Malware Defender - New HIPS from China

There's no need to team up, wat0114. I'll play with MD in my spare times and you'll probably see a ruleset next year.

 

Malware Defender 1.2.2 beta1 is released

The beta version is available for download at http://www.torchsoft.com/download/md_setup_1.2.2_b1.exe

what's new?
- Added support for jumping to the same registry key in HKLM or HKCU by context menu.
- Added "Go To Referenced Key" command to the context menu of registry editor when the selected key or value contains a valid ProgID or ClassID.
- Added "Open Containing Folder" command to the context menu of registry editor when the selected key or value contains a valid folder or file path.
- Added "Open URL" command to the context menu of registry editor when the selected key or value contains a URL.
- Added support for logging related data of actions. (command line, handle name, hook type, etc)
- Added new built-in registry rules to protect against changing files and folders settings of explorer.
- Changed execute permission of system application to "Ignore" if it is "Ask".
- Fixed a bug when creating rules in learning mode.
- Fixed a display bug in autostart manager.
- Fixed a bug when parsing registry path in address bar.

Known issue:
1. There is a bug in "logging related data of actions" feature. If the action is "Set registry value" and the value data is binary, the data is not converted to string.

 

This beta is running stable on my computer. I installed it "on top."

 

This beta is running fine here too (on XP Pro sp2).

And I find it great news seing you incorporated some of the nice RW's features in this MD's build. As Malware Defender is already neat right now, your deep knowledge of windows' registry arcane inners and your continue support dedication to squash any reported bug put a reassuring feeling and enrich my confidence in this classical HIPS brilliant futur!

 

Malware Defender 1.2.2 is released

The new version is available for download at http://www.torchsoft.com/download/md_setup.exe

what's new since the beta1?
- Fixed a bug when logging "Set registry value" action.

 

Keep rollin 'em out

Excellent HIPS

 

I'd be very interested in this, hopefully MD will have outbound network access protection before you complete your ruleset.

 

I've been using Malware Defender for 2 weeks now and have found that I cannot run chkdsk on reboot. The 2nd index check stops at around 60% with an "unidentified error". If I disable Malware Defender and set it to not start with Windows, my chkdsk on reboot will run without a problem. I tried setting chkdsk to "Grant Full Permissions" in Malware Defender without any success. Has anyone else encountered this problem?

Jetico Firewall also flagged Malware Defender yesterday trying to connect to 65.54.87.117 and 65.54.87.118. Does anyone know what these outbound requests are for?

Thanks in advance for any help!

 

65.54.87.117
cds114.sjc9.llnw.net

65.54.87.118
cds115.sjc9.llnw.net

65.52.0.0 - 65.55.255.255

Microsoft Corp
One Microsoft Way
Redmond
WA
98052
United States

 

MD by default verifies file signatures automatically by contacting Microsoft's servers (including those your firewall identified).

Nick

 

Nice find spidey. I see a similar problem on Vista. With MD in learning mode, when I run chkdsk /f and reboot, chkdsk hangs at 7% of "Stage 1 of 3". It eventually times out and Vista loads. If I disable MD's startup, chkdsk completes normally.

Nick

 

Thanks for the IP info Einsturzende and nick s. I've been using CyberKit for years to do nslookups and didn't recognize the hostnames. I'm going to start using IPNetInfo to do whois lookups from now on.

 

I didn't mention in my original posting that my issue with chkdsk is on XP. Did you try changing anything in your rules to fix the issue in Vista? I tried everything I could think of and still no luck. I also have started having problems with ERUNT's autobackup failing. I'm still trying to determine if that's being caused by Malware Defender or not.

 

To spidey and nick_s: Thanks for the information. I will check the problem.

 

When troubleshooting MD, I apply learning mode first. Learning mode should not break anything. If it does, then playing with rules will probably not help.

Nick

 

The Spanish version of MD is available now!

Thanks Carlos Rodríguez for the great work.

http://www.torchsoft.com/download/md_setup_esn.exe

 

nick s, xiaolin,

.... Does "verfiying file signatures" with Microsoft, mean that its checking that the Windows System Executables are properly "signed" with certificates or does it mean something else ?

.... What happens if you often use your pc without being connected to the internet ?

 

Thanks!!!

 

MD check the file signatures of all executables, not only Windows system executables. If the file pass the verification, it means the file is signed with certificate of the vendor.

MD use the APIs which provided by Microsoft to verify file signatures. If an internet connection is unavailable, MD may failed to verify some files.

 

I don't want security software to call out to companies like this. That is one of the reasons that I have security software in the first place to keep out the snoopy corporate world.

 

MD's "calling out" is optional. You can disable kernel symbol download/updates when you first install MD. You can also toggle off file verification via Tools > Options > General. You will diminish MD's shield by doing so. I would keep both enabled.

Nick

 

Thanks for the info nick s

I think I would prefer call outs to servers outside my machine to be turned off by default
and then give me the option to turn it on if I felt I wanted that.

 

Malware Defender 1.2.3 beta1 is released

The beta version is available for download at http://www.torchsoft.com/download/md_setup_1.2.3_b1.exe

what's new?
- Fixed a bug that may cause chkdsk error when startup.
- Fixed a bug when creating rules for named pipe in learning mode.
- Added support for resizing the registry rule dialog box.
- Changed the default setting of "Allow signed applications to be run by system applications" to unchecked.
- Other Minor improvements.

 

Re: Malware Defender 1.2.3 beta1 is released

-Can be install over 1.2.2 ?

-I also noticed that if write permition rule put ask on Global Registry Rule (*)
automatically log all,but log box unchecked ?

 

Re: Malware Defender 1.2.3 beta1 is released

I installed over top with no problems so far.

I confirm this with latest beta. Personally I would leave this rule at the default "Permit", otherwise alerts will be almost non-stop.