[Public Beta] Returnil Virtual System Lite 2011

Hell all,
Thank you to everyone who has sent in feedback for the Labs version. Your commentary and suggestions have allowed us to move the Lite project ahead faster than we anticipated

http://www.returnilvirtualsystem.com/returnil-labs

Change log (this build):

Notes:

1. Client and console can be installed on the same computer (IOW, you can install and control a client on the computer designated as the server)

2. The IP address for the console is set at the client

3. Refresh rate for the Console is ~every 20 seconds. So give the console a half minute to populate its client list on first install and when opened initially

All licensing at the time is Trial so you will not need specific licensing during this testing period. Please send your feedback to us through our technical support address: support (dash) tech (at) returnil (dot) com and thank you in advance trying the new version.

Mike

 

Important note: Uninstall other versions of RVS before installing the new RVS Lite 2011 version.

Thanks
Mike

 

I like this version.

Has the below exploit safesys.exe been sorted ?
https://www.wilderssecurity.com/showthread.php?t=248137

 

Me too. Folder exclusion is working well without any error messages for XP users. Returnil did a wonderful job with this version.

 

Would prefer to see the option to use memory cache before disk cache and have gone back to the old version for that reason.

Maybe create a ramdrive of say around a gig and allocate 800 meg to Returnil's changes cache then move the two cache storage folders to the ramdrive?

Dunno if it's feasible or even work and just thinking out loud.

 

If System Guard is off RVS Lite is vulnerable

If you delete the disk cache (returnil.rvs) Returnil switch to memory cache

+1

 

Can you tell me more please or point to an article?

Will Returnil recreate returnil.rvs after a set amount of memory is used and can the memory amount be controlled or will Returnil do this automatically.

 

Hi Franklin,

As developers notes (in the negative), it is blocked when using the System Guard feature.

The reason there is not a detailed description of what developers describes is because it is not recommended but works due to the fail safe condition in the virtualization driver that will enforce strict memory caching when the disk cache becomes damaged, corrupted, or deleted. As it is a safety feature, it should not be used as a normal operating condition. This does not mean it doesn't work, just that you should think about the meaning behind why it is there and that you would be using the software in an unintended way...

Mike

 

Thank you Coldmoon.

 

New build available

RVS Lite 2011 2.1.5.5119

http://www.returnilvirtualsystem.com/returnil-labs

Change log:

Mike

 

Mike,
Have been trying this version out and find it very stable.
However, a question. When using RVS 2010 with the Anti-Execute turned on it would immediately stop anything running that was not on the actual disk, malicious or not.
Using this Lite 2011 version with the 'replacement' System Guard enabled I was able to install non malicious software without the AE giving a peep.
The manual says "When System Guard is ON, all important modules of your system will be protected". Does this mean that we now have an *intelligent* AE that only jumps into action if what is installing attempts to do something malicious on the system - or do I have a problem, a malfunction?
I did of course have System Protection enabled.

 

The System Guard in Lite 2011 is not the same as the AE feature in 2010 and has a different, but targeted focus to specifically address ISR circumventing malware. If you activate the "Prompt..." option, you will get a better feel for what it is doing.

NOTE: having the System Guard active can interfere with the proper application of Windows/Microsoft updates so be sure to deactivate it prior to installing these updates.

Having that option enabled however will only allow you to make decisions when you get a popup as it will not remember your choices later on (IOW, your decision to allow or deny will not alter the ruleset). It is an option that allows the Administrator some flexibility to temporarily allow something or to troubleshoot a problem on a client system.

Mike

 

Hi coldmoon!
Great work with this new version. Very Nice new features.
Some of this news features will be available in the free version?
THX

 

Hi s23,
First, there will not be a free version of RVS Lite 2011. It is a unique product line with a Public Access/Cafe focus but has scalability that also makes it an excellent solution for small home, SOHO, SMB, and Enterprise network customers.

With this said however, the improvements in the virtualization engine will be integrated into the main 3x line such as folder exclusions and multi-partition virtualization. The exact configurations for the 3x Home Free line are still in flux so you will need to wait for a bit yet to get a list of the free version feature sets for 3x.

Mike

 

GREAT!!! THX. Good to see possibility of multi partition virtualization in the free version too.A bit of topic but is possible make the installer for the free home version give a option to not install the antimalware engine?

 

Hi,
Apologies for the late reply. The short answer is no as this is an integral part of the 3x line and approach to PC security. If the Virus Guard is not wanted, the best advice is to try the RVS Lite 2011 version (topic of this thread).

The multi-partition virtualization will be a premium feature so would not be available in the free 3x line when it is fully integrated.

Mike

 

An update of the 'System Guard' section of the manual for RVS 2011 Lite would be appreciated.

 

We are working on manual updates for both Lite 2011 and the new 3.2 series as well. What specific updates would you like to see added?

Mike

Edit: spelling

 

The section with system guard for the Lite version mentions an anti-executable even though there is not an anti-executable in the Lite version like the main series version (at least not yet). My understanding is the System Guard in the Lite version checks for the creation of new dlls and other things. Could you include in the manual for the Lite version what the system guard stops and what it won't stop? For example, will it stop a keylogger?
Thanks.

 

The AE functionality is internal to the System Guard itself so it does not include settings to change it. A list of what it blocks and may not block would impossible to list but you can get an idea from the fact that it blocks changes to sensitive system files and monitors drivers through a form of firewall.

For example, the System Guard will prevent MS/Windows updates from being installed when active for this very reason.

Mike

 

But could certain types of keyloggers slip through, as he mentioned above? Does it automatically let you know if anything is trying to install......regardless.....no matter what it is? There are some companies that white list commercial keyloggers, stating that they do so because they have legitimate uses. But of course that does not mean that they do not also have some illegitimate uses as well.....which they obviously do. So maybe the option to block anything other than what is already installed would be a good idea.

 

The System Guard in RVS Lite 2011 will not warn, alert, or otherwise inform the user that something is blocked - it just is. For those situations where you need a little flexibility and there isn't a targeted rule to address it (though it will be blocked), you can use the "prompt..." option where you can allow something. This allowance however is only until the next restart and the System Guard will not remember your choice.

Mike

 

I experienced an issue with RVS Lite 2011, already reported here: https://www.wilderssecurity.com/showpost.php?p=1713368&postcount=16

 

Mike,
I have had RVS Lite 2011 installed for less than 2 days and find I now have a C:\Returnil folder with Returnil.RVP and Returnil.RVS files in it and the total size of these two files is 7.3GB. It has just taken nearly twice as long as usual to do a back up. What exactly are these two files and why are they so large. Will they get any bigger than this.

 

RVP = Virtual Disk
RVS = Disk cache

The size of the VD is exactly what you set it to be when you installed Lite 2011. You can move it to storage and then move it back when making backups, just make sure you close the RVS Lite 2011 GUI before you move it.

For the disk cache, you can try resetting the disk cache to 0 with the virtualization off by using the repair feature in the uninstaller. This will force the virtualization into fail-safe (strict memory caching) when the image is restored. After restoring to the image, use the uninstaller repair to recreate the cache.

Mike