- Feb 15, 2012
- 2,128
Best Anti-EXE/App Whitelisting 2015
- Thread starter Overkill
- Start date
- Status
@Malware1 discovered AG could be bypassed in Medium Mode by using .lnk file to cmd.exe about 6 months ago. It was reported to BRG and fixed. A few of us tested it thoroughly... it was Medium Mode bypass by ransomware script disguised as text file. If I am not mistaken, @Malware1 happened upon the vulnerability by merely crafting the cmd.exe shortcut from the desktop (User Space). So AG did not block the access to cmd.exe (System Space). Quite serious actually... although malware author would have to know about it and target AG specifically at that time.
NVT ERP was bypassed back in late 2012 by 16-bit, COM files and using Internet Explorer. Each of these was a bit arcane and reported to Andreas by discoverers. Once again, malware author would have to know about them and target ERP at that time. If I am not mistaken all have long been fixed.
VooDooShield has been bypassed by malware using rundll32.exe. It was fixed a few years ago.
Unfortunately, nothing is perfect... including AEs.
Fortunately, bypasses can be fixed.
For those that are particularly OCD about their security softs just remember this:
The number of anti-executable users is very small... maybe a few hundred thousand users total spread over three or four applications.
Malware authors tend to target softs that are mainstream with millions of users - like Adobe, browsers, Oracle, etc. This includes security softs... so big names AVs are much, much more of a target than some obscure anti-executable. Malware is, after all, a numbers game.
So, even if an AE has a vulnerability that enables a bypass, how likely is it that a malware writer will target a soft with a user base numbering in only the tens of thousands at most - when they know it is unlikely to net them very little, if anything at all.
Plus, at least from what I see, AE users tend to be quite conservative\safe in their computing habits = download very little and are not high-risk surfers.
Think about it...
The number of anti-executable users is very small... maybe a few hundred thousand users total spread over three or four applications.
Malware authors tend to target softs that are mainstream with millions of users - like Adobe, browsers, Oracle, etc. This includes security softs... so big names AVs are much, much more of a target than some obscure anti-executable. Malware is, after all, a numbers game.
So, even if an AE has a vulnerability that enables a bypass, how likely is it that a malware writer will target a soft with a user base numbering in only the tens of thousands at most - when they know it is unlikely to net them very little, if anything at all.
Plus, at least from what I see, AE users tend to be quite conservative\safe in their computing habits = download very little and are not high-risk surfers.
Think about it...
Last edited by a moderator:
- Mar 1, 2014
- 1,708
I'm still waiting for a genius malware author who can bypass all security softwares with just one or many connected malware. hahahaha...
What if there's an Albert Einstein in the dark cyberworld? What could possibly happen? hahahaha...
What if there's an Albert Einstein in the dark cyberworld? What could possibly happen? hahahaha...
AppGuard, NVT ERP and VS are all developed and supported by very small teams.
IF a serious bypass is discovered... report it. The developers will fix bypasses quite quickly... as will most any security soft vendor if the bypass is demonstrably critical.
I am not the person to ask about VPNs and how they affect any AEs, since I have little experience with VPNs. I can't tell you anything that you would find useful...
Easy enough... theoretically speaking only:
- Develop malware
- Get it onto Microsoft update servers
- Get Microsoft updates to install it as part of Automatic Updates
- World-wide infection
- Jul 22, 2014
- 2,525
- Feb 10, 2012
- 585
Try WinPrivacy from Winpatrol "scotty" or SpyShelter
WinPatrolToGo, Ruiware, LLC.
SpyShelter | Anti-Keylogger Numer 1 na Świecie
SpyShelter have HIPS features also Sandbox and Keystore encryption which work better than alternative soft "KeyScrambler" you can also buy version with Firewall module
WinPatrolToGo, Ruiware, LLC.
SpyShelter | Anti-Keylogger Numer 1 na Świecie
SpyShelter have HIPS features also Sandbox and Keystore encryption which work better than alternative soft "KeyScrambler" you can also buy version with Firewall module
Last edited:
Try WinPrivacy from Winpatrol "scotty" or SpyShelter
WinPatrolToGo, Ruiware, LLC.
SpyShelter | Anti-Keylogger Numer 1 na Świecie
SpyShelter have HIPS features also Sandbox and Keystore encryption which work better than alternative soft "KeyScrambler" you can also buy version with Firewall module
WinPatrol is OK. I'm not sure Ruiware worked out 64-bit system bugs yet...
SpyShelter does not provide full protections on 64 bit systems due to Patch Guard... plus the GUI is clumsy, tedious.
Both are OK, dependable softs...
WinPatrol for deleting scripts work very well. But it does blocks them and it detection of scripts it is outstanding!
Waiting on their new ramson-ware software.
Waiting on their new ramson-ware software.
- Mar 23, 2015
- 555
It is a pseudo-HIPS. It will alert upon specific behaviors\actions and then user has to Allow or Block. It is OK. It's been around for a long time.
- Mar 15, 2011
- 13,070
@Online_Sword : It just focus on possible entry behaviour like start up and any crucial files on the system, good for at least not so paranoid to monitor all the changes.
However if you want a full anti-exe then WinPatrol is not the one you looking for, which needs a full maintenance check like EXE Radar Pro and few others.
However if you want a full anti-exe then WinPatrol is not the one you looking for, which needs a full maintenance check like EXE Radar Pro and few others.
- Feb 10, 2012
- 585
i told WinPrivacy not WinPatrol but you can use both HIDS + Anti-EXE with network monitoring looks nice
im also gonna buy new 3rd sofrware from Scotty this can be good monitor acess file/process.
It's something look like advanced option from SpyShelter but it will for sure more advanced
im also gonna buy new 3rd sofrware from Scotty this can be good monitor acess file/process.
It's something look like advanced option from SpyShelter but it will for sure more advanced
Salutations,Friends!
In your opinion which Anti-EXE/Application software of 2015 work with
Sandboxie? Providing the all around protections against scripts exploits?
Without conflicts!
Making each day better than yesterday!
In your opinion which Anti-EXE/Application software of 2015 work with
Sandboxie? Providing the all around protections against scripts exploits?
Without conflicts!
Making each day better than yesterday!
- Mar 23, 2015
- 555
According to the official documents, AppGuard and Exe Radar Pro can work with Sandboxie after some configuration.
- AppGuard:
- Exe Radar Pro:
In addition, it is mentioned by Andreas that SmartObjectBlocker can also work with Sandboxie. Still, you need to do some configuration for Sandboxie.
- SmartObjectBlocker
Last edited:
- Status
Similar threads
