Safe Returner

[sg09]

Originally Posted by egomoo

In my test,Safe Returner has less FP.

Anyone who make a review on it could apply a free license according its website page here

http://www.safereturner.com/getakey.html

Thanks a lot for the offer..

[CloneRanger]

Good to see it all panned out to be for real Be interesting to see how well it progresses

[falkor]

I know Franklin . I read it . Tried both ways . No go and no problem . I have moved off of it and moved on .

[sg09]

Hi, egomoo, while trying the product, during update I got two types of error message. And after that it stopped working.




Please look over the problem.

[falkor]

Yep . That would be the same crap I got . Lol .

[sg09]

Originally Posted by falkor

Yep . That would be the same crap I got . Lol .

You got the same error?

[egomoo]

the server has some a 500 error

and now I have fixed it.

Sorry for that.

It's ok.

[AvinashR]

Hi Egomoo,

I have tried to test your software, but i have received some fatal errors. Even i was not able to scan anything. To be very honest, my first experience is really bad...

But never mind, i am sure you'll look into the matter and convert the initial worst into final BEST !!

I look forward to "hearing" from you soon..

[egomoo]

I'm so sorry that my web hosting server has some tech problem.

I'm now try my best to fix them.

Sorry.....

[AvinashR]

Originally Posted by egomoo

I'm so sorry that my web hosting server has some tech problem.

I'm now try my best to fix them.

Sorry.....

I understand. Please try to fix it, so that i can able to test your software.

With Best Regards,

[Tarnak]

I got the .com file and changed the extension to .exe and tried to run, but I got the following error message:

---------------------------
Error
---------------------------
Unable to execute file in the temporary directory. Setup aborted.



Error 193: %1 is not a valid Win32 application.
---------------------------
OK
---------------------------

[sg09]

Problem solved. Thanks for the fast response..
It detected two threats (FP),
AWC.exe (advanced wall paper changer), for not having Company Name.
btguard.sys (MBR Guard), very few google search result



But my question is many malwares has many google search results...


My Verdict: I am quite satisfied... I expected it to detect MBR Guard. Not too many FP as I guessed as I have a few many Softwares installed.

[sg09]

Update: A few more detections in Expert Mode. I like the threat ratings. First scan took a longer time compared to later scans. Also checks for updates before scan.

Few Suggestion:
1. Make the Window re-sizable.
2. The application can be turned off from Task Manager. Better self protection is needed.

[jmonge]

does it have real time protection?

[egomoo]

Originally Posted by sg09

Problem solved. Thanks for the fast response..
It detected two threats (FP),
AWC.exe (advanced wall paper changer), for not having Company Name.
btguard.sys (MBR Guard), very few google search result

Attachment 219028

But my question is many malwares has many google search results...


My Verdict: I am quite satisfied... I expected it to detect MBR Guard. Not too many FP as I guessed as I have a few many Softwares installed.

YES,the Norton Power Eraser also detect btguard.sys as a threat because there is few folks use it.

I agree with that many malwares has many google search results, but the scan engine do not base only "google result".

The threat detail is a information for a novice to spot malware.

It is easy to be recognised If they know it is installed by themselves.

I will update the database ASAP to resolve the 2 FPs

thanks for your test and advice.

[egomoo]

Originally Posted by jmonge

does it have real time protection?

Safe Returner is not an anti-virus product, so it do not have real-time protection.

Safe Returner focuses on the detection and removal of active malicious software.

[Franklin]

egomoo, can you get the latest version over to the download sites?

[egomoo]

Yes,I have upload a new install package to server.

go here to download :

http://www.safereturner.com/download.php

it fix some bugs when run in windows 7 but the version is also 1.24.

I hope have fixed AvinashR's error message.

if there is no bugs in windows7 after AvinashR test,then I will change its version as 1.25

thanks all

[egomoo]

Deep In Safe Returner

I want to share something more with safeReturner

the review below is makded by a expert on malware research group.

the link is http://www.kernelmode.info/forum/vie...php?f=11&t=188

Hi,

I tried it against Security Essentials 2010 (aka Internet Security 2010).

It successfully detected and cleaned rouge av (very simple rouge).

As far as I see Safe Returner uses termination of all non whitelisted processes at the beginning of scan.

However exists a lot of fake av's that blocks startup of applications that are not in their whitelist (usually by process name).
So I doubt in real usefulness of this program in comparison with the classical antimalware products such as antiviruses.
SafeReturner does not include any kind of self-protection (or I didn't found it).

I believe it is created only with one purpose - get some bucks from unexperienced users.

I want to say the review is fair after a quick test with little samples.

But If you test more than 10 samples,or leanr more about the app for more time ,I believe you will like it.

Most of the first experience is non-credible by techs because they know classical antimalware products has more large database,must take more time scan.（do not include CLOUD product）

They can not believe that such a small tool in such a short of time could remove lots of malware in common use.

here is a story from a editor

[sg09]

Thanks for your reply. Can you make some options available through which FP can be reported?
Also, self protection is very important. Once malware writers come to know about your program they will device method to kill the process.

[egomoo]

1. if the app's purpose is getting bucks from unexperienced users.

It must do not give 30 days all function for trial.

And users do pay nothing remove malware in his 30 day trial.

2. "Safe Returner uses termination of all non whitelisted processes at the beginning of scan"

yes ,it will terminate most of process but not use a whitelisted database.

In XP, it use the api function to let the process closed itself.

ExitWindowsEx(EWX_LOGOFF,0);

send a "LOGOFF" message to system,then all the other process receive the logoff message,and close itself.

But in safereturner,it intercept "WM_QueryEndSession" event,so it sitll run and scan.

3."However exists a lot of fake av's that blocks startup of applications that are not in their whitelist (usually by process name).
So I doubt in real usefulness of this program in comparison with the classical antimalware products such as antiviruses.“

Safe Returner is a none signature-base anti-malware tool.

It has a cloud similar anlysis function but do not base on signature.

All in one, It is a smart version of Sysinternal's Autoruns.

Safe Returner could automatically remove most of malwares which could be removed by manually while use Autoruns with pc skill.

So it's powerful in common use both novice and techs

there are some malware that it could not remove at 1.24 version

1. API hooks to prevent SafeReturner get the right startup item
2. rootkits hide itself from normal detection

[egomoo]

Originally Posted by sg09

Thanks for your reply. Can you make some options available through which FP can be reported?
Also, self protection is very important. Once malware writers come to know about your program they will device method to kill the process.

thanks.

please read on help document about "False Positive " subject.

It has some features to report FP.

further more,the scan log will automatically upload to the server so we will review it,then put it to the next database update

There are two ways you could choose to do with a true false positive:

1. Right Click on the result box --> "Submit as false positive to us"
2. Right Click on the result box --> "Add to ignore list"

self protection is very important for a famous tool,as safe returner is still on its beginning of development,so the protection features will be added in next version.

[sg09]

Oho... Very sorry I didn't notice the FP Reporting part. :p

Yes, Safe returner is in the early state and we wish it to be a very good product in future. That's why few more suggestion.
1. Add a feature to protect the installation process like Kaspersky or Dr Web so that it can be installed on infected systems too. What about making a portable version like Dr.Web cure it..!!
2. It may be a little silly but may be many of us don't like a security apps not having a digital signature..:p


O.T: Just noticed you have been a member of Wilders since Aug 2007... Why didn't you introduce your product before?

[egomoo]

thanks for your suggestion,and I will add those to my next plan

Yep, I'm a old man in malware research as a member of Wilders since Aug 2007.

So the app is full of my wisdom from manually malware removal.

And I finished its beta version on 2009 and after 6 months tested in normal user'pc as a free software.

It collect more than 10000 users' system information to develop a less FP and effective scan engine.

So that mean its Algorithm to detect malware have tested on lots of computers and have been adjusted.

[AvinashR]

Originally Posted by egomoo

thanks for your suggestion,and I will add those to my next plan

Yep, I'm a old man in malware research as a member of Wilders since Aug 2007.

So the app is full of my wisdom from manually malware removal.

And I finished its beta version on 2009 and after 6 months tested in normal user'pc as a free software.

It collect more than 10000 users' system information to develop a less FP and effective scan engine.

So that mean its Algorithm to detect malware have tested on lots of computers and have been adjusted.

I am still receiving errors ...