TrojanHunter 5

I'm currently planning for TrojanHunter 5 and would like some input on the TrojanHunter user interface from the ones who will be using the product - namely you, the users.

Specifically, I would like to know if there's a demand for a more "easy to use" interface. Basically this would mean that scanning could be as simple as just clicking a button to scan the entire computer and would also get rid of most of the more advanced options.

Another aspect I'm looking at is to make detection of suspicious files look less alarming. What I'm thinking is that when "possible trojan files" are found, the user would be told:

- Your scan was clean but we found some files that could potentially be malware

- ...and be presented with a dialog saying "Would you like to submit these suspicious files for analysis and get an email back if we determine them to be malware"?

The reasoning behind this is that I suspect many users don't like to fiddle around with too many options and would mainly just like to scan their system for trojans with the default settings.

Any and all input is appreciated. Also, if there's anything you really like/don't like about the current user interface, be sure to mention it.

 

I agree that simplified interfaces tend to be a good thing, but I think there's a lot of us here that prefer to have advanced UIs as well.. why not have a simplified interface by default, but then have an advanced UI that can be turned on in the preferences, along the lines of what Spybot S&D does? You'd get the best of both worlds that way Now that TDS3 is dead, it would actually be nice if you added some of the same kind of tools for advanced users to do some manual trojan hunting

Personally I never really liked the Outlook style interface in a security app, at least not as the entire UI (I do like it for preferences windows). Something nice and sleek, and well organized would be great.

 

Hi Magnus,

Glad to hear you are continuing to strive for improvements to TrojanHunter. And congrats for bringing Gavin on board to help out....nice job

Since you asked.....as for an "easy to use" interface....Honestly, I think that TrojanHunter 4.2's interface is about THE EASIEST interface of ALL security products I have ever used or tried! I don't see how it COULD be any easier to understand.....without possibly doing away with some of the buttons/options/features that are extremely useful. Even for a novice like myself, I can figure out TH's interface with NO problems what so ever. When the user right clicks the system tray icon OR goes to "Start>Programs>TrojanHunter"....and selects "Run TrojanHunter scanner"...the interface opens, and from there it is simply up to the user to select the "Full Scan" or "Quick Scan" option. I don't think it can get any simpler....unless you want to change the wording to "Open TrojanHunter Interface" and then add another option that says "Run TrojanHunter Scanner" which would automatically default to a "Full" or "Quick" scan that the user could select (prior to running the initial "scan"....with a tickbox to ask if they would like for that selection to be retained for future scans).

I like the "No Trojan Files Found" disclaimer. Perhaps you could add an entry that says "Suspiscious/Unknown Files Found During Scan" with a little disclaimer identified by an asterisk that asks the user "Would you like to submit these files for further analysis? An email with the results will be sent to your email address that TrojanHunter was registered to", and a link/option for the user to select "yes" or "no thanks".

Nice job, please keep up the great work

 

Hi Magnus, personally I would like to keep those advanced options, custom settings but I guess for a lot of others, they want to keep it as simple as possible...isn't there a way to choose? advanced for the 'advanced' and simple for the ones who chooses too? (from the install, having the option: advanced procedure vs. normal/simple procedure...
now I think of it...as long as you keep it as an option I don't mind

automatic "possible" malware submittement would be nice, especialy for yourself I guess, having the latest threats updated from within the program...
I wouldn't care for receiving an email with the results cause that could last for days/weeks ... that's too long for just some confirmation about being infected or not...

like I said, I like those advanced options..now what I would like to see (personally) and I already stated this on your board one year ago when input was appreciated too is that a realtime autostart notification when something is added to those autostart keys and the same goes for that processviewer...you can automatically upload this data that for analysis too so you can make new sigs if those addatations are malware...that would be an enhencement if you ask me and would benefit you, the user and also the more advanced users so they can play a little

best wishes and good luck

 

Forgot to mention in previous post.....one possible addition which I think would be welcomed by a vast majority, would be to have a built-in "Scheduler"....which would allow the user to schedule scans WITHOUT having to use Windows Task Scheduler. Just a suggestion/thought......

 

Thanks for the input!

I think that if I decide on an ultra-easy-to-use interface there would also be an "Advanced mode" button that would bring up an interface similar to the current one.

The layout I'm considering would have a panel on the left side with the following

• Status (the default page, showing update status and last scan performed)
• Scan (where you could select the scan to perform)
• Support (with a link to the FAQ and an "email support" link)
• Update (where you would update or schedule automatic updates)

There would be no options in this layout if I could help it. An "Advanced Mode" menu item would bring out more advanced program and scan options as well as the tools (Netstat Viewer, Process Viewer etc.)

What I'm looking at here is to make it as intuitive as possible for the less computer-versed to perform a scan.

 

another nice option would be:

* Paranoid Mode D) when scanning through Paranoid Mode, all non critical processes will be ended automatically to ensure proper cleaning, faster scanning, and making some sort of Safe Mode but without the hassle lol

 

Already ahead of you; see my last post

 

I'm not so sure about killing processes but I would consider a "Restart computer in Safe Mode" option to perform scans there when dealing with more nasty trojans.

 

yep, that's nice and an automatic Trojanhunter launchement...

if you want it to keep it as simple as possible you could create a 'stinger' tool...that's as easiest as it gets I guess...

an option for netstat: adding the PID + process name ...

 

I agree with most of the previous feedback. Have preset simplified settings for those who like to have their programs ready to run out of the box. Also have an advanced option for folks who like to dig deeper. Also add the option to schedule scans...

 

i would love a free version the same as asquared and ewido has

 

On step ahead of you... haha. I already asked about this and the reply from Mangus...


Me

Mangus

http://forum.misec.net/board/Announcements/1138629799

 

I like this idea. The current interface is pretty simple already, though.

I like the fact that the interface uses standard, well-known Windows design components, and doesn't look like (as someone we all know would say) a skinned Fisher-Price busybox. Applications--and triply so security applications--that use skinned interfaces irritate the hell out of me. I'm talking sand-in-the-eye irritation.

 

How about doing away with that "alternate data stream" thing, I understand that part of this equation, has to do with SP2. Perhaps a button in TH5 could ask "want to take care of, those ADS"

Take care
rico

 

I agree with that assesment. The interface is already very easy, anything much easier will probly look plain dumb

I have a suggestion though: it would be a good thing to make the scanner's display window resizable and the separation bar between "file-tree" view and "malicious events" view movable. Well, you know what I mean.
For instance: I use win98se and when I need to scan in SAFE MODE the screen resolution is set to 640x480 by default - you seriously need to be able to resize the scanner's window under these conditions

 

No more Temp created after scanning - useless crap left on a system, and no need for that at all.

 

Hope it also has a free version like Ewido and A-Squared...

Hope it becomes more lighter on system resources and ram memory...

Hope it focuses more on detecting trojans and not on detecting some other things that others could already detects...

Hope it become more affordable for average users...

Hope the passion on improving this program will not fade through time...

 

that would be a good addition, for example if live trojans are found running in memory TH would offer a chance to automatically reboot into safe mode to do a full scan

also i'd like to see automated deletion of renamed trojan files through the program interface.. or maybe a quarantine folder to move renamed files , as a part of the cleaning process.

 

i think TH is already simple to use, so it doesn't need to be "simplified"..

one "problem" that i noticed is when TH is not set to automatically clean an infection (in THGuard's settings), when you click "clean" (after THGuard has detected an infection), the window that pops up that says that the infection was cleaned is behind the window that tells you that an infection has been detected.. maybe there could be a tweak so that the window that tells you that an infection was cleaned could popup in front of the window that tells you that an infection has been detected..

also, i think that even if TH is set to not "clean" automatically, it should still kill the process in memory (instead of just telling you that a trojan is running), but not automatically "kill" the detected file by renaming it.. speaking of "simplification", that would be a simple way of handling infections, kill the process in memory, then ask the user if they also want the "infection" to be "cleaned" (if they have automatic cleaning disabled)..

also, i noticed that when an infection is cleaned after THGuard flags it, a regkey is left in "startup", unlike when you click "clean" after a manual scan finds an infection, where the regkey is removed.. i don't know if that can be addressed or not..

i don't think there is a need for TH to automatically restart a computer in safe mode, if that is even possible.. the users can do that easy enough.. maybe if the infection cannot be cleaned otherwise, there could be a message advising people to do a scan in safe mode..

 

Let me know asap when you release the Free Home Edition like AVG

 

Hello Magnus

Wow I think you are now looking at some great ideas.

Thank you for thinking about the common home users.

Simple interface with advanced button, low number of pop ups and your idea to
send is possiable maleware to peek at is a great idea. I would not think you would get swampped with people sending in samples unless it were either a real threat or false alarm.

good work

controler