New Antiexecutable: NoVirusThanks EXE Radar Pro

Thanks Pete for the heads up.

@Dzp5t

Great, that issue you reported should have been fixed in that new build, my bad for not updating the signature.

 

Nope, no VM

 

This problem happened when I was using just the BUILD1-15052015.

 

@novirusthanks

Have there been any reported issues where placing ERP permanently into Learning Mode causes an AppHang?

I submitted ERP self-generated bug report to you via support e-mail address on your site.

Thanks,

HJLBX

 

Running Win 7 x64. Was running v 3.1.0.0 Build 1-22042015 - after this post will update to latest stable build.
As my C: partition has put on weight in the last few months, I was comparing two images to see what has changed. To my surprised I noticed a huge increase in the ERP Logs folder size, from 650MB on July 1st to 1,2GB today. I immediately proceeded to clear it - I don't think I have ever done it before - and I now have some questions:
a. are my settings (see picture) correct? I don't remember tweaking them, so I assume they are default
b. what could such a huge increase be due to? Keep in mind that the PC was off for over a month
c. is there a workaround for ERP to do such cleaning automatically?

thanks

 

Hello newbino,
Thanks....you reminded me to delete Logs.

 

While using Shadow Defender I don't mind but I agree with newbino an automatic log clean is needed.

 

That would be great, but now ERP is essentially quasi-abandonware...

 

Does anyone know the following:

If enable Learning Mode is there a timer other than what is in the tray icon menu ?

Does "Enable Windows 8 Start screen processes" setting apply to each individual Windows App or to just WWAHost.exe and Livecomm.exe ?

 

@newbino

We can add an option to auto-delete logs if they reach N size or older than N days.

@hjlbx

No, you can choice only from the timers available in the tray icon menu.

Not yet, during the Learning Mode did you executed processes of like 25+ MB in file size ? If yes, that could be the cause.

I received that, I'll upload tomorrow a new build of ERP for testing.

It allows processes located in C:\Program Files\WindowsApps\* and C:\Program Files\Local\Packages\*

@Dzp5t

Is possible that another security app blocks EXERadar.exe from starting ?

 

When will the next beta be released?

 

I received that, I'll upload tomorrow a new build of ERP for testing.....OVERKILL tomarrow a NEW BETA,,,

 

@novirusthanks

Purge old hashes when a process is white\black-listed deletes previous rules (for example, for softs that are updated frequently) ?

 

Same question from me, and hopefully some of my requests will make it into this version.

 

@novirusthanks
There's an ongoing discussion about anti-exe abilities to prevent applications from executing unknown dlls.
https://www.wilderssecurity.com/thre...lications-from-executing-unknown-dlls.380122/

Could you shed some light here and / or there if ERP needs to be updated on this matter or just tinker some settings and that's it?

 

Just took v3.1_15052015_BUILD1 (xttp://downloads.novirusthanks.org/files/EXERadar_Pro_x86_x64_v3.1_15052015_BUILD1.exe) for a spin and it's great. This is a first time use and am beginning to like it. Might there be some way to block an application launch by commandline? I mean if there be a way to block or add to blacklist, say, an application launch triggered by a different application..like a browser launch? This seems to be a hips thing but it'll be nice if there be a workaround of some kind...Atill observing here.

 

@hjlbx

Yes.

@Mister X

ERP is an anti-executable, its main objective is to block/allow processes. You can prevent some specific system processes, like rundll32 and regsvr32, from loading DLLs but you cannot directly block the loading of DLLs. For example, if you allow Firefox.exe to run, then it can directly load any DLL.

@constantine76

We are adding possibility to blacklist specific command-line strings.

 

--Thanks for the reply there.

Is there a possibility that I can send you a PM. Just share a link from a friend whose very interested in the Smart Object Blocker. Not a member here so he can't post here. Thanks

 

@constantine76

Sure, you can send me a PM or you can contact me via email at http://www.novirusthanks.org/contacts/

 

Have sent you an

Sent an email just moments ago. Thanks

 

I have a question about modifying ERP settings...

I have recently created a Standard User profile, and am adjusting myself to use this as primary, and only run Admin profile when updating/installing etc...

I was wondering if ERP settings that are in Admin can be duplicated to show up in Standard User? I am not sure if this is possible since the whole idea of Standard User is to prevent tinkering... I think? All changes I make to ERP settings while in Standard User are negated after reboot. When I enter Admin profile, the desired settings are there, as expected since it is Admin.

Am I missing a setting, or is this the way a Standard User profile works? I remember I had the same issue with SpyShelter in Standard User mode (back when I used SS and Standard User in tandem); so I'm thinking it might be Windows doing it's normal thing.

I do use AppGuard in Lockdown Mode, and also have Software Restriction Policy installed... I dropped AppGuard down to Install Mode and also unlocked SRP before making changes, but no dice. What I am trying to do is get ERP to not default allow Windows and Program File executables by default, so the blend of AG and ERP and SRP is more complimentary rather than doubled-up.

Thanks in advance for feedback.

EDIT: Just thought of an easier way to explain my query... does ERP remember the settings for each user account?

 

I experienced similar issue on W8.1 system. Installed NVT ERP using Microsoft (Admin level) account. Created profile. Then signed into Windows using hidden primary Admin account. NVT ERP was reset completely with all rules\settings set to default.

It has something to do with the hidden Admin account.

 

Damn, and I doubt it is recommended to install NVT into hidden primary... well, anything really...