New Antiexecutable: NoVirusThanks EXE Radar Pro

Hi Guys, after some time we've released an update for Driver Radar Pro (I updated the thread on Wilders), so now we're going to finish ERP, fixing the remained bugs reported by users. Sorry for the delay and absence, we just had a super-busy time with other projects, updating all the other apps that had issues with Windows 10, etc. I'll be present here from now on

 

Welcome back... I was kind of panicked for your absence

 

@novirusthanks

Everyone here loves NVT ERP ... so when you are absent we are forlorn and start thinking all sorts of bad things ... LOL !

 

Great to see you back!

 

Many thanks Andreas!

 

Welcome back, I really like it very much, thanks!

 

welcome back Andreas, now...

"Release the Kraken !!! "

ERP is the Kraken , the apps that every malwares fears

 

Why these similar files (because they are the same program different versions/hashes) are not detected by ERP?
Note that I already have a rule under WhiteList:
C:\Program Files\wumt\wumt_x64.exe 72FB5CE95A4A4B816DC3AAD9FFD5CFF9

After upgrading for every new version ERP just let it run without blocking or warning though.

References and dowload:
http://forums.mydigitallife.info/th...iTool/page13?p=1161402&viewfull=1#post1161402

Edit:
My current settings:

View attachment 251230

 

You are running it from program files - which is whitelisted folder (default setting).

Settings > General > "Allow software from Program Files folder"

 

Oh, I missed to post my current settings:



So I'm not allowing anything from that location by default.

 

@Mister X

On the events what there is wrote under the "Action" column ?

It should specify why that exes are allowed, like Allowed [Whitelist].

If it says Allowed [Whitelist] it means the exes are not different\changed (same hash).

 

It says [Whitelist Commandline] but for sure hashes have changed.

 

What is the command-line used by that program ?

 

"C:\Program Files\wumt\wumt_x64.exe"

I can't recall correctly but if I mistakenly whitelisted that program when clicked on "WhiteList Command-Line" instead of "WhiteList Process" back in time, could this be the reason why ERP is allowing it?

 

Yes. Welcome back and glad that you got to take a break for a change. As everyone else always looking forward to the latest efforts on any of the programs. You guys Rock!

 

@novirusthanks - Apologies if this has been reported before, but under Whitelist>Applications, if one attempts to sort on Date/Time it sorts on the dd-mm-yyyy, should be yyyy-mm-dd.

 

@novirusthanks

If I add a *.dll to vulnerable process list, will ERP alert to it's loading or execution ?

I want to monitor dfshim.dll.

 

I agree the displayed date should be dd-mm-yyyy time, but when one clicks on the column header to sort most recent for example, the sorting should be yyyy-mm-dd time, else the result is incorrect e.g. 2015 and 2016 entries are interspersed.

 

You can add *.dll to vulnerable processes. However, that doesn't mean ERP will monitor and alert to their loading\execution.

That is why I posted question to @novirusthanks.

 

Mine is same, but I can still add *.dll.

Just select the *.dll you wish to add.

FYI: I am using NVT ERP on W8.1 64-bit.

You have to know the name and file-path of the *.dll you wish to add to vulnerable processes, but I think doing so is useless.

Not sure.

Hope get answer from @novirusthanks.

 

When clicking on Date/Time column header to sort ...

 

Strange - must be some setting in Windows then.

 

@novirusthanks

Bug\Quirk

W8.1 Home x86-64 - Clean Install

Install Kingsoft WPS to C:\Program Files (x86), but ERP shows it as C:\Program Files.