New Antiexecutable: NoVirusThanks EXE Radar Pro

Here is a new v4.0 (pre-release) test2:
http://downloads.novirusthanks.org/files/exe_radar_pro_4_setup_test2.exe

*** Please do not share the download link, we will delete it when we'll release the official v4 ***

So far this is what's new compared to the previous pre-release:

+ Fixed writing of rules (matching of fields)
+ Fixed matching of wildcard characters (Like to) on rules
+ Fixed matching of parent process on rules
+ Fixed showing of main window on multi-monitors
+ Fixed showing of "Hide Main Window" on Tray Icon
+ Added option "Do not auto-close notification dialog" (when a process is blocked)

To install it, first uninstall the previous build, then reboot (not really needed but may help), and install the new build.

There were some issues on rules, please retry with this new build (should work fine now).

To use wildcards (? and * characters) just select "Like to" instead of "Equal to".

@mood

Will read all your suggestions on these days and discuss them, thanks for posting them!

@Peter2150

Will take a look at your issue, it looks like definitely strange.

@askmark

Yes, it will be fixed\handled-better in next build.

Sure.

@Charyb

We've added the option "Do not auto-close notification dialog" on Settings tab.

We'll also set pagination to 50 or 100 rules per page.

@shmu26

This rule on Command Line:

Code:

C:\WINDOWS\system32\Rundll32.exe Prnntfy.dll,AsyncUILoaderEntry Local\{*}_ASYNCUI

Should now work fine.

@Pliskin

It is fixed now.

 

Hello,

I am still having problems with vulnerable processes as I outlined in post # 6505 above. I am fairly sure it has nothing to do with the wildcards as I cannot get the VPL to work using the entire command line string. I am also fairly sure I am using the wildcards correctly because I have no issue with regular processes and using wildcards. I am at a loss... (and yes, I do change the command line to "Like to")

Am I the only one having issues using the VPL and then creating rules for the vulnerable processes?
Has anyone gotten it to work correctly?

On a side note, I lost all of my created rules after updating to the new version and the list that I had exported would not import so I had to start from scratch.

 

Hello,

The frustrating part to me is not knowing whether it is me doing something wrong or a bug/issue with version 4. I have gone over all that I am doing and can only assume that I am doing things correctly as I can edit and add rules (with and without wildcards) for regular processes fine with no issues. It is only with vulnerable processes that I have an issue. With no feedback from @novirusthanks, I can only assume that it is a bug/issue with version 4 and vulnerable processes.

One of the great things about version 3 (at least for me) was its simplicity). Version 4 is more complex, especially concerning vulnerable processes and adding the rules needed for the VPL with command lines...

 

@puff-m-d

I checked your rules on post 6505 and they are correct.

With build 2 they should be handled correctly, on build 1 the wildcard on Command Line field was not working fine.

Can you try this rule (basically, removing checking for hashes):

Code:

[Proc.Name = cmd.exe] [Proc.Path = C:\Windows\System32] [Proc.CmdLine LIKE "cmd.exe" /c ipconfig*] [Parent.Name = C:\Program Files\AirVPN\AirVPN.exe] [Parent.Signer = AIR DI PAOLO BRINI] [Action = Allow]

If doesn't work, can you show a screenshot of the expanded alert dialog?

We've found an issue on ERPv4 when it tries to import specific command-line strings, will be fixed asap.

 

Hello @novirusthanks,

I tried your rule as outlined above. The changed rule did not work. Here is the requested screenshot:

 

Still doesn't work. Here is my new "Parent can launch any exe" rule with explorer.exe, so you can test it yourself:

 

@puff-m-d

Strange, will install AirVPN and try it.

@Pliskin

The field "Name" in "Parent Process" matches both path + name, i.e:

C:\Windows\explorer.exe -> correct

explorer.exe -> not correct

 

That screenshot has a "customise rule" link which means it's triggered by an existing rule. Would be interesting to see a screenshot of the rule behind that link.

 

Hello @askmark,

I am using @novirusthanks VPL, so it is the rule contained in that list. If you are not familiar with the VPL, see post #6454 "How to handle Vulnerable Processes?".

 

Thank you. That means I have found a bug, because if you use "Read Data from file" for the Parent Process you will only get the name (explorer.exe) which is incorrect, as you say.

 

So it matches the VPL rule for cmd.exe and not your custom rule, is that correct?

 

Hello @askmark,

Yes, that is correct.

 

I also have that field show up when selecting Read Data From File, however I run into a different matter where set an expression to ASK on powershell.exe w/PARENT field of course is explorer.exe (as it shows Read Data From File) and it launches powershell anyway. No alerts, no nothing.

I'll tinker with the settings some more and see what's amiss.

 

We've just finished to implement the option 1 discussed on #6472:



New build will be uploaded soon.

@Pliskin

Yes, will be fixed asap, thanks for the details.

@EASTER @puff-m-d

Build 2 should correctly allow command-lines supporting wildcards (it has only an issue on parent process name reported by Pliskin).

We'll double check it asap.

 

How the heck did I miss this, thanks!

 

Thanks. It's incredible the pure numbers of vulnerable processes/command-line strings that windows leaves wide open for tamper.

 

Does v4 have a Utilities tab?

 

Build 2 is yet to been released yet.

 

Cool stuff, exciting to see the new version. I will wait for it to become a bit more mature, but the GUI looks good though.

 

Any idea of a time expectancy for the next test build ERP 4?

 

I've noticed that it doesn't remember window and column-sizes. Also, is it possible to make ERP monitor suspended processes? So if a process starts up a child processes in a suspended state, it should be blocked. This way you can block process hollowing attacks.

 

Awesome. So happy that mention is been made.

Malwares will go to any lengths and that's a goodie two shoes angle for those buzzards.

 

yes it is what we call it a beta