonable. But that is followed by the vaguely worded information that -{ Quote: "Prevx plans to market a range of services providing information on Internet Threats to corporate customers, ISPs, security vendors, rating organizations and other interested parties." }-
Does that information include your ‘currently executing processes’? Who are these corporate customers and ‘other interested parties’? And how happy do you feel about contributing to commercial market research services?

[nadirah]

Yeah meltdown, I sure do want to know what those guys at Prevx want to do with the information that they collect.

[Hyperion]

Thanks to everyone for the reply.I too don't like the fact that wants to dial home.Added to the fact that it's heavier than my antivirus and firewall put together for the CPU, made me drop it.

About Process Guard,unfortunately,it seems that even version 3 causes trouble to my PC.

I m back to WinPatrol,which is much less than the previous too,but works smoothly and with minimum resources.If i get paranoid i ll put back Abtrusion Protector i guess...

[flyrfan111]

Thought of something else that bothers me about this; Why did they make a NEW site just for this upgrade? They redirect you to a new site. Wouldn't it be easier to just update the old one? It seems maybe the intrusion prevention company wants to get into the marketing/advertising sector as well. Is it only the three of us that think this is strange? Anybody with more technical knowledge take a look at any packets? Anybody with some hacking skills try to test this out and see just how preventative this intrusion software is?

[pIMp]

Here we go, wouldnt call myself someone with hacking skills, but I know
how to turn on Etherial and to spy on the HTTP traffic of prevx :)

Ok so far, they changed from encrypted HTTPS to HTTP in version 2, otherwise I wouldnt be able to spy easily on their traffic.
It is not sending any binary data - its all readable text and numbers in those HTTP traffic.
I recognized a couple of process names in the traffic, currently running on
my system as well some data which I saw in the Event Details of some alerts.

It seems they are connecting several times their webserver in order to report
collected alerts. Such an option already existed in version 1 as "Send To Prevx". This option is now gone and seems to be automatically active.

I cannot tell more at the moment, but given the fact they are not even
encrypting the traffic and given the stuff I've seen, it seem's not to contain
any personal information. Ive got it installed on a clean machine as well on my working machine - the data on both machine are identically. I would have suspected it sends more stuff from my working machine - but it doesnt.

On their page they are stating they are using the event data to help the user
when pressing "Get Advice" on an alert popup. They would show some statistics obout how many users denied it and how many allowed it, makes sense, however, atm there is not much to see when ya press the button, but then also on the other hand, they released it yesterday.

needs further checking...
maybe someone else wants to join in to check out what they are sending?
4 eyes see more then 2 :)

[Unity]

The main problem for me with this version is like Hyperion , the ressource usage.

Prevx 1.0 : 0 CPU%
Prevx 2.0 : 2-5 % CPU

I've installed the 1.0 version again.

[nadirah]

I'm sure some of you here may remember Aluria's partnership with WhenU.
If prevx gets from anti-spyware to spyware, just block 'em.

[nadirah]

Prevx said:
Prevx plans to market a range of services providing information on Internet Threats to corporate customers, ISPs, security vendors, rating organizations and other interested parties.

Indeed, who are those corporate customers , rating organisations and other interested parties?

Corporate customers could be other companies, who knows, what if they secretly send the information to a spyware company?
Then, rating organisations!? What the heck are these rating organisations anyway?
And other interested parties, could they be spammers, marketers or advertisers?

On the internet, you can never trust people completely.

[Notok]

You can read the audit report in full by downloading this PDF
http://www1.prevx.com/PrevxHomeAudit.pdf

[Hyperion]

In that pdf, art 6. practically says that it could be used as Trojan ,but this isn't possible to verify because the source code should be analyzed in order to see this.ALso says that this is theoretical possibility that exists with many other software like antivirus programmes,so basically,it's a matter of trust.

Well,at least as far as i know ,my antivirus doesn't try to upload any info about my system ,it just tries to download signatures.

I think i can live without PrevX. :)

Nadirah's comments are also correct.The whole situation is a bit too vague for my tastes.The fact alone that in version 2 you have no control on when you send the report is preoccupying.

Also somewhere yesterday i read that they "purged" their database with the info about the users of version 1 and beta testers.Today i can't finda where i read this but i m positive.In fact while for version 1 they were requiring registration,for ver 2 you just click and download. All these things seem weird.

[ronjor]

Here's a thread.

http://www.wilderssecurity.com/showthread.php?t=53581

[Infinity]

I liked the first part too but this new one is uninstalled. I can live without prevx too...and all those things about their eula isn't giving me headaches in the beginning but now when I think of it...well like I said, uninstalled it.

I am glad I am part of this forum: the times I have changed my mind here is ... lets say: a lot...lol... in this I must admit I was a bit naive , I still believe it is a good prod. but their policy is like you all said a bit vage and can be interpreted in many ways and that opens the door for other things...

thanx for pointing this out.

have a nice day you all!!

Opt.

[BrainWarp]

Damn--i hate to see that prevx has taken this route.I really like prevx 1 running on my computer ,but it's a little wierd how 2 version needs to call out to net.I think i'll stay with the first version.It serves me well for now.

I had high hopes for this company,but in the end money always corrupts

[QuoiQuel]

pIMp: "needs further checking...
maybe someone else wants to join in to check out what they are sending?"

Well, I did some checking on what they were sending. I liked PrevX Home, but the latest update got me a bit worried. And not only the bit about Ask the audience or Get advice. I use Sygate Personal Firewall and checked if PrevX was accessing the internet without there being an Event, as they call it. And PrevX did. My Event History list is empty but every 5 minutes or so the programma accesses wip6.prevx.com [IP 213.52.140.88]. Backtracing and Whois brought me to companies called Globix [http://www.globix.com] and Probet Technology Ltd. I enabled Packet Logging (which captures every packet of data that leaves - or enters - a port) in Sygate and checked what exactly PrevX Agent was sending: Packet Dump 463 bytes, the Packet Decode window showed a detailed inventory of (active) applications and executables on my computer. Now why is this, I wonder?

I denied PrevX Agent access to the internet and asked PrevX, per e-mail, to explain the reason for letting PrevX access "the boss" at frequent and regular intervals. No reply yet.

[pIMp]

Yeah, I reliazed that too.
Prevx seems to run periodically in the background checking for new alerts to be reported, whatever.
They state something like that on their website.
It also does that IP lookup, however, it does it only once on my machine !?

Like in my post, I saw also a few process names going out and wild numbers.
Anything else you spotted?

[QuoiQuel]

Nothing much. I just let it have its way and access the internet, but nothing spectacular this time. No inventory of process names, just a garbled e-mailaddress, the IP-address of my modem and a set cookie (which I can't find anywhere). As long as I deny access, it keeps trying to access the internet (about every 5 minutes or so), but now that I've let it, it keeps quiet. I told Sygate to ask me whether I want to let PXagent access. We'll see what happens next.

[pIMp]

I run 2.0 since the first day launch 2 weeks ago or so and Im
almost constantly watching the traffic.

As you say, nothing spectacular - events and few process names from
time to time.
I guess they use the process names to minimize/check for
side/cross-effects with other security products !?
Coz not long time ago they issued a security settings called "spysweeper awareness". I guess they figured out that Prevx Home and spysweeper
caused problems.

Keep us posted please in case ya find something ugly.

[QuoiQuel]

Just witnessed another access. Nothing much, just an incomplete e-mailaddress and gibberish (to me, anyway). I altered the SpySweeper Awareness thing in Security Settings, just to see what happened (I don't use Spysweeper). Security level went dwn to 97% but no messages to home base, or sth. like that. Will keep you posted.