Cyberhawk 2.04 released

Here's the poop on what's changed:

* Addressed Internet Explorer slow down and performance issues experienced by some users
* Improved malware cleanup and quarantine for more effective cleaning
* Added incremental install capability so that going forward updates can be delivered through patches instead of requiring a full uninstall followed by reinstall
* Fixed rootkit scanner hang issue when scanning directories with large numbers of files
* Rootkit scan dialog now includes a ‘Select All’ option and abilitiy to ignore or remember certain hidden objects in future scan results
* General improvements to overall protective capability
* Fewer false positives
* Miscellaneous other program fixes

http://www.novatix.com/Cyberhawk/

 

You guys/girls are fast! ...

Enjoy it. Thanks to all the beta testers that helped out.

Dan

 

i try to install this to my laptop, unfortunatelyit crashed most of my program (bluetooth, etc.)

i immidiatly un install it and its back to normal.

is this vista compatible? i have pccillin IS 2007 and superantispyware pro installed....dont know if theres some compatablity issue too?

thanks

 

Hope it's lighter than the last vesion.

 

Hi all,

I use it since a hour and seems many more light than previous build and i hope stable.

Congrats, Novatix, i think this one is the best that i ever tried

Regards,

MaB

 

I'm trying it right now. Seems light and no discernable drag. Hope there aren't as mant FP's as in the last version.

 

Version 2.0.4.34 fails the first three tests of Firewall LeakTester Anti-Keylogger Tester (AKLT). FWIW, I submitted a ticket on their website.

 

Loads & runs straight & true. Nice so far.

 

Are we talking only pro version? Is the basic version also improved?

 

Oh boy, here we go again. I always been a secret beholden loyal to CyberHawk mainly due to it's first early releases and i just been sitting on the sidelines waiting to see what improvements would finally ring out with this latest version, but if that AKLT result is true, i dunno what to think.

Only way to find out is to try it i guess. Have to switch snapshots and give it a whirl. I like the comment by Riverrun because those issues are what we were waiting to be corrected.

 

Cyberhawk doesn't really adhere to the mantra of shooting down anything that moves - that's the job for a full-blown HIPS program. The developers aimed to flag only malicious programs, and following this idealogy, flagging the AKLT would be nothing but a false positive.

 

AKLT tests anti-keylogging behavior and therefore falls into the category of things Cyberhawk should protect.

 

Thats sort of my thinking at this time too Thankful but in all fairness to Novatix & Cyberhawk i believe we should let CyberHawk Support chime in on this before we jump too far ahead of ourselves here. There is some truth to the not a full blown HIPS per say but from past experience most all even Leaktests i threw at early Cyberhawk it done reasonably well against them but thats been some time ago now.

 

I agree. That's why I submitted a ticket. By the way, it still slows my system down too much.

 

I posted some time back about my finding that Cyberhawk uses, not 2, or 3, but i found 4! drivers that support this program's workings and frankly that right away explained for me why i had been experiencing sluggish behavior while Cyberhawk was running. Now that may be necessary for it to carry out it's work but theres an obvious trade-off there, and one in which was the reason once System Safety Monitor entered this scene with their flagship product that i cut all ties forever with any Anti-Viruses. They just seemed to wedge themselves into my system far too tightly for any comfort & satisfaction. I didn't like those trade-offs then and never will. Now that HIPS like SSM are here i don't need to concern myself anymore with tradeoffs like that. SSM runs squeaky clean on my XP Pro with absolutely NEVER any pressure at all on the system while at the same time offering fantastic coverage.

Now CyberHawk! When it first hit the scene my first inclination was NOT to replace (first-come-first-serve) SSM with it but rather compliment each other and establish a dual-coverage of sorts and they done just that. In fact, Cyberhawk, whether due to it's particular positions in the SSDT Table or something else yet unbeknowns to me, it jumped up "FIRST" before SSM to intercept potential invasion behavior and CyberHawk also after blocking proceeded to TERMINATE completely the same process it was alerted to and given permission to Block by user, me.

 

And that, my friend, is the key word.

AKLT is to real keyloggers what the Eicar test string is to real viruses. In my personal experience, from observation, Cyberhawk doesn't simply flag the GetKeyState APIs by themselves, but when combined with more complex behavior - such as requesting network access in tandem with requesting the afore-mentioned APIs - then Cyberhawk does pop up an alert. Don't quote me on this, though.

 

I think personally I will prefer lightness and stability at the moment. Once it is stable enough and runs really light, I will keep it on my system( even if it does not detect most keyloggers). These features can be added gradually.

BTW I agree that by behaviour, these keylogging attempts hould be detected.
A bit OT, has anybody tried this test with latest KAV?

Thanks

 

Cyberhawk (for me anyways) catches "GetKeyState" and "GetAsyncKeyState", the DirectX and screenshot tests will not get an alert from Cyberhawk. Also, we have seen that sometimes (vmware) the AKLT test does not capture keystrokes, and Cyberhawk will not alert on no behavior. We saw this on a few machines, hence the reason I mention this. Also, you must click out of the AKLT box, for the first two tests to produce an alert.

DirectX is not "caught" simply because in the world there are few if any malware samples with this type of attack. The samples that use the latter attacks usually get caught before they are allowed to get to the stage of recording a screenshot.
That being said, rules to counter these types of threats are being worked on.

Since we have the rootkit scanner, perhaps it is just say that Cyberhawk is not "pure" HIPS, but .... every alert that you see from Cyberhawk is because a rule is triggered by a particular behavior.

We have aimed at trying to be easier on system resources, although security software being the animal it is... will step on each others toes, to find THE combination to put on ones system is the "fountain of youth" if you will, and we too are searching for this. Hopefully we will give some sort of solution to that soon.

OK, I am babbling.

Dan

 

Sure it is lighter than before and no false positive so far, although CHservice is using a bit of CPU.

 

Installed CH 2.04 last night on my wifes laptop. Between CHservices and CHTray it is only using about 8500K. Tried the GetKeyState" and "GetAsyncKeyState" tests and CH picks up both when I click out of the AKLT window.

 

What does it mean exactly? A security suite?

 

Firewall, antivirus, antispyware, packaged software like the bigger companies out there offer.

 

Ohh... So if possible let us know pls which software brands you are going to incorporate. Components must be top noch, and still more important is their seamless integration, otherwise you are not going to get customers. Stability, stability, stability,... the most important thing for ordinary users, even if it is on behalf of a little bit less security.

But will CH continue as standalone? It,s a big Q?

 

The statement was definitely not official, and I meant that everyone (here) is searching for the "complete" package/s.

 

K, wait n see.