Crystal Security - Discussion

[kardokristal]

Hello everyone,

New version of Kristal Security is now available.

Kristal Security 2012 [0.0.1.1 Beta] version launched today and include totally redesigned GUI.
Program is available in 5 different languages thanks to other country translators. Available languages:

1) English
2) Chinese
3) Polish
4) Bengali
5) Estonian

Kristal Security is simple anti-malware program to fight against viruses, worms and other malware. It include Real-time protection.
You can backup your data, secure files, clean pc and do other things.

Also includes automatic and manual updates and it is very light on your system. You can use this with other security products.

Program is absolutely free.

Note: Our website and other 2 security programs called: Kristal Safe Way and Kristal Theft Protect are updated and new versions available.
Also website have now totally new design.

All information and downloads from our website:

http://www.kristalsecurity.com

Best regards,
Kardo Kristal

[Dermot7]

Congratulations Kardo, on your new website and products...it all looks very nice!
If you don't mind me saying, however, the copy/text needs a little "proof reading", to fix some incorrect grammar etc.
This is probably just because English is, presumably, not your mother-tongue.
If you like, I am willing to correct it for you, if you'd like the grammar etc to be
more precise and descriptive.
Hope you don't think I'm being pedantic...just trying to help

Here are two examples of errors:

[kardokristal]

Hi Dermot7,

Thank you for pointing out my English errors/mistakes

Yes i am interested in your help and yes, English is not my mother-tongue.

Best regards,
Kardo Kristal

[Dermot7]

Ok...what I'll do then is look at the whole website etc, and get back to you in a day or two (I'm very busy tomorrow), and I'll PM you with the results and suggestions. I used to be (when I was young ) a copywriter/freelance journalist...so you're in safe hands
All the best, Dermot.

[gregd]

To help you out and because you're a "security website". I would dump your free template. Free templates, whether they're for WordPress, Joomla or any other CMS, generally contain malware.

When I run your url through Sucuri, I get the following malware alert:

http://imgur.com/8hzhw

Based on a link at the bottom of your free template

[m00nbl00d]

Originally Posted by gregd

To help you out and because you're a "security website". I would dump your free template. Free templates, whether they're for WordPress, Joomla or any other CMS, generally contain malware.

When I run your url through Sucuri, I get the following malware alert:

http://imgur.com/8hzhw

Based on a link at the bottom of your free template

I'm not sure if it has to do with it being a free template. I didn't investigate further, but by looking at the source code, I'd say that it has to do with the tracking service it is being used, which belongs to/is a partner of 000webhost.

That said, Wepawet scan came up clean.

For instance, hpHosts and WOT (based on hpHosts) flag the domain in question as being serving exploits. A bit difficult for exploits to be lasting since 21-09-2011, considering domains hosting exploits don't last that long. The majority won't last minutes, even less months.

On the other hand, the main domain is not flagged by either of them. But, WOT users to rate it red. Have that as you want.

AVG LinkScanner reports the URL as being clean of exploits as well.

Also, Sucuri reports -http://analytics.hosting24.com/count.php as being clean. So, it's a bit confusing why they're alerting for something in Kristal's website, related to this URL, when Sucuri reports the URL clean?

-http://sitecheck.sucuri.net/results/http://analytics.hosting24.com/count.php

[kardokristal]

Hi gregd,

Thank you for the report but i am sure that this is like anomaly false positive.

I just checked site with VirusTotal and URL Void.

Both reported 100% Clean, also dr.web link scanner and AVG linkscanner reported as clean.

Here are the results:

1) VirusTotal report: http://i.imgur.com/lyaUn.png

2) URL Void report: http://i.imgur.com/E7yxH.png

About website template: It was one of the most popular free template in this month from where i downloaded it.

Best Regards,
Kardo Kristal

[kardokristal]

Hi,

One more report by F-Secure:

You can see that also F-Secure report website as Safe.

http://i.imgur.com/ZWAUN.png

Best regards,
Kardo Kristal

[gregd]

Hey Kardo, I was simply pointing out that for a security website, it's best to take any and all precautions you can with regard to security. I encounter "free" Word Press (and other) templates all the time that have dubious links and embedded malware in them, that most people aren't aware are even in the templates.

I didn't really need proof that your website was legit just that when I visited it and saw that you were using a "free" template, I chose to run it through a site that I use regularly in my consulting business and wanted to give you a heads up about it.

Do with it what you will and good luck.

[kardokristal]

Originally Posted by gregd

Hey Kardo, I was simply pointing out that for a security website, it's best to take any and all precautions you can with regard to security. I encounter "free" Word Press (and other) templates all the time that have dubious links and embedded malware in them, that most people aren't aware are even in the templates.

I didn't really need proof that your website was legit just that when I visited it and saw that you were using a "free" template, I chose to run it through a site that I use regularly in my consulting business and wanted to give you a heads up about it.

Do with it what you will and good luck.

Hi gregd,

Okay, thank you for your information and suggestions.

Best regards,
Kardo Kristal

[kardokristal]

Hi everyone,

First test of new feature is completed and Public beta is soon available of Kristal Security Advance Detector. This feature is part of Kristal Security protection method and is also available in future as separate product.

Use online database to check created, changed files for status like safe, unsafe or unknown. This detector will also notify you when file (.exe) is changed or modified. You can choose to blacklist/whitelist files, allow modifications, block (remove) or deny (deny execution for file),
choose detector level: Low (eyes on Program Files) or High (All .exe file changes, creations). This feature will be available in next version of Kristal Security and i will fix Updater problem for new version.

You can blacklist/whitelist files from list anytime.

Also is coming experts/reviewers section (You can help us to identify trusted/untrusted files easily to make detection even better).


In total, program (Kristal Security) will use internal database (for regular scans) and online database (Kristal Advance detector protection module and Kristal Security Advance Detector) to scan your files on background. Thanks to this, internal database will be slim and online database can be very large without impacting your system

Advance detector will be available also as separated program and for free.

Here you can see first images/screenshots of Kristal Advance Detector beta:

Main overview of Kristal Advance Detector

1) http://i.imgur.com/DNXYp.png

New file or modification is detected. You can see our rating for file etc...

2) http://i.imgur.com/7O0E7.png

User action added to list

3) http://i.imgur.com/s0ZWy.png

Set file group for selected file from list anytime

4) http://i.imgur.com/BJnC7.png

Result when file added to blacklist

5) http://i.imgur.com/P1pw5.png

Result when file is in whitelist or added to whitelist by user

6) http://i.imgur.com/2hD9q.png

Best regards,
Kardo Kristal

[m00nbl00d]

I thought it was already available.

Anyway, where it says Enable AD and Disable AD + Advance Detector Enabled, what do you think of having the following, instead:

Protection Status: Enabled

then, below it, the UI would have Enable, which would be grayed out, and Disable, which would be normal.

Then, when the protection is disabled, it shows Protection Status: Disabled.

On its turn, Disable would now be grayed out, and Enable would be normal.

I also think you wouldn't need AD Monitor | Actions. Monitor | Actions would be just fine. Users already know they're dealing with Advance Detector. The AD part only adds redundancy, in my humble opinion.

Anyway, just an opinion. lol



-edit-

Where it says Apply new rule, wouldn't Apply be more than clear to the user?

[kardokristal]

Originally Posted by m00nbl00d

I thought it was already available.

Anyway, where it says Enable AD and Disable AD + Advance Detector Enabled, what do you think of having the following, instead:

Protection Status: Enabled

then, below it, the UI would have Enable, which would be grayed out, and Disable, which would be normal.

Then, when the protection is disabled, it shows Protection Status: Disabled.

On its turn, Disable would now be grayed out, and Enable would be normal.

I also think you wouldn't need AD Monitor | Actions. Monitor | Actions would be just fine. Users already know they're dealing with Advance Detector. The AD part only adds redundancy, in my humble opinion.

Anyway, just an opinion. lol



-edit-

Where it says Apply new rule, wouldn't Apply be more than clear to the user?

Hi m00nbl00d,

Thank you for your suggestions

Public beta and Final version is like you suggested: Protection Status: Enabled and other suggestions you mentioned.

For all other members: All suggestions are welcome.

Remember: any existing and new Kristal security products user is important!

Best regards,
Kardo Kristal

[m00nbl00d]

Originally Posted by kristalsecurity

Hi m00nbl00d,

Thank you for your suggestions

Public beta and Final version is like you suggested: Protection Status: Enabled and other suggestions you mentioned.

For all other members: All suggestions are welcome.

Remember: any existing and new Kristal security products user is important!

Best regards,
Kardo Kristal

Thank you for considering them.

Do you have an idea when it will be released (beta)?

[kardokristal]

Originally Posted by m00nbl00d

Thank you for considering them.

Do you have an idea when it will be released (beta)?

Hi,

You are welcome

Answer: Public beta is available in few days.

It uses only 5-7 mb of ram on my computer. I release this for first as separate
program and when beta testing is done, then i will implement this to kristal security program (it stays also as separated program).

Best regards,
Kardo Kristal

[m00nbl00d]

Originally Posted by kristalsecurity

Hi,

You are welcome

Answer: Public beta is available in few days.

It uses only 5-7 mb of ram on my computer. I release this for first as separate
program and when beta testing is done, then i will implement this to kristal security program (it stays also as separated program).

Best regards,
Kardo Kristal

Will be waiting, then.

[ichito]

Originally Posted by m00nbl00d

Will be waiting, then.

Of course

[kardokristal]

Hello everyone,

BETA version of KS Advance Detector (also called: Kristal Advance Detector) has been released.

Version 0.0.0.1 Beta.

You can download installer or packed (.zip) to test out first beta of
KS Advance Detector.

Packed (zip) download: -http://dl.dropbox.com/u/47450407/Kristal%20Advance%20Detector%202012%20-%20Public/Kristal%20Advance%20Detector%20BETA.zip-

Installer version download: -http://dl.dropbox.com/u/47450407/Kristal%20Advance%20Detector%202012%20-%20Public/Kristal%20Advance%20Detector%20installer.exe-

Here are some screenshots of first public beta:

1) http://i.imgur.com/LG82S.png

2) http://i.imgur.com/ecUZO.png

3) http://i.imgur.com/zr7p3.png

4) http://i.imgur.com/gIEmW.png

NOTE: Links updated to new version: 0.0.0.2 Beta

All suggestions, comments and bug reports are welcome.

This version is not public on Kristal Security website yet because this version
is first and may contain a lot of bugs. When most bugs eliminated then available also in Kristal Security product and as separated program too.

Best regards,
Kardo Kristal

[kardokristal]

Hi,

Quick update released:

Important bugs fixed:

* Activity Monitor / Blacklist and Whitelist load

* Settings - Auto-Start (Automatic start-up option corrected and working)

Download links for Kristal Advance Detector 0.0.0.2 Beta:

Packed (zip) download: -http://dl.dropbox.com/u/47450407/Kristal%20Advance%20Detector%202012%20-%20Public/Kristal%20Advance%20Detector%20BETA.zip-

Installer version download: -http://dl.dropbox.com/u/47450407/Kristal%20Advance%20Detector%202012%20-%20Public/Kristal%20Advance%20Detector%20installer.exe-

Best regards,
Kardo Kristal

[Tarnak]

A pity it requires .NET...



... but, at least the exe file got the all clear from another source.

[kupo]

Tried it (under virtual mode by Time Freeze), and it threw me some .net errors, but it did worked because it prompt when I download a file, added it to blacklist and tried to run it and execution is blocked.Will wait though till bugs where squashed. Too much beta applications running in my system. . Suggestion, please make it work in a standard user account, (not needing admin privileges), a way to do this it make it a service. Thanks! .
EDIT: It is working without admin rights, my bad. (not sure if it will prevent changes in folders requiring admin rights though, like program files, system32, etc)

[kupo]

This is the error I'm finding
"Could not find a part of the path 'C:\ksadfiles\Checklist.txt'"
I tried to find this file and it is located in C:\kadfiles\, a typo perhaps?

[kardokristal]

Originally Posted by Tarnak

A pity it requires .NET...

Attachment 231832

... but, at least the exe file got the all clear from another source.

Attachment 231833

Hi Tarnak,

Yes, .NET 4 framework is required.

Good to know that Kingsoft show my program as clean

Best regards,
Kardo Kristal

[kardokristal]

Originally Posted by skudo12

This is the error I'm finding
"Could not find a part of the path 'C:\ksadfiles\Checklist.txt'"
I tried to find this file and it is located in C:\kadfiles\, a typo perhaps?

Hi skudo12,

Thank you very much for this report

Yes you are right, i will fix this today.

NOTE: Program final name is: Kristal Advance Detector.

Also is soon available Kristal Security forum on Kristal Security website.

There is coming some changes of contact address (more official like: info@kristalsecurity.com for example). If changes completed i will notify.

Best regards,
Kardo Kristal

[kardokristal]

Hi all,

skudo12 reported bug is fixed now.

Version number is still 0.0.0.2 Beta, but this is now updated and
important bug fixed.

NOTE:

I plan to add up to 4 classification engines (Malc0de, SANS, Emsisoft - Isthisfilesafe.com and Threatexpert)

I need positive answers from Emsisoft about their database usage and from
ThreatExpert. Positive answer already got from SANS.

Best regards,
Kardo Kristal