New Antiexecutable: NoVirusThanks EXE Radar Pro

Discussion in 'other anti-malware software' started by sg09, Jun 3, 2011.

  1. Djigi

    Djigi Registered Member

    Joined:
    Aug 13, 2012
    Posts:
    554
    Location:
    Croatia
    Perhaps because the security companies complained or scared of losing their cash cow.
     
  2. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    11,673
    Location:
    The Netherlands
    Actually, strict parent-child process control hasn't got anything to do with HIPS. At the moment ERP allows you to make global rules, but in certain cases it would be handy if you could make process specific rules. For example, certain malware might run the browser to send data. And other malware might launch explorer.exe and svchost.exe in order to perform a process hollowing attack. Obviously, you do not want to be alerted every time that these processes are being launched.

    I use SpyShelter for this, the only problem is that the current implementation drives me nuts. You should be able to fine tune it.
     
  3. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,256
    It may not be HIPS, but it isn't Anti Executable. AE's simply block exe from running, and don't have any parent child process involvment.,
     
  4. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    11,673
    Location:
    The Netherlands
    Actually, you're wrong, it IS a feature related to anti-exe. You can make either global rules, or process specific rules. I already explained why this can be handy. It makes sense to monitor apps that are trying to launch the browser or explorer.exe and svchost.exe, but you can't add these processes to the "vulnerable apps" list, for obvious reasons.
     
  5. bellgamin

    bellgamin Very Frequent Poster

    Joined:
    Aug 1, 2002
    Posts:
    6,445
    Location:
    Hawaii
    PLEASE!!! Let's keep ERP light & simple. It's splendid as it is.
     
  6. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,256
    I whole heartily agree.
     
  7. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    11,673
    Location:
    The Netherlands
    I think you guys are misunderstanding. What I'm proposing would keep ERP simple and light. You could still choose to make global rules, but it would give you an option to also make strict rules. For example, stuff like: Only Windows Explorer is allowed to launch Firefox, and only services.exe is allowed to launch svchost.exe.
     
  8. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,256
    No Rasheed, we get it. You want to make ERP into a HIPS, we want to keep it a simple AE
     
  9. bellgamin

    bellgamin Very Frequent Poster

    Joined:
    Aug 1, 2002
    Posts:
    6,445
    Location:
    Hawaii
    If you want that capability, I suggest you try SpyShelter.
     
  10. mood

    mood Updates Team

    Joined:
    Oct 27, 2012
    Posts:
    14,007
    Rasheed is already using it ;)
     
  11. act8192

    act8192 Registered Member

    Joined:
    Nov 9, 2006
    Posts:
    1,588
    Rasheed,
    At one point, long ago on page 151 of this thread, NVT answered similar concerns. You were on that page as well, so was Peter.
    Take a look at NVT suggestions, in post#3761 for instance, where he answers exact scenarios you just wrote about:
    https://www.wilderssecurity.com/thre...e-novirusthanks-exe-radar-pro.300552/page-151
    Using ERP, am I 100% comfortable with it? Not really, it's not as strict as SSM was, and fileless crapwares are always of concern, but MBAE (in my case) will likely handle that pest. That said, I'd love to see a table with parent and child columns :)
     
  12. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    5,694
    Location:
    Europe then Asia
    Use ReHIPS :p (despite his name i would consider its "HIPS" module more between an anti-exe and a HIPS ), it works more like an anti-exe with parent-children monitoring. and you can edit command lines.

    by using it, i removed 2 of my favorite softs i used to use : Sandboxie and ERP
     
  13. Less is more :), two questions:
    a) any idead when ReHIPS 2 will be released?
    b) why use AppGuard with ReHIPS?
     
  14. Where is the beta available as download?
     
  15. Djigi

    Djigi Registered Member

    Joined:
    Aug 13, 2012
    Posts:
    554
    Location:
    Croatia
  16. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    11,673
    Location:
    The Netherlands
    What part of optional don't you understand? It's like talking to a brick wall. :D

    No thanks, I have read about it, and it's not for me. I don't like the way it does the sanboxing, and SpyShelter already offers child process control. The thing is, I don't want to be alerted about every child process, that's too annoying. So a fine tuning option is needed.

    Yes correct, back then I also thought it wasn't truly needed, but when you read about how a lot of malware operates, it's a good feature to have. Like I said, currently you can not add explorer.exe and svchost.exe to the vulnerable apps list, because that would most likely break the system.
     
  17. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    5,694
    Location:
    Europe then Asia
    What you don't like , it is the Virtual Desktop? ( if that, you just have to untick a checkbox to isolate in real desktop as Sandboxie does).
     
  18. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,256

    Rasheed.

    I fully understand optional, but optional also means hundreds of lines of code for those options and they just bloat the program. It is an ANTI-EXECUTABLE period
     
  19. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    11,673
    Location:
    The Netherlands
    It depends on the skills of the developer, I don't believe this will make it bloated. And in fact, Smart Object Blocker and Bouncer, who are both quite light, already offer this. With the difference that both don't have a user friendly GUI. But anyway, I don't think that ERP will get an update anytime soon.
     
  20. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    11,673
    Location:
    The Netherlands
    Yes, I don't like virtual desktops, but I also prefer virtualization of the file system. That's why I also don't really like SpyShelter's sandboxing feature. It's hard to beat Sandboxie, others have tried it in the past think of SafeSpace, BufferZone and GreenBorder, but they all failed. ReHIPS looks too complex overall, so I will not be using it, also not for the anti-exe feature, ERP is good enough.
     
  21. Nebulus

    Nebulus Registered Member

    Joined:
    Jan 20, 2007
    Posts:
    1,596
    Location:
    European Union
    Yes, but adding features from two light programs to a third one might make enough of a difference that the third might become heavy :)
     
  22. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    5,694
    Location:
    Europe then Asia
    It is what i like in ReHIPS , i like full control of every aspect of the isolated environment (what is isolated, how it is done , what access right and privileges it has, etc...) :D

    indeed , ERP is good enough , with RH i have a 2-in-1 soft, so im happy with it ;)
     
  23. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    11,673
    Location:
    The Netherlands
    This is getting ridiculous, I didn't ask to add a cloud AV, now that would make it heavy. This is a very simple anti-executable feature, that the developer could easily add. Take a look at SpyShelter, it does a lot more than ERP, but is one of the lightest security apps on the market.
     
  24. mood

    mood Updates Team

    Joined:
    Oct 27, 2012
    Posts:
    14,007
    You can't really compare SpS with ERP o_O
    :D
    You are "requesting" that feature all over again ;) (just sayin')
    The answer is everytime: "No. Keep it simple"
     
  25. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    11,673
    Location:
    The Netherlands
    That's not the point. The point is that adding a new feature doesn't automatically makes a program bloated. And it wasn't really a request in my latests post, I just said why it would make sense to add this. Also, I trust in the skills of NVT, I requested an "Install Mode", and it was implemented quite nicely.
     
Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.