Crystal Security 3.5

[Av Gurus]

I put it on Windows 10_x64 on my Virtual machine and it's working fine

 

[Kardo Kristal]

I put it on Windows 10_x64 on my Virtual machine and it's working fine

Thank you for the feedback. @Av Gurus

Regards,
Kardo

 

[OokamiCreed]

RAM usage idles at 35MB or less and goes upto around 45MB while browsing. CPU (even when doing advanced scanning - including while it is classifying files) stays below 3%. Sometimes however it will jump to 13% but only for a few seconds. This does not happen while it isn't scanning. I haven't seen it jump while doing a quick scan however.

While browsing:

While scanning:

 

[Deleted member 2913]

Why portable & installer both?
Whats the difference?

Can be used standalone or secondary only?

 

[Av Gurus]

Any settings (tips) for skiping UAC prompt?
I set Crystal Security to start with Windows.

 

[jamescv7]

Any settings (tips) for skiping UAC prompt?
I set Crystal Security to start with Windows.

Spoiler: A bit lengthy of steps, Task Scheduler is a handy at all ;)

http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html

 

[viktik]

Manual Scanning using context menu does not open any window to show which files are being scanned.

Context menu scan does not scans files in sub folder

Crystal security does not scans files with no extension

For every file detected as suspicious, unknown, unsafe a alert windows is shown. If hundreds of files are detected then hundreds of popup will be shown. This is very cumbersome.

User can only add individual files to Whitelist or in other lists. There is no option add folders in the list.

In "uploads" list there should be a button "Remove completed" to remove all the files that has been uploaded.

if you can remove the antivirus engines that produces false positives then it will be very helpful. Engines like tencent, BKAV, Zillya, calmAV, trend micro, rising, antiy-AVL,

one problem is it cannot classify the detected files as adwares and malwares. All the detected files are classified as unsafe or suspicious. The problem with it is that crystal security will delete the adwares that has already been installed which are not very aggressive adware. It may be bundleware.

Smart defrag 4 setup file is detected as suspicious. Some antivirus engine are detecting it as adware, unwanted program. Rising antivirus is detecting it as Trojan, which it is not. Smart defrag 4 is a safe application and can be considered bundleware. It is left up to user to classify this file as adware or malware and take proper decision. Implication can be that user won't be installing this application which is safe and could has been useful to the user.

A lot of files were classified as UNKNOWN. Crystal security still did not knew that these files existed. a lot windows OS files were classified as UNKNOWN. Hopefully this will not happen in future.

k lite codec pack has been submitted to virus total, then why is it labeled as UNKNOWN.

Some safe files are labelled as suspicious and unsafe. There should be an option to report those false positives within this application.

While dealing with archived files, crystal security will classify it as unknown files and will present option to upload it. This is not good. archived files may contain personal documents. Better unzip the archived files and scan it. Don't scan and try to upload password protected archives.


During quick scan 24784 files gets scanned but those files did not got classified. As you can see overview has only 3493 files that has been classified. So why does it not classify all those 24784 files while doing quick scan.

 

[OokamiCreed]

For every file detected as suspicious, unknown, unsafe a alert windows is shown. If hundreds of files are detected then hundreds of popup will be shown. This is very cumbersome.

I've noticed this as well. Seems like it can't connect to get the opinion of other AV's a lot of the time. 95% of these alerts are from files that are offical Windows files (signed by Microsoft) inside of here:

I also had a problem where Crystal Security wouldn't tell me anything and denied the right of a file to run (Windows itself showed a message stating that it, or I, didn't have the rights to execute). This was fixed after shutting Crystal down.

 

[Kardo Kristal]

Why portable & installer both? Whats the difference?

@yesnoo Thank you for the interest.

Many users requested installer version. Installer version is installed in Program Files folder and it creates shortcut to desktop automatically so installer version should be better for the "average" users. Both versions hold data in AppData directory.

Any settings (tips) for skiping UAC prompt?
I set Crystal Security to start with Windows.

@Av Gurus Currently the only workaround is to use Task scheduler. Another way is to disable "Start as Admin" but please note that some features will be disabled too

Thanks @jamescv7

Regards,
Kardo

 

[Malware1]

Many users requested installer version. Installer version is installed in Program Files folder and it creates shortcut to desktop automatically so installer version should be better for the "average" users. Both versions hold data in AppData directory.

The portable version should store all settings in a file in the same directory where it's executed.

 

[Kardo Kristal]

The portable version should store all settings in a file in the same directory where it's executed.

When it is executed directly from Desktop then you can see all data files on desktop too.

Regards,
Kardo

 

[Kardo Kristal]

@viktik Thank you for the useful feedback and suggestions.

Manual Scanning using context menu does not open any window to show which files are being scanned.

Hmm.. Got your point. Maybe UI should appear automatically when you scan files manually via context menu. Is it good idea?

For every file detected as suspicious, unknown, unsafe a alert windows is shown. If hundreds of files are detected then hundreds of popup will be shown. This is very cumbersome.

Is it actually possible to set automatic rules for each result and it is also possible to hide notifications for specific results (e.g. Unknown).

User can only add individual files to Whitelist or in other lists. There is no option add folders in the list.
In "uploads" list there should be a button "Remove completed" to remove all the files that has been uploaded.

Good suggestions. Both ideas will be added in the near future.

one problem is it cannot classify the detected files as adwares and malwares. All the detected files are classified as unsafe or suspicious. The problem with it is that crystal security will delete the adwares that has already been installed but are not very aggressive in showing ads.

I believe that I can add some kind of filter to detect type of malware etc.

A lot of files were classified as UNKNOWN. Crystal security still did not knew that these files existed. a lot windows OS files were classified as UNKNOWN. Hopefully this will not happen in future.

Question: On-access was enabled? When a lot of file will be analyzed in a row then there is one problem with limitation by the API (VT).
I have many options to solve it:

1. Analyze file after every 6 seconds
2. When file is Unknown by VT then result is based on other engines

Some safe files are labelled as suspicious and unsafe. There should be an option to report those false positives within this application.

I can only add this option for Heuristics, Crystal cloud and Local engine.

While dealing with archived files, crystal security will classify it as unknown files and will present option to upload it. This is not good. archived files may contain personal documents. Better unzip the archived files and scan it. Don't scan and try to upload password protected files.

Okay. There is a plan to add configurable extensions filter for uploads. Currently only executable files will be uploaded automatically.

Regards,
Kardo

 

[Kardo Kristal]

I've noticed this as well. Seems like it can't connect to get the opinion of other AV's a lot of the time. 95% of these alerts are from files that are offical Windows files (signed by Microsoft) inside of here:

@OokamiCreed You can enable "Trust applications with digital signature" (disabled by default) - then all digitally signed files will be skipped and allowed automatically but please note that it may allow digitally signed malware too.

Regards,
Kardo

 

[OokamiCreed]

@OokamiCreed You can enable "Trust applications with digital signature" (disabled by default) - then all digitally signed files will be skipped and allowed automatically but please note that it may allow digitally signed malware too.

Regards,
Kardo

I have tried this but it did not fix the problem. They were still showing as "unknown". After restarting Crystal Security it quieted down a bit (didn't show as many) but still showed some nonetheless.

 

[Malware1]

Question: On-access was enabled? When a lot of file will be analyzed in a row then there is one problem with limitation by the API (VT).
I have many options to solve it:

1. Analyze file after every 6 seconds
2. When file is Unknown by VT then result is based on other engines

So Crystal Security checks each file and simply ignores a file when the limit is reached?
It should scan only 10 files per minute, there should be some queue and if there are more files to scan, then check them later.

 

[Kardo Kristal]

I have tried this but it did not fix the problem. They were still showing as "unknown". After restarting Crystal Security it quieted down a bit (didn't show as many) but still showed some nonetheless.

@OokamiCreed Okay. Thank you for the feedback.

So Crystal Security checks each file and simply ignores a file when the limit is reached?

@Malware1 No, it is still analyzed but result is Unknown when limit is reached. I know that it is not a good way. I'll change it in the next version but I must find good solution. Your suggestion..

It should scan only 10 files per minute, there should be some queue and if there are more files to scan, then check them later.

.. Is good too but queue can cause some security issues too. I'll think how to improve it.

PS. Thanks for the PM. I'll reply ASAP.

Regards,
Kardo

During quick scan 24784 files gets scanned but those files did not got classified. As you can see overview has only 3493 files that has been classified. So why does it not classify all those 24784 files while doing quick scan.

@viktik It is normal (to avoid huge White-list - It may cause slow performance).

Regards,
Kardo

 

[viktik]

There are many files which are stuck with classification "unknown" and "Queued"

• After analysing those files they get classified safe.

There is no way to arrange files based on classification. If it was possible then it would have been very easy to rescan files which are stuck in classification "queued" and "unknown". manually selecting those files from a list of 4000 files is very difficult.

Overview can have five section, each section will list files based on classification which is safe, unsafe, unknown, suspicious and Queued. Then user can just open any one section then analyze all the files.

Similarly whitelist and blacklist files will be divided in sections based on classification of files.



What about files that has been deleted from hard disk or is moved to other location, but it is still in the overview, whitelist or blacklist. How will the user remove the those files from list

 

[Kardo Kristal]

There is no way to arrange files based on classification. If it was possible then it would have been very easy to rescan files which are stuck in classification "queued" and "unknown". manually selecting those files from a list of 4000 files is very difficult.

@viktik Good feedback. I have one idea. I can add groups to listview control. So all files will be grouped by result.

Safe group
Unsafe group
... and so on.

What about files that has been deleted from hard disk or is moved to other location, but it is still in the overview, whitelist or blacklist. How will the user remove the those files from list

There is an option called "Purge Whitelist" (under Whitelist) and "Purge Blacklist" (under Blacklist). Right-click on file and then you can select it. After click, all files that not exist on hard drive will be removed from list too, all other files are still listed. Should I add this "Purge" option to Overview section too?



Regards,
Kardo

 

[viktik]

Crystal security shows error message then crashes.

here is link to error log file : http://www65.zippyshare.com/v/dz1BUrRW/file.html

 

[Kardo Kristal]

Crystal security shows error message then crashes.
here is link to error log file : http://www65.zippyshare.com/v/dz1BUrRW/file.html

@viktik Thank you for the report. So far it is second error report. All seems to be caused by one module. Probably I must make changes in Active protection system. Thanks again for all the feedback, suggestions and reports.

Regards,
Kardo