pe guard

Discussion in 'other anti-malware software' started by simisg, Sep 19, 2009.

Thread Status:
Not open for further replies.
  1. trismegistos

    trismegistos Registered Member

    Joined:
    Jan 29, 2009
    Posts:
    363
    Have anyone tried testing this against any MBR malware for e.g. the Killdisk trojan?
    Does it offer protection from low-level disk access or direct disk access?

    Does it have any kernel hooks just like any Classical HIPS or application control firewall or does it use only kernel mode drivers like Sandboxie?
     
  2. MICRO

    MICRO Registered Member

    Joined:
    Jun 8, 2004
    Posts:
    1,020
    Installed PEG OK and not many warnings at all for a few days but today I
    went to download a couple of Apps. from Snaps. and appear to have hit a snag - As downloading the first App. began PEG warnings popped up and I clicked to Allow multi times but they constantly popped up so I must have been clicking the wrong item - After 1.85 MB completed downloading I checked and the size downloaded was 633 KB's - I then downloaded another App. 430 KB's
    but once it completed I checked to find only 60 KB's.

    Exited PEG and downloaded both Apps. and their correct sizes before switching PEG back on.

    Can anyone advise please re. the downloading situation from a legit. site
    how best and easiest to handle PEG without the need to switch it off ?
     
  3. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Found out that mchInjdrv.sys is being used by something legit.


    winHole7 + opaida

    Thanx for the detailed info + the update.

    trismegistos


    Well it would be Brilliant if it could help protect against an MBR nasty, but i wonder ?

    I ran Rku/Gmer/Icesword and didn't notice any hooks. I think it's probably more like an AntiExe + type App.

    MICRO


    I also noticed PEG intercepting downloads, and had to click allow a number of times. This is actually quite clever, but can be frustrating. I've decided to disable it in future whilst i download something i expect to be safe. Don't know of any other App that does this, so as far as know it's a first for PEG !
     
  4. PROROOTECT

    PROROOTECT Registered Member

    Joined:
    May 5, 2008
    Posts:
    1,102
    Location:
    HERE ...Fort Lee, NJ
    StevieO thank you to kindly note the content of my Post #63 dealing of MchInjDrv.sys .


    PROROOTECT
     
  5. opaida

    opaida Registered Member

    Joined:
    Sep 25, 2009
    Posts:
    161
    jmonge
    I don't think you have to download the update, because it was
    enough 20 sec countdown with you :p
    The update only in the countdown timer.

    trismegistos
    sorry, I am not sure about direct disk access!!o_O

    MICRO+StevieO
    it's better to put PEG in normal mode when downloading an PE file.
     
  6. Warklen

    Warklen Registered Member

    Joined:
    Jan 17, 2009
    Posts:
    112
    OSSS will do this. Very powerful HIPS cant wait for the final version.
    PE Guard seems to be a nice little app as well.
     
  7. winHole7

    winHole7 Registered Member

    Joined:
    Sep 24, 2009
    Posts:
    12
    Hello to all,

    @opaida
    Thanks a lot for your explanations... and for the updated timer function !
    ... And your English isn't worse than mine ;)

    @StevieO
    Not too far from the truth... :p

    @trismegistos
    As StevieO said, "PEG.sys" seems to be a kernel mode driver... (no hook and not hidden)

    It seems that "PEG" only protects different executable type [*.exe], dynamic-link library executable type [*.dll] and driver [*.sys] files against a process that tries to get a write access to them.
    As it may be a legitimate one (SuperCopier, Eraser...) or a bad one (malware...), we just need to pay attention to what is good (allowed) and what isn't (revoked/prevented)...
    About the downloading; I never switch to "Normal GUARD" but I verify the process (that requests a write access) and the (downloaded) file and, if it's okay, I check "Apply to this pair always." then I click on "ALLOW" so, I only get one warning by downloaded file. But, it may be annoying when someone is downloading a lot of files.

    Salutations...
    _ernestoG_
     
  8. MICRO

    MICRO Registered Member

    Joined:
    Jun 8, 2004
    Posts:
    1,020
    I shall do the same, switch PE off while downloading a safe App. -Opaida says to switch PE to Normal but only refers to if downloading a PE file ?

    The other problem I have is that on startup a little Gigabyte App., a
    Dynamic Energy Saver starts up, and every morning I click PE's Allow, no good and then
    Allow this pair, and Allow this Process, but every morning I need to go through the same ritual - Would it be a fact that PE can't remember ? or am I still not hitting the correct Allowings ?
     
  9. NormanF

    NormanF Registered Member

    Joined:
    Feb 20, 2009
    Posts:
    2,742
    It really is a stand alone HIPS with a small footprint. Its a set and forget it HIPs. After that, the doors to your PC should be locked shut to the entry of malware!
     
  10. NormanF

    NormanF Registered Member

    Joined:
    Feb 20, 2009
    Posts:
    2,742
    That's exactly what an HIPS should do. If you need to download a legitimate program or install system updates, just disable it temporarily and turn it back on when done!
     
  11. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    exactly:)
     
  12. Joeythedude

    Joeythedude Registered Member

    Joined:
    Apr 19, 2007
    Posts:
    519
    Hi opaida

    Thanks for posting here and for the application.

    I have a few questions :

    1.
    How do you recommend using this ?
    Would it be to Enable it when surfing , and turn it off afterwards ?

    2.
    Does it scan inside files for the characteristics of executable programs , or does it check file extensions ?


    Thanks
    J
     
  13. Habakuck

    Habakuck Registered Member

    Joined:
    May 24, 2009
    Posts:
    544
    Did anyone tested it in 64-bit environment?

    I am very interessted in PEG cause i searched for something like this!

    I do not have the opportunity to test it on 64-bit by myself so if anyone could do that i would be very thankful.


    Good to have you here opeida!

    Very nice project! :thumb: Thank you so far.

    My best wishes.
     
  14. cheater87

    cheater87 Registered Member

    Joined:
    Apr 22, 2005
    Posts:
    3,262
    Location:
    Pennsylvania.
    WOT gives it a green rating. :)
     
  15. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    in one of my pc i am running PeGuard and DefenSewall ;) it looks rock solid:thumb:
     
  16. NormanF

    NormanF Registered Member

    Joined:
    Feb 20, 2009
    Posts:
    2,742
    You just set it and forget it. You only disable it when you need to download a legitimate program or run system updates. Its designed with noobs in mind since unlike with a classical HIPS, there are no configurable options. Its not an AV product since there are no definitions to update - it never needs to be updated.
     
  17. cheater87

    cheater87 Registered Member

    Joined:
    Apr 22, 2005
    Posts:
    3,262
    Location:
    Pennsylvania.
    What type of malware is it good and not good at blocking?
     
  18. NormanF

    NormanF Registered Member

    Joined:
    Feb 20, 2009
    Posts:
    2,742
    As its name indicates - it blocks executable files - files that have to run on your computer whether its malware or a rootkit. If you don't grant it permission, it dies right there. Pretty good protection alongside any AV and anti-malware product you may have. It keeps the bad stuff out and allows you to decide what can be safely run on your PC. Its small, lightweight and powerful - and you can't beat the price. And it will never need an update.
     
  19. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    alot of stuff;)
     
  20. arjunned

    arjunned Registered Member

    Joined:
    Apr 1, 2008
    Posts:
    191
    This is really an awesome application.
    Cheers opaida! :D
     
  21. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    agree,i am going to put it in all my pcs with defensewall:)
     
  22. opaida

    opaida Registered Member

    Joined:
    Sep 25, 2009
    Posts:
    161
    MICRO
    I save the selected actions in PEG.sys, so when you shut down your computer they will be cleared.!!

    Joeythedude
    1.
    when surfing put it in POWER mode, when downloading/installing/copying a trusted PE file put it in NORMAL mode.
    And as NormanF said, run it and forget it.
    2.
    As a first version, PEG checks file extension only.
    And I beleive that enough, because I don't think there is a virus will check for PEG existing to copy itself with another extension.
    Habakuck
    I am really don't know :D .
    Alos, I dont have the opportunity to test too.
    cheater87
    Mainly, it protects PE files from being injected.
    Alos, it prevents any PE file to enter your computer without your knowledge.
    jmonge, NormanF and arjunned
    THX all :)
    Opaida.
     
  23. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    any updates coming soon?thanks
     
  24. NormanF

    NormanF Registered Member

    Joined:
    Feb 20, 2009
    Posts:
    2,742
    As the author stated, no updates are necessary or required. Its not traditional AV or anti-malware that requires definition updates. The job of PE Guard is to block executable files that could harm your PC from being downloaded/running.
     
  25. galileo

    galileo Registered Member

    Joined:
    Dec 10, 2005
    Posts:
    72

    @opaida:

    Suggestion: when downloading/installing/copying have PEG pop-up with an offer (YES or NO) to switch to NORMAL mode...and then have it automagically switch back to POWER mode when the action is completed...;)

    User friendliness is always a good thing...

    galileo
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.