New Antiexecutable: NoVirusThanks EXE Radar Pro

@novirusthanks- Since install of this revised test build 21 am happy to say it's so far seems to be functioning as expected. Although am afforded little time to delve into testing various Rules etc. @mood and others are filling in that chore magnificiently. Examining as many possibilities as can be tried n tested and ERP v4 is popping on all 8's!

 

Can you add a prefs setting so the user can decide how many entries they want ?

 

Here is a new v4.0 (pre-release) test22:
https://downloads.novirusthanks.org/files/exe_radar_pro_4_setup_test22.exe

*** Please do not share the download link, we will delete it when we'll release the official v4 ***

So far this is what's new compared to the previous pre-release:

+ Action = Ask executions now auto-check the cmdline checkbox inside the Alert window (along with Vulnerable Processes)
+ Fixed Learning Mode isn't retained after a reboot
+ Increased maximum number of Events displayed in the "Events-tab" to 10K
+ Fixed The window of the Expression Builder resizable, but the size is not remembered
+ Fixed Processes allowed via Alert Mode show wrong expression in Events

To install it, first uninstall the previous build, then reboot (not really needed but may help), and install the new build.

@EASTER

Yes, we should add that on next build.

@mood

Reported issues should be fixed.

@Defenestration

Yes, we should add that on next build.

 

Are you working on an autoupdate?

BTW if you, guy who reads this, also changed the loon.wav you can make it read-only so that it doesn't get overwritten with any new version. I tested it. It's fine. Just click ignore during installation.

 

Quick update:

Here is a new v4.0 (pre-release) test23:
https://downloads.novirusthanks.org/files/exe_radar_pro_4_setup_test23.exe

*** Please do not share the download link, we will delete it when we'll release the official v4 ***

So far this is what's new compared to the previous pre-release:

+ Added new signers to Trusted Vendors list
+ Auto-check the Command Line field also in "Expression Builder" if the user clicks on "Custom Rule" on "Alert Dialog" triggered by Action = Ask executions
+ Allow user to specify how many entries show in the Events-tab
+ Fixed small logic bug involving play Blocked sound
+ Select a custom WAV sound file for Alert-notifications
+ Select a custom WAV sound file for Block-notifications
+ Improved "Allow Known Safe Process Behaviors"
+ Minor fixes and optimizations

To install it, first uninstall the previous build, then reboot (not really needed but may help), and install the new build.

Screenshot:



@__Nikopol

Not yet.

It now uses Alert.wav and Block.wav and they are overwritten on each install.

I will change it to not overwrite them if they're already present

 

Installed test23.

Found the following things.

1- Significant delay when starting programs (around 1-2 seconds) and this is on a i7 8600 with Samsung 970 Evo NVME. Other security software I am running is Emsisoft AM with exclusion for ERP in place. When removing ERP the delay is gone.

2- When turning on Learning Mode, after a reboot it's set to Alert Mode, I would expect it to stay on Learning Mode.

Edit: SpElLiNg

 

That's ok. I can imagine it is much work.

Oh, you don't need to do that now that we can set the sound in the settings, I think. thanks!

BTW,
- I'd like to set a password to prevent closing or changing protection state, but I don't want to enter it all the time when I allow an alert. (There are many alerts with my config because I don't trust the programs folder etc.) Could you add more options?

- I'd also like to be able to disable it only for a certain amount of time. Because right now before installing the new update I found it was disabled. (probably because I did this for some reason) And I don't know how long it was in this state. 'xD

Thanks again for your work!

 

Wow Thanks a bunch. You're really nice to us. Appreciated!

Another group of eye-catching additions for ERP v4 was very welcome.

 

@novirusthanks

test23: After several reboots it seemed to work, but then it happened again (which was also mentioned there: #7016)
In addition:
After each reboot the size of the main window has a default size of ~750x582 (variable windowXY in the config)
Setting the main window to a bigger size is working and it is retained for the current session but after the next reboot the size is again 750x582.
All other sizes (Events, Rules, etc.) seem to be retained correctly, but not the size of the main window.

 

CONFIRMED- On this end also Learning Mode switches on/after a reboot-hard reset to ALERT MODE automatically. Not sure but while in Learning Mode previously which indicates in the EVENTS log/screen, after this same reboot-hard reset, there is no log of it having been in Learning Mode previously when it actually was and was showing in the EVENTS log. (not recorded/retained-so not saved either after reboot-hard reset)

CORRECTION-On further examination of the today's RadarPro Logs the Learning Mode was DEFINITELY logged previously in spite that it reverted after reboot-hard reset to Alert Mode.

ANOTHER- Under LOG-If user sets the say "Show Last 250 Entries in Events Tab" and reboots normally-the default "Show Last 500 Entries in Events Tab" becomes the new setting.

Also-Not of big consequence however if changing a WAV file in Sound Effects on/after a reboot it returns back to the previous WAV=Did not save the new WAV setting. Subsequently changing WAV file again-and reboot again- IT DID new audio WAV.

Easily remedied for the time being if that happens by manually overwriting BOTH wav files ALERT.wav & BLOCK.wav in the NVT Program Files folder. Not a biggie at all here but something they may want to correct for others IF FOUND TO BE PERSISTENT for some.

///EDIT- I see what's happening. RadarPro is using/playing the newly selected WAV file for Alert/Block in memory WHEN SELECTED FROM A LOCAL FOLDER (say desktop) but not auto-overwriting to it's own folder. Hope this helps.

(Example) Shut down-close (but not reboot) RadarPro-Restart RadarPro again, go into C:\Program Files\NoVirusThanks\EXERadarPro and manually start Alert.wav-Block.wav to confirm if settings stick or it retains previous Sound Effects.

TEST 23

 

Just wondering. is no one noticing the delay when starting programs when test23 is installed ??

 

I have been suffering from delay when starting programs even before test23.

 

@shmu26

Thx. This is a brand new PC, on my other PC (which was a lot slower) I didn't notice it that much with previous test versions but with this new one it's clearly noticeable.

 

There is no delay for me. I have a very crappy Laptop too.

 

Maybe because your laptop is "crappy" you don't notice the delay

 

Shouldn't even the delay be delayed on my laptop? It is certainly not 1-2 seconds. But let me test this...
Nope, there isn't even more than a few hundred milliseconds delay, if any.

I tested this by deactivating protection, not by uninstalling.
Does anyone know of a way to directly measure that delay? I was just going by feel. (Which accuracy is about 100ms)

 

I will test version 23 on my OLD PC (i7 4770 with Seagate SSHD). I only have tested earlier versions of ERP on that one.

On my new one, I haven't tested it with deactivating protection but just uninstalled it, will try both when I have some time and report back!

 

I can imagine the delay to get bigger the longer the rules list is.
Maybe try filling it with junk from learning mode. I only have 141 rules anyway.

 

Thx, as this was a New Install of ERP I only had a couple of rules (Via learning Mode) when I started noticing it. Maybe it has to do with learning mode ?

Another thing to put on my list to test

 

i have to agree, there is a noticeable slowdown usig ERP. i don't think it's just a difference between test versions, it's there since NVT fixed the popup stopping every other process

 

Wdya mean? That is still the case. I just tested it. No process starts with a popup open.

 

no other process starts? since when? that was fixed ages ago

 

I thought it is a safety feature. But it always annoyed me that I couldn't google about the stuff in the pop-up while it is open.

 

You can be sure that'll be looked at and improved. NVT is rolling TEST models right now of course just for the purpose of gathering what runs well and what needs refinement.

FWIW, on 8.1 specifically with a mere 4 GB of memory (3.82 available it says) ERP v4 in all these runs is not shown me any delays at all in running apps or programs and I am a madman of multitasking sometimes loading this desktop with multiple folders-3 browsers w/ all sorts of open windows.

The only delay I do see is the Alert response from Sound Effects sorta kinda, but not an issue beyond what I already posted about yesterday.

 

I finally had some time to test test 23 on my other PC, there also the delay is noticeable. Still need to test on my New PC with deactivating protection !