New Antiexecutable: NoVirusThanks EXE Radar Pro

Discussion in 'other anti-malware software' started by sg09, Jun 3, 2011.

  1. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    19,295
    Excellent 1st impression. Ran the tests you asked for and they were successful. Tonight ran in a Win 7 VM. Tomorrow I will restore my Desktop Win 10 x64 FCU and test on that.
     
  2. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    4,046
    Location:
    Europe then Asia
    @novirusthanks

    1- I see that ProcPermitDialog on taskbar can't be closed, supposedly or not? @Peter2150 @Mister X @mood , do you have this behavior too?

    2- Windows default's Metro Apps like Calculator, Mail, etc...aren't whitelisted by default, could be a no go for some people.
     
    Last edited: Oct 23, 2017
  3. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    19,295
    On no.1 yes I am seeing it also.
     
  4. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    4,046
    Location:
    Europe then Asia
  5. mood

    mood Updates Team

    Joined:
    Oct 27, 2012
    Posts:
    3,055
    Issues:
    1) The alert dialog is not the topmost window and it is "hidden" behind other windows
    2) Moving the scrollbar in "Events" is smooth, but it is the opposite in the file dialog "Expression Builder / Read Data from file". There it is jerky, and sometimes the scrollbar doesn't move after a click on the small arrow buttons of the horizontal or vertical scrollbar.
    3) "Rule Editor - Categories": The category "Alert Dialog" is a category which cannot be edited or deleted. I guess this was the intention of the developers. In this case the "Edit" and "Delete" button should be greyed out.
    4) After a right-click on the tray-icon and "Exit", a memory leak has occured. Details:
    An unexpected memory leak has occured. The unexpected small block leaks are:
    29 - 36 bytes: TChangeLink x 25, UnicodeString x 10
    37 - 44 bytes: UnicodeString x 10
    45 - 52 bytes: UnicodeString x 2
    61 - 68 bytes: TBitmap x 15
    117 - 124 bytes: TBitmapImage x 15
    133 - 140 bytes: UnicodeString x 3
    189 - 204 bytes: TMenuItem x 25
    ProcPermitDialog.exe has exited with a Exit Status of 0x0, but after that i can see 3 Process Creations and 3 Process Terminations in a row:
    Rightclick on the tray-icon & Exit:
    [Process Termination]
    Process: C:\ProcPermit\ProcPermitDialog.exe
    Exit Status: 0x0
    3x:
    [Process Creation]
    Process: C:\ProcPermit\ProcPermitDialog.exe
    Parent: C:\ProcPermit\ProcPermitSvc.exe
    3x:
    [Process Termination]
    Process: C:\ProcPermit\ProcPermitDialog.exe
    Exit Status: 0x0

    Confirmed
     
  6. mood

    mood Updates Team

    Joined:
    Oct 27, 2012
    Posts:
    3,055
    Issue:
    (Events) If a column is too small to show the whole content, a tooltip is displayed. That's fine, but the same tooltip is shown for all other events.
    a) "Microsoft Windows Pu..." can be seen on the screenshot, but it is "Microsoft Windows Publisher". If i hover of this name with the cursor, a tooltip can be seen.
    b) Now i move my cursor over to a different name (Nir Sofer), and now i see the same tooltip :cautious: (Expected Result: no tooltip)
    ERP_tooltip.png
    It seems it is showing the tooltip of the selected event for all other events too.
    The only column which is showing correct tooltips is "Date/Time"
     
  7. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,559
    Location:
    The etherlands
    Thanks Andreas. Will do some tests later today on second Win 10 Pro x64 v1709 16299.19 machine, though I doubt I will pick up anything more than the illustrious @Umbra, @mood, and @Peter2150 (no particular order) ;).
     
  8. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    4,046
    Location:
    Europe then Asia
    Confirmed

    Not on my side

    confirmed, several clicks on the arrow are sometimes needed.

    you have to go to > Edit Expression > Read Data from File > select a file, then the rule is created and editable.


    not happened (yet) on my side.

    1- A right click context menu for selected rule in the Rules tab will be appreciated.
     
  9. novirusthanks

    novirusthanks Developer

    Joined:
    Nov 5, 2010
    Posts:
    756
    Location:
    Italy
    Thanks for testing guys =)

    I could reproduce all reported issues, including the memory leak.

    @mood

    Do you mean these scrollbars (when selecting an exe file via "Read Data from file"):

    open-file-scrollbars.png

    @Umbra

    Yeah, we may pre-add a rule like this to allow all MS Windows Apps:

    Code:
    Process -> Path -> Like to -> C:\Program Files\WinodwsApps\Microsoft.*
    Parent Process -> Signer -> Equal to -> Microsoft Windows Publisher
    (OPTIONAL) Parent Process -> Name -> Equal to -> C:\Windows\System32\svchost.exe
    
    rule-windows-apps.png

    We can switch to SHA256 on the next builds.

    That is a bug, will be fixed on second release.
     
    Last edited: Oct 24, 2017
  10. ichito

    ichito Registered Member

    Joined:
    Jan 14, 2011
    Posts:
    1,620
    Location:
    Poland - Cracow
    Thanks Andreas for sharing :thumb:
     
  11. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,559
    Location:
    The etherlands
    And on Events e.g. 'Add process to whitelist' as in v3, etc.

    But I suppose these niceties ('Other options') will be included later.

    Looking good though!
     
    Last edited: Oct 24, 2017
  12. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    4,046
    Location:
    Europe then Asia
    Great !

    Yeah that should work.

    I have to say the GUI is very clean and simple, very easy to navigate. I wish a "dark" theme :p
     
  13. Overkill

    Overkill Registered Member

    Joined:
    Mar 16, 2012
    Posts:
    2,206
    Location:
    USA
    Can I test this in shadow mode or does it need to be rebooted after install?
     
  14. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,559
    Location:
    The etherlands
    Should be OK. No reboot required.
     
  15. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    4,046
    Location:
    Europe then Asia
    No reboot, just a service starting.
     
  16. Overkill

    Overkill Registered Member

    Joined:
    Mar 16, 2012
    Posts:
    2,206
    Location:
    USA
    Great! Thanks
     
  17. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    4,046
    Location:
    Europe then Asia
    @Overkill just follow the procedure, all is explained in the .txt file
     
  18. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,559
    Location:
    The etherlands
    Do you mean right-click, exit? Works here.
    Vertical: Works if you click above or below the scroll bar, but can't 'drag' it up or down ...
    Horizontal is fine.
     
  19. Djigi

    Djigi Registered Member

    Joined:
    Aug 13, 2012
    Posts:
    530
    Location:
    Croatia
    How is working with SUA? All problems from last version is solved or not?
     
  20. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,559
    Location:
    The etherlands
    @Umbra?
     
  21. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    19,295
    There is no last version to compare to. Totally new and not finished
     
  22. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,559
    Location:
    The etherlands
    IIRC @Umbra previously said v3 did not work under SUA, just wondering if he experiences same with v4.
     
  23. Mister X

    Mister X Registered Member

    Joined:
    Aug 10, 2013
    Posts:
    2,935
    Location:
    Mexico
    Why the Universe treat me like this? Am I paying a huge debt? :argh: :p

    Having many many days free to beta test something important as ERP, I've been working installing a customer's machine since yesterday and got no time for beta testing at all.

    Sorry Andreas, I'll start testing asap but as @paulderdash said, what else could I find they haven't did? /sad.
     
  24. novirusthanks

    novirusthanks Developer

    Joined:
    Nov 5, 2010
    Posts:
    756
    Location:
    Italy
    Yes, it is a bug, will be fixed on second release.

    The issue is when you minimize the GUI (or click on the "X" icon on the top-right), the GUI's icon remains in the taskbar and can't be closed. It will be fixed on the second release.

    Yes, we will re-introduce some of the right-click options on next builds.

    @Mister X

    No worries :)
     
  25. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    4,046
    Location:
    Europe then Asia
    v4 works great on SUA :thumb:, all my observations above are on SUA.
     
Loading...