System Safety Monitor 2.2.0.593 out of beta

[Chubb]

System Safety Monitor 2.2.0.593 released

What's new:
* new application rule concept: application groups;
* added new module: Windows Hooks;
* added hidden process (rootkit) detection (eg. FU, FUTo etc.);
* added support for Windows XP Fast User Switching;
* added version info to the tray icon tooltip;
* added PID to the App Activity dialog for both Parent and Child processes;
* added new registry objects to the default registry rules;
* several language updates.

Bugs fixed:
* registry browser status bar shows misplaced value;
* unexpectedly closing SSM on remote desktop session;
* tray icon is occassionally grey after booting up &logging on;
* CPU graph tooltip redrawing;
* select columns dialog appears at the same position;
* command-line parameters editing bug;
* access violation after disabling Learning Mode;
* minor GUI issue with "Resize to content";
* minor GUI bugs.

[Stem]

This version is still in Beta. (full release version 2.1.15.592)

http://syssafety.com/files.html

[Chubb]

Oh sorry about that. I just received the e-mail notification that 2.2.0.593 was released. It didn't mention that it is still a beta.

[Stem]

Originally Posted by Chubb

Oh sorry about that.

No problem,...

Originally Posted by Chubb

I just received the e-mail notification that 2.2.0.593 was released

I thought the same thing on receiving the e-mail.

[Tommy]

Originally Posted by Stem

No problem,...
I thought the same thing on receiving the e-mail.

You are not allone in this.

[lodore]

i thought the same lol.

[ThunderZ]

Side note for those of us using the free version. It has been updated as well. 2.0.8.583 Non-beta of course.

[ccsito]

The release notes page hasn't been completely updated with this information.
http://syssafety.com/releasenotes.html

Please note that versions 2.0.x.x are the only versions that will work with Windows 98. The other program versions will not.

[bellgamin]

Originally Posted by Chubb

Oh sorry about that. I just received the e-mail notification that 2.2.0.593 was released. It didn't mention that it is still a beta.

I thought as you did. I awakened when I noticed the download included "beta" in its title. I'm not in a beta-testing mode right now, but the list of changes in this version was tooooo sweet for me to pass up. So I installed it. Running steady and on course.

[WSFuser]

the new SSM 2.2 lets u control outbound network access correct?

can someone post memory usage screenshot? also does disabling any of its features decrease memory usage?

[Stem]

Originally Posted by WSFuser

the new SSM 2.2 lets u control outbound network access correct?

Well, it did give full control of internet access to all applications,... but for some reason, they have changed the rules,... giving "csrss.exe", "smss.exe" and "lsass.exe" full access (Allow access to untrusted addresses),... This certainly puts me off using the latest SSM(beta) for internet access control.

[bellgamin]

Originally Posted by Stem

Well, it did give full control of internet access to all applications,... but for some reason, they have changed the rules,... giving "csrss.exe", "smss.exe" and "lsass.exe" full access (Allow access to untrusted addresses),... This certainly puts me off using the latest SSM(beta) for internet access control.

Oooops. I thought I found a way to edit those rules, but the changes didn't remain in place.

[Tommy]

Hm, i am not running the Beta, but how i understood Stem, and also some folks mentioned it in the SSM forum, the Beta has regarding to these 3 files ("csrss.exe", "smss.exe" and "lsass.exe") so called 'hardcore rules' which can't be changed. If that is realy so, i also won't install this version.

[MICRO]

Originally Posted by ThunderZ

Side note for those of us using the free version. It has been updated as well. 2.0.8.583 Non-beta of course.

Can anyone please advise if the latest 2.0.8.583 update has been downloaded and INSTALLED, can the previous,
2.0.8.574
2.0.8.579
2.0.8.581
2.0.8.582
which are all carrying 3 odd MB's, be safely Deleted ?

TIA.

[bellgamin]

Originally Posted by Tommy

Hm, i am not running the Beta, but how i understood Stem, and also some folks mentioned it in the SSM forum, the Beta has regarding to these 3 files ("csrss.exe", "smss.exe" and "lsass.exe") so called 'hardcore rules' which can't be changed. If that is realy so, i also won't install this version.

I posted this issue on SSM's forum at LINK.

[Tommy]

That's good news, that these rules can be changed. Perhaps in a later beta phase i will install it.
Yes the SSM folkes are very open to suggestions. I am since sometime in email contact with Vitali, a very respective and open minded person.

[Stem]

Originally Posted by Tommy

That's good news, that these rules can be changed.

No, the rules are hard_coded,... they cannot be edited/removed.

[bellgamin]

Originally Posted by Stem

No, the rules are hard_coded,... they cannot be edited/removed.

You are sooo right! (Blushing).

I discovered that my changes did not stay in place, but disappeared. I then edited my posts above, but not fast enough to avoid having everyone know that I have again stepped on my dork. Ah well, such is life.

I have reported this issue on SSM's forum. I hope others (Stem especially) will pass further comments to the SSM folks.

By the way, do I NEED to activate SSM's network rules module? I'm have only the one computer. Kerio 2.1.5 is monitoring outgoing. So why do I need any further scrutiny of outgoing stuff by SSM?

[Stem]

Originally Posted by bellgamin

I posted this issue on SSM's forum at LINK.

I posted about this on friday (as soon as I noticed the change) link but the post as been past by up to now from the SSM team.
I hope more will post to have these "allow access to untrusted addresses" rules left to the user to decide,....... and not be hard_coded to allow.

[Stem]

Originally Posted by bellgamin

By the way, do I NEED to activate SSM's network rules module?

No, you can leave this disabled. (I have been using this module due to testing "packet filters" (no app control))

[bellgamin]

Originally Posted by Stem

I posted about this on friday (as soon as I noticed the change) link but the post as been past by up to now from the SSM team.
I hope more will post to have these "allow access to untrusted addresses" rules left to the user to decide,....... and not be hard_coded to allow.

I just added an "amen" to your post over at SSM. I missed it before. Sorry. Thanks for the advice on the network rule. I have accordingly disabled it.

Live long & prosper.

[Tommy]

Folks you make me crazy; Yes - No - Yes - No.

Ok, this morning (my time) i also send Vitali an email about my/our concern. Nice thread on SSM forum, the 3 musketeers; Stem, Benjamin and mi. I am meeting you guys every where.

[Stem]

Originally Posted by bellgamin

I just added an "amen" to your post over at SSM.

Thanks,.. I will be sending an e-mail if the post is left unanswered.

Originally Posted by bellgamin

I missed it before. Sorry.

No problem

Originally Posted by bellgamin

Thanks for the advice on the network rule. I have accordingly disabled it.

The network access rules was an addition asked for by myself and others,.. but these are not needed if you have an application firewall installed (unless the firewall as hard_coded rules to allow its own applications internet access,..... and ya can block um)

Originally Posted by bellgamin

Live long & prosper.

I sure hope so,...

[Tommy]

I got response from SSM regarding the hardcore rules:
It says, that they will allow editing of the network permissions for them at the very least. They only hardcoded those rules which may case system hangs or crashes if changed. They will review the whole set of the current settings to allow as much editing as possible for these processes.

[Chubb]

System Safety Monitor 2.2.0.594 was released.

What's new:
* added "WinEvents Hooks" list to the module "Hooks";
* added Drag & Drop for application rules;
* several language updates.

Bugs fixed:
* fixed several memory leaks;
* version info in the tray icon tooltip;
* App settings not restored when importing config;
* the child/parent settings for a group are lost after restarting SSM.

Again, the word BETA was missing from the version number..