New Antiexecutable: NoVirusThanks EXE Radar Pro

Floyd 57 · Sep 3, 2018

PresentationHost.exe is already on excubits' blacklist

Here's a list of Excubits exe blacklist combined with NVT's default 42 vulnerable processes, as well as some custom processes I've added, annotated by !!!

[Bouncer] means the rule is in my Bouncer .ini

aspnet_compiler.exe
at.exe
attrib.exe
auditpol.exe
bash.exe
bcdboot.exe
bcdedit.exe
bginfo.exe
*bitsadmin* [Bouncer]
bitsadmin.exe
bootcfg.exe
bootim.exe
bootsect.exe
ByteCodeGenerator.exe
cacls.exe
cdb.exe
certutil.exe
cmd.exe
!!!cmdtool.exe
!!!control.exe
csc.exe
cscript.exe
csi.exe
cvtres.exe
dbghost.exe
dbgsvc.exe
debug.exe
DFsvc.exe
diskpart.exe
dnx.exe
eventvwr.exe
fsi.exe
fsiAnyCpu.exe
hh.exe
icacls.exe
IEExec.exe
iexplore.exe
iexpress.exe
ilasm.exe
infdefaultinstall.exe
*InstallUtil* [Bouncer]
installutil.exe
java.exe
javaw.exe
journal.exe
jsc.exe
*jscript*.dll* [Bouncer]
kd.exe
*lpkinstall* [Bouncer]
lxrun.exe
*LxssManager*.dll [Bouncer]
!!!Microsoft.Workflow.Compiler.exe
!!!mmc.exe
msbuild.exe
mshta.exe
msiexec.exe
MSPUB.exe
msra.exe
mstsc.exe
net.exe
net1.exe
netsh.exe
netstat.exe
!!!notepad.exe
!!!notepad++.exe
ntkd.exe
ntsd.exe
odbcconf.exe
powershell.exe
powershell_ise.exe
PresentationHost.exe
quser.exe
rcsi.exe
reg.exe
*RegAsm* [Bouncer]
regasm.exe
!!!regedit.exe
regini.exe
*Regsvcs* [Bouncer]
regsvcs.exe
regsvr32.exe
!!!robocopy.exe
rundll32.exe
RunLegacyCPLElevated.exe
runonce.exe
runscripthelper.exe
sc.exe
schtasks.exe
scrcons.exe
script.exe
sdbinst.exe
sdclt.exe
set.exe
setx.exe
shutdown.exe
*Stash* [Bouncer]
syskey.exe
*System.Management.Automation* [Bouncer]
systemreset.exe
takeown.exe
taskkill.exe
UserAccountControlSettings.exe
utilman.exe
vbc.exe
visualuiaverifynative.exe
vssadmin.exe
wbemtest.exe
wevtutil.exe
whoami.exe
windbg.exe
wmic.exe
wscript.exe
xcacls.exe
xcopy.exe

Combine this with my list of unassociated file extensions from the bouncer thread and your PC will be rock-hard!

Of course, if you are like me and you've unchecked every single thing from NVT Exe Radar Pro 4's security settings, namely:

Allow System Files
Allow All Microsoft-Signed Processes
Allow Microsoft Windows "Apps"
Allow All Software From Program Files Folder
Allow All Signed Processes
Allow Known Safe Process Behaviors
Allow Processes Signed by Trusted Vendors

Then you don't need a vulnerable processes list, because everything is not-whitelisted by default, and everything will need to be allowed explicitly to run. This is the GOD mode in NVT Exe Radar Pro 4, where you control everything on your pc, other than processes started before NVT Exe Radar Pro 4's driver, such as wininit.exe or winlogon.exe , but you don't want to block those processes anyway, not with this software

TerryWood · Sep 3, 2018

Hi @ NVT

On my Home tab Version 26 it says I have 243 Processes Analysed, 243 Allowed processes, 0 Blocked.

Yet when I go to the rules tab and screen by Deny it shows 10 Vulnerable Processes denied. Is this correct? How can you have 0 blocked when 10 are denied?

Thanks

Terry

guest · Sep 3, 2018

TerryWood said: ↑

I have 243 Processes Analysed, 243 Allowed processes, 0 Blocked.

Yet when I go to the rules tab and screen by Deny it shows 10 Vulnerable Processes denied. Is this correct? How can you have 0 blocked when 10 are denied?
Click to expand...

This number doesn't depend on how much deny rules you have in the rules tab.
Look at the Events tab. If you see no blocked processes, "0 Blocked" is correct.
As soon as a process is blocked (Action=Deny / Action=Ask/Deny One), the number goes higher.

Floyd 57 · Sep 3, 2018

mood said: ↑

This number doesn't depend on how much deny rules you have in the rules tab.
Look at the Events tab. If you see no blocked processes, "0 Blocked" is correct.
As soon as a process is blocked (Action=Deny / Action=Ask/Deny One), the number goes higher.
Click to expand...

Yeah I wonder what he was thinking, @TerryWood do you have 243 allowed rules?

shmu26 · Sep 3, 2018

novirusthanks said: ↑

+ Fixed saving/loading of Unicode strings on Rules database
Click to expand...

Now that you mention it, I think the exact same issue exists with OSArmor, in custom block rules and exclusions.
For instance, I have a signer like this: Toggl OÜ
But in "exclusions", it appears like this: [%FILESIGNER%: Toggl O?]

Floyd 57 · Sep 3, 2018

shmu26 said: ↑

Now that you mention it, I think the exact same issue exists with OSArmor, in custom block rules and exclusions.
For instance, I have a signer like this: Toggl OÜ
But in "exclusions", it appears like this: [%FILESIGNER%: Toggl O?]
Click to expand...

I mean, it's not like you're gonna encounter malicious file whose signer is named Toggle OO or something like that (thus bypassing your Toggl O? rule)
Perhaps that's how the dev implemented those other languages

And if you do wanna be as close to as 100% safe as possible, then whitelisting by hash, combined with all other stuff, is best (rather than relying on just signer whitelisting for example)

Mr.X · Sep 3, 2018

paulderdash said: ↑

@Mr.X, just curious, is this list based on Excubits' blacklist, and if so, does it take into account latest changes?
Click to expand...

Yes it is and doesn't take into account those latest changes though.

novirusthanks · Sep 3, 2018

A quick update:

Here is a new v4.0 (pre-release) test27:
https://downloads.novirusthanks.org/files/exe_radar_pro_4_setup_test27.exe

*** Please do not share the download link, we will delete it when we'll release the official v4 ***

Build 27
+ Fixed exporting of rules that contain unicode characters
+ On "Trusted Vendors" dialog the column "Signer" now shows the number of items, i.e "Signers (1234)"
+ Fixed Details shown in "File Information" on Alert Dialog are not trimmed
+ Improved "Allow Known Safe Process Behaviors"
+ Minor fixes and improvements

To install it, first uninstall the previous build, then reboot (not really needed but may help), and install the new build.

@Rasheed187

Couldn't reproduce it here, will retry later.

@EASTER

Yes we're discussing that to see how we can implement it now that many processes fields can be combined.

We may show that maybe only for rules that have the process path+name and the hash.

@iammike

Thanks, added now to safe behaviors.

@Cutting_Edgetech

Not added yet, I'll need to better test it to make sure there are no issues and then we can add it in case.

@Mr.X

Thanks for sharing the list.

@shmu26

Good find, will fix that on OSA too in a few days.

guest · Sep 3, 2018

novirusthanks said: ↑

+ Fixed saving/loading of Unicode strings on Rules database
Click to expand...

Rulles/Vendors will be exported to a file which is not in a Unicode format and therefore Unicode characters will get lost.

OS Armor is also affected and Unicode characters will be shown as "?" because the file Exclusions.db and CustomBlock.db are by default not in a Unicode format.
Edit: A new build (test27) has been posted some moments ago, i'll test it again with the new build (Result: Exporting of rules [with Unicode characters] has been fixed).

novirusthanks · Sep 3, 2018

@mood

We posted almost at the same time

Yes that issue with exporting rules is fixed on test 27 (see link on my previous post).

Will fix OSA asap.

Mr.X · Sep 3, 2018

novirusthanks said: ↑

Thanks for sharing the list.
Click to expand...

No problem Andreas.
Btw did you look at my post in the other thread, perhaps yes, but I want to know cause I know you have a lot of work to do and forum's mentions and alerts could be easily mislaid/overlooked. I apologize for the off topic but that matter's so important to me: https://www.wilderssecurity.com/threads/anti-autoexec.393019/#post-2777900

Anything you want to reply do it there please.

EASTER · Sep 3, 2018

@EASTER

Yes we're discussing that to see how we can implement it now that many processes fields can be combined.

We may show that maybe only for rules that have the process path+name and the hash.
Click to expand...

Thanks @novirusthanks for your reply-and also the new 27 test version as well.

@mood- @Mr.X and other contributors- Many and much thanks for your attention to intricate details.

Mr.X · Sep 3, 2018

@EASTER
You're welcome and same for you, thanks for your comments as well.

Mr.X · Sep 3, 2018

SHvFl said: ↑

better make it a continual scrolling?
Click to expand...

Yep! I want this one too!
I completely forgot to mention here...

Cutting_Edgetech · Sep 3, 2018

Mr.X said: ↑

Whether yes or no, I don't wait:

Code:

<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = aspnet_compiler.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = at.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = attrib.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = auditpol.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = bash.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = bcdboot.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = bcdedit.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = bginfo.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = bitsadmin.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = bootcfg.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = bootim.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = bootsect.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = ByteCodeGenerator.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = cacls.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = cdb.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = certutil.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = cmd.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = CmdTool.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = Commit.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = csc.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = csi.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = dbghost.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = dbgsvc.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = debug.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = DFsvc.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = diskpart.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = dnx.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = eventvwr.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = fsi.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = fsiAnyCpu.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = hh.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = IEExec.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = iexplore.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = iexpress.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = ilasm.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = infdefaultinstall.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = InstallUtil.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = journal.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = jsc.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = kd.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = lpkinstall.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = Microsoft.Workflow.Compiler.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = mmc.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = MSBuild.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = mshta.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = msiexec.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = msra.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = mstsc.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = netsh.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = netstat.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = ntkd.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = ntsd.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = odbcconf.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = powershell.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = powershell_ise.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = PresentationHost.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = quser.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = rcsi.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = reg.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = RegAsm.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = regini.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = Regsvcs.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = regsvr32.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = RunLegacyCPLElevated.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = runonce.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = runscripthelper.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = schtasks.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = scrcons.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = script.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = sdbinst.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = sdclt.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = set.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = setx.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = Stash.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = syskey.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = systemreset.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = takeown.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = taskkill.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = UserAccountControlSettings.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = utilman.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = vbc.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = visualuiaverifynative.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = vssadmin.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = wbemtest.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = windbg.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = wmic.exe] [Action = Ask]</> <enabled>1</> <comment></>
<category>Vulnerable Processes</> <action>Ask</> <expression>[Proc.Name = xcacls.exe] [Action = Ask]</> <enabled>1</> <comment></>

Click to expand...

I already have it on my list also. I've never seen it used except by malware. I would have to do some digging to find out what users may need it.

Mr.X · Sep 3, 2018

I fully uninstalled test26 as usual plus manually deleting any leftovers and installed test27 but can't import my backed up rules. Is that happening due to the XML file encoding? I can see my back ups are ANSI and new XML file is encoded as UCS-2 LE BOM.

Mr.X · Sep 4, 2018

Re-encoding Rules XML file (back up) to UCS-2 LE BOM did the trick as I was able to re-import my rules and ERP's happy again...

EASTER · Sep 4, 2018

Amazing

Cutting_Edgetech · Sep 4, 2018

I've been using test 27 all day on Windows 10 x64 version 1709. No problems to report so far.

guest · Sep 6, 2018

SHvFl said: ↑

@novirusthanks Also i believe the setting block processes executed from usb devices shouldn't follow trusted vendors and vulnuerable processes rules. It should block every parent and child process regardless.
Click to expand...

+1,or at least put a tickbox.

Floyd 57 · Sep 6, 2018

guest said: ↑

+1,or at least put a tickbox.
Click to expand...

Covered by OSArmor's "block processes executed from USB" since there's no Trusted Vendors there (not by default at least, you can make exclusions for Signers which is kinda the same thing)

EASTER · Sep 7, 2018

guest said: ↑

+1,or at least put a tickbox.
Click to expand...

+1

guest · Sep 7, 2018

Floyd 57 said: ↑

Covered by OSArmor
Click to expand...

This is ERP here...
If you use ERP, you don't necessarily needs or want to use OSA.

Floyd 57 · Sep 7, 2018

guest said: ↑

This is ERP here...
If you use ERP, you don't necessarily needs or want to use OSA.
Click to expand...

But you should use it anyway cuz it's THAT good Realistically, if you're using NVT ERP, that means you need/want an anti-exe (and it's not like you have a huge choice either), and if you need an anti-exe, OSArmor is a perfect addition. Like, when would you need to use NVT ERP without OSArmor being a great boost in security in addition to it? Unless you're like me using NVT ERP's GOD mode, and even then OSArmor doesn't hurt cuz it's just so light it might as well not be there in terms of performance, then yeah

I just can't think of a situation where a PC will lack NVT ERP's security protections, but will "have" OSArmor's, so to speak, maybe you know one
And if that's the case, then the person using/setting up the PC is (supposedly) knowledgeable enough to work around your proposed "drawback" (putting the quotes cuz of everything I said)

I'm sure the dev will implement what you're saying sooner or later, I'm just saying that in the meantime you should use OSArmor, it's just a great product without any performance drawback whatsoever, you're losing out if you're not using it

guest · Sep 7, 2018

@Floyd 57 I dont say it is not useful or working to have both OSA & ERP, just that in a ERP thread giving a solution to a feature request by pointing to another software is not what we want or need.

The way you replied is like you go in a restaurant and order a steak then you ask "may i have some sauce?" then the waiter said "you should go to the restaurant next to us, they have sauce"...
Got my point?

Floyd 57 said: ↑

But you should use it anyway cuz it's THAT good Realistically, if you're using NVT ERP, that means you need/want an anti-exe (and it's not like you have a huge choice either), and if you need an anti-exe, OSArmor is a perfect addition.
Click to expand...

My main security solution is AppGuard (an SRP), i use ERP and/or OSA alongside it mostly to cover a specific situation.
If you read my signature, you would have noticed that i use OSA already (since its first release, btw).

Like, when would you need to use NVT ERP without OSArmor being a great boost in security in addition to it?
Click to expand...

you can have a more granular control of the system with ERP than OSA.
OSA, which is originally oriented to Average Joe (unlike ERP), have pre-made rules which are set as default or can be activated via a checkbox. In ERP, you must "create" them.
ERP will prompt for every executable launched, while OSA will directly block those not in its list.
As you said there is no harm to use both together if people like to (i do in 2 of my systems) but with ERP you don't need OSA.

I just can't think of a situation where a PC will lack NVT ERP's security protections, but will "have" OSArmor's, so to speak, maybe you know one
Click to expand...

yeah i know plenty: for people who can't handle ERP prompts, reason of existence of OSA, because prompt-less.
OSA is set and forget, ERP isn't at all.

And if that's the case, then the person using/setting up the PC is (supposedly) knowledgeable enough to work around your proposed "drawback" (putting the quotes cuz of everything I said)
Click to expand...

Remember some of us are long time beta-testers, we don't think just about our point of view, needs or knowledge, but we have to put ourselves in place of a more classic user.
A classic user may not need/know OSA but still need ERP to block all process launching from USBs even if part of the TVL and rules.

Log in or Sign up

New Antiexecutable: NoVirusThanks EXE Radar Pro

Floyd 57 Registered Member

TerryWood Registered Member

guest Guest

Floyd 57 Registered Member

shmu26 Registered Member

Floyd 57 Registered Member

Mr.X Registered Member

novirusthanks Developer

guest Guest

novirusthanks Developer

Mr.X Registered Member

EASTER Registered Member

Mr.X Registered Member

Mr.X Registered Member

Cutting_Edgetech Registered Member

Mr.X Registered Member

Mr.X Registered Member

EASTER Registered Member

Cutting_Edgetech Registered Member

guest Guest

Floyd 57 Registered Member

EASTER Registered Member

guest Guest

Floyd 57 Registered Member

guest Guest

Log in or Sign up

New Antiexecutable: NoVirusThanks EXE Radar Pro

Floyd 57 Registered Member

TerryWood Registered Member

guest Guest

Floyd 57 Registered Member

shmu26 Registered Member

Floyd 57 Registered Member

Mr.X Registered Member

novirusthanks Developer

guest Guest

novirusthanks Developer

Mr.X Registered Member

EASTER Registered Member

Mr.X Registered Member

Mr.X Registered Member

Cutting_Edgetech Registered Member

Mr.X Registered Member

Mr.X Registered Member

EASTER Registered Member

Cutting_Edgetech Registered Member

guest Guest

Floyd 57 Registered Member

EASTER Registered Member

guest Guest

Floyd 57 Registered Member

guest Guest

Useful Searches