Anything similar to Faronics Anti-Executables?

Hi,
just canvassing opinions about Anti-Exec.. is there anything better than AE.

AE works fine but whenever i have installed a new program - I need to update the white list & it takes hours if my hard-disk is large. It takes hours to re-scan the HD for exes. Then multiple by the number of PCs i have to update.

Is there anything better than anti-Exec?

Thanks

 

erlee,

The initial whitelist scan can take hours on a large and populated drive. However, once this is completed, subsequent whitelist activity (for example following a disable AE/install/enable AE operation) are rather quick since only the new files accessed during the disabled state are added.

If you perform a system wide disk scan with AE disabled, that will yield a result that appears equivalent to the initial AE scan since all files on the system would have been accessed and their whitelist status will be rechecked on enabling AE.

Blue

 

Not better, but simular without white lists SpywareTerminator's HIPS feature

 

Exec LockDown - a new version - will be launched in APril 2008

http://www.horizondatasys.com/169602.ihtml

hope it's a good one.

 

They had one by this name a while back which they had discontinued.
I believe it was "trust no exe" that they bought out.
Hopefully the new version will be improved and as good as Anti Executable,as well as compedibly priced.

 

I really think you should not be deterred or frustrated with AE because it re-inventories your whole file system in order to accept new entries, almost like an AV recovery database, sure it takes some time but hours? I have a 200GB Maxtor and it never took hours
So i dunno why that type of delay.

More on your topic though, if i were in your shoes and felt disenchanted over AE to the point of needing a replacement, i would no doubt have to turn to EQS (HIPS) because it not only covers executables but also scripts/registry etc. something AE is not yet made for if it ever will.

 

Wow, Easter. It's getting to the point now where I don't have to read your posts to know what you are saying. I think we all get it now....you are pro EQS.

 

Well, the reason is simple, i also have AE and quite a few other security apps of course which i've brought in over time. I just can't find another app that is as full-featured in so many areas of coverage, alerts as expected, never misses, and is super-lite and fully stable even if i install ANY of my other security apps along with it. That's a huge plus when you read of so many marathon conflicts between semi and similar apps, or opposites.

More OT. The topic author certainly makes a very valid concern here. Any HIPS aside, i don't know of any program that could come close to offering the type of protection that AE does for normal system exectuables and as well. To me it behaves so much like an AV in many ways and that's due to it's in-build code detections.

I would be just as interested if there is another app as similar to AE myself.

 

Hello Easter,

I just sent you PM with an Autorun.inf file and a .vbs file for you to test. Please post a screen shot of the alert message you get from EQS.

thanks,

rich

 

From CFP( same is true for EQS I think), I created rule for autoruns in CFP but it is there in EQS by default.

 

Hello aigle,

Since this is getting a bit off topic, I've started a new thread about blocking scripts. Try the tests I've set up and post your results.


https://www.wilderssecurity.com/showthread.php?t=203483

----
rich

 

Hi Rmus

Just now seen your PM and am in progress of running it. You must be a Sorcerer of White Magic and reading my mind at a distance because i was thinking today where i might find that EXACT finjan test again. I lost the vbs file i had but thanks to you i can run it again.

Little slow here but i'll give it a spin per your PM and report back. I'm probably gonna test it against both 3.41 & 4.0 beta to see if both returns are similar or different results.

Regards EASTER

 

Delayed to May 1, 2008.

 

What is this AE about ? Does it do more than any popular HIPS ?

 

The new program is called Executable Lockdown and is completely different from
Exe Lockdown. There will be no freeware version.

 

Regard it as a limited HIPS whos purpose is simply default-deny. It allows users to run whitelisted applications, while preventing the execution of the non-whitelisted executables.

/C.

 

Aha, thanks. Does it control execution in kernel or in userland ? What about autoruns ?

 

I'm sure it has a kernel driver to enforce the policy. It doesn't cover autoruns because it doesn't need to do so.

 

Anti-Executable has a Quintuple Verification
Whitelist verifies.
* File Size
* File Type
* File Location
* Creation Date
* Code Sample

http://www.faronics.com/html/AntiExec.asp
You better trial AE, because this is a very strict software, you might not like it in the end.
Very unusual software too, so read the welcome email or help, otherwise you get lost. It hides itself very well, icon doesn't work like others, special uninstalling procedure, no access to its folder, password protected.

 

Executable Lockdown is now available:
http://www.horizondatasys.com/169602.ihtml

 

Renamed Process Explorer procexp.bat and executed just fine, no alert. heh
I just noticed it's more expensive than AE, i mean, $49..

 

I am quite happy with AE.

 

A pure system partition has only Windows and Applications and no data.
Do you have so many applications, that it takes AE hours to re-scan your system partition ? Do you use all these applications or are you just a collector of applications without using them ?
The very first scan took some time, but after that any new application was a matter of seconds to adjust the whitelist.

 

So you took a whitelisted program and renamed it and it ran...why is this a bad thing? Try taking a blacklisted program and renaming it to a whitelisted program and if it runs thats a bad thing. But I can assure you it will not

Also it's 39 dollars now.

Thanks,

Chris

 

as I know, the Returnil new beta has a plugin, I hope I can call it another AE.