New Antiexecutable: NoVirusThanks EXE Radar Pro

But I am interested if what issues others here have experienced with ERP since the latest Win 10 Cumulative Update (to Build 14393.693)? How widespread is the problem?

Apart from the one incident, also experienced by @iammike, which I cannot conclusively say was due to ERP, I have not had issues, so I am leaving it on for now.
If it does bork my machine at some point, I may just need to do an image restore.

 

@ Everyone

ERP is not dead, we're back at developing a new ERP from scratch, here is why:

- We will use SQLite to handle rules with search\edit\filter\sort\pagination\etc
- We will save more info about a rule, such as when it was added and when it was last modified
- You will be able to enable or disable a rule
- We are discussing a new way to match processes with rules, a possibility we are evaluating now is like this (we're open to ideas of course):

Code:

[proc.parent = “C:\Windows\Explore.exe”] and  [proc.name = “abc.exe”] and [proc.signer = “Microsoft Corporation”] [action = “allow”]
[proc.name = “explorer.exe”] and [proc.signer <> “Microsoft Corporation”] [action = “deny”]

- We will add support for categorization of rules, i.e "Windows Updates", "Firefox Updates", "Windows Processes", etc
- We have improved the method to gather information about a process
- All will be focused in a super easy way to manage rules
- New UI

When we'll have the first beta build ready I will update here so anyone can test it.

 

+1 !! Welcome Back Andreas.

Can't wait to test the new and enhanced ERP

 

Very good. The waiting time is over

 

Andreas - so good to have you back!
Two questions/requests in advance:
1. Would it be at all possible to somehow import settings and black/whitelists from the existing version?
2. Also would it be possible to make it so that Vulnerable Processes whitelist is not hash dependent, as these system32/sysWOW64 .exe hashes change with each major Windows 10 upgrade, meaning they need to be re-added. Some of us have a lot of these defined, over and above the default.

 

Great news! Welcome back!

 

Excellent
@Peter2150...+1

 

Finally

 

Now I am suddenly getting crashes on every reboot, sometimes many NVT ERP alerts before it fails. Had to restore an image.

WhoCrashed reports as follows:
On Thu 2017/01/19 3:05:09 PM GMT your computer crashed
crash dump file: C:\windows\Minidump\011917-6937-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14A6F0)
Bugcheck code: 0xC2 (0x7, 0x0, 0x0, 0xFFFF9E8FDCE9D97
Error: BAD_POOL_CALLER
file path: C:\windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the current thread is making a bad pool request.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. (My bolding).

Still can't be sure it's ERP, though it would seem suspect. I have disabled it to see if that helps for now.
But maybe I'll need to uninstall it - and wait for the new beta

 

New version/s = paid product or donationware

 

The newly released HMP.A (beta) with updated drivers is much more likely to cause that BSOD - if you are using it.

 

@novirusthanks I am glad to see you back!
One question: do you plan to change the licensing of ERP and what with users who already have a PRO license?

 

@novirusthanks Sometimes bashing the sleeping giant will make it wake up

 

it comes from HMPA latest beta, not from ERP. ; i got this Bad Pool Caller stopcode too. had to revert to stable build 573

 

_Everyone

Thanks for the welcome back

@paulderdash

1. Not initially, but we may workaround something for that.
2. Yes, the new version will allow to specify vulnerable processes by process + hash or by process or by hash etc

@NSG001

Can't say much for now about that, but if it will be paid all actual ERP users that have purchased a license will get the new version for free.

@Lockdown @guest

Thanks for the information!

 

Nice, then a file stays a vulnerable process even if it was updated ("specify vulnerable process by process")
Useful improvement, especially for users with more than 100 Vulnerable processes:

 

+1

 

No really. Thank you for coming back where the mortals... lol

 

Cool,

What would really be great when the GUI would include a rule builder (like ThreatFire or AppLocker), e.g.

• First select action : allow or deny
• Next select parent process with windows file open dialogue (or skip)
• Next select rule type (signer, folder, name or hash) followed by windows file open dialogue
• Next select exception (same as syntax, guidance as with rule type above)

GUI assisted rule builder facilitates simple rules. Free format rules following logic as described would allow more flexibility to the power user as described in the code above ([metadata object = value] and/or [metadata object = value] > [action =allow/block[)


P.S.

Andreas, good to see you are back

Kees

 

I purchased a license almost 3 years ago without a single update. What's the ETA? 3 months? 6 months? 3 more years? I have my doubts.

 

Great news！Welcome back！

 

I knew he'd be back!