WinPatrol v25.0.2012 RC Released

WinPatrol v25.0.2012 Final Released

WinPatrol v25.0.2012 Final Released
Date: July 8th 2012

WinPatrol 25 Learns Lessons from Stuxnet
In recent months we’ve all noticed a change in how malware is introduced on someone’s computer. While the most common entry point remains users making a bad choice, the use of program vulnerabilities is used by more sophisticated malware. The number of Microsoft vulnerabilities being exposed is actually decreasing yet Microsoft was forced to send a number of out-of-cycle Windows security updates last month. Non-Microsoft applications accounted for 71.2% of all publicly known vulnerabilities in the 2nd quarter of 2011.

There’s no Anti-Virus software available that can totally protect you from the variety of vulnerabilities that continue to be exposed by hackers. Even WinPatrol can’t stop all these holes but does everything possible to alert you and help you cleanup unwanted programs. Some of the newest malware sits quietly in the background waiting for a target. One of our goals has always been to make sure you know what’s happening on your system.

Based on the research done on state sponsored malware like Stuxnet and Flame I’ve added two new features which have become popular methods used to hide and disable security programs. These new features are designed to prevent programs from hiding on your system waiting for a target before releasing their full payload.

What's New?
• Uninstall Detection ( NEW! )
The new WinPatrol v25 will track programs that have been installed on your system and will monitor the location Windows uses to store Uninstall information. This location includes the path to the Uninstall command which is often used by malware to remove a program silently. WinPatrol will let you know the names of any programs which are removed. This feature is available to PLUS only users and is optional. Legitimate alerts may occur during software updates or when you choose to remove software.
• Start Program Removed Detection ( NEW! )
All WinPatrol users can benefit from the often requested option of Start program removal. WinPatrol was the first program to let users know if a new auto startup programs had been added. Now WinPatrol will also let you know if another program has removed one of your Startup programs. One of the common behaviors of malware is to reduce the possibility of being detected by Anti-Virus or security software. It’s common for new malware to remove programs from your auto Startup list.
• Delayed Startup Programs
One of our more popular features is the ability to delay the launch of a Startup programs. Our recent sale generated a lot of new WinPatrol users who helped isolate a few bugs in Delayed Start especially on 64 bit versions of Windows. These bugs have been fixed so programs aren’t lost and parameter are properly returned when moving a Delayed program back to its original status.
• Windows XP Kill Task
This bug only affected XP users and even reverting to our v18 code didn’t help resolve a flaw preventing WinPatrol from killing tasks. It turns out Microsoft changed the value of one of the parameter masks used in a function called OpenProcess. The kill task function broke because we updated to newer Microsoft tools in our efforts to better support Windows 7. Sorry to the XP folks that it took this long to find. I can't thank Larry from Microsoft enough for his assistance. This is an important feature because unlike Task Manager, WinPatrol allows you to select multiple programs to kill with one click.
• Company Name, Details and Correct Path
One of the first steps in detecting a suspicious programs is the lack of a company name in its resource. On Windows 64 bit machines not all of the details of programs were available due to a bug I found and reported to Microsoft. It turns out a common Windows function called ExpandEnvironmentStrings won’t always provide the correct path when represented by the environment variable %programfiles%. If you’re using Windows 64 bit you probably noticed there is a "C:\Program Files" path for 64 bit programs and older programs are stored in "C:\Program Files (x86)". A correct path to your program is required to obtain details like a company name. We’ve worked around this bug in Windows.
• Misc Fixes
Anyone who has noticed that Scotty's ability to run on startup was missing will be pleased. There was in fact bug that removed WinPatrol as a Startup program. It wasn't caused by other programs, just programmer stupidity.

More Info l Download: WinPatrol 25

 

Thanks Corrine for the heads up! G

 

FINAL just hit the web wave!!

 

Thanks Gordon & Corrine!

Daniel

 

Got it, thanks.

 

I am a little slow, or either behind...

 

Now, I am current...

 

This has some clever new features. I'm going to start running it resident again and see how it alerts. I'm not aware of any other program that monitors startup and uninstall options in real time.

 

I wonder how this new version does with detecting malware. I know past versions it really didnt do to well.

 

Good update. Thanks

 

Thanks for posting about this update.
Gotta love what Bill has done with WinPatrol over the years

 

Another snapshot, but not behind so far this time.