Battle Best Anti-EXE/App Whitelisting 2015

[Overkill]

Which one do you choose?

 

[hjlbx]

I m usi g Voodoshield 2.75 and I like it as its ability to scan with 56 VT scanner when something unknown is detected.
I asked the above because I didn't know if Voodoshield worked at kernel level (thanks Hjlb for the info that v. 3 will be!) and exactly what kind of files are controlled.
I don't think they have a memory or folder, registry protection.

I read a lot about AG, but I'm still not sure what files are guarded.

NVT is where I have no infos. Does it wotk at kernel mode, what files does it guard, does it have memory protection?

VooDooShield is a pure anti-executable; it provides no folder, memory or registry protection. Not sure if it will ever be added.

Basically, AppGuard protects everything except ProgramData and User Profiles (by blocking writes, memory injection into processes) ... however, you can customize it to get softs to work.

NVT ERP is a pure anti-executable; it provides no folder, memory or registry protection. Andreas the developer isn't going to add it. I know NVT ERP can block installation of kernel mode drivers. NVT ERP has nice feature where use can white-list command lines - like control panel command lines that use rundll32.exe. Can block\regulate any interpreter and vulnerable processes too.

If you want maximum security, then combine AppGuard and NVT ERP... or VooDooShield when stable v. 3 is released.

On top of anti-executable add virtualization and outbound firewall notifications and that is about as good as it gets. It isn't 100 % bullet proof but it is as close as you can get without turning your system into a tank - in which case it would be so loaded down that it won't work unless you have a Xeon core.

 

[porkpiehat]

VooDoo Shield (paid) gets my vote.
I love the layout of the program and how well it works. PeAcE

yeah, me too... I tried NVT ERP, but I didn't get along with it... VooDooShield just does what I expect of it, and fits in very nicely with my setup....

 

[Solarquest]

VooDooShield is a pure anti-executable; it provides no folder, memory or registry protection. Not sure if it will ever be added.

Basically, AppGuard protects everything except ProgramData and User Profiles (by blocking writes, memory injection into processes) ... however, you can customize it to get softs to work.

NVT ERP is a pure anti-executable; it provides no folder, memory or registry protection. Andreas the developer isn't going to add it. I know NVT ERP can block installation of kernel mode drivers. NVT ERP has nice feature where use can white-list command lines - like control panel command lines that use rundll32.exe. Can block\regulate any interpreter and vulnerable processes too.

If you want maximum security, then combine AppGuard and NVT ERP... or VooDooShield when stable v. 3 is released.

On top of anti-executable add virtualization and outbound firewall notifications and that is about as good as it gets. It isn't 100 % bullet proof but it is as close as you can get without turning your system into a tank - in which case it would be so loaded down that it won't work unless you have a Xeon core.

Hjlbx,
Thank you for the clear and informative answer!
My last question is, do they all check the same files(exe, script, dll, scr, ...) or what program covers more types?
In advance, nice weekend to all!

 

[Online_Sword]

Hjlbx,
Thank you for the clear and informative answer!
My last question is, do they all check the same files(exe, script, dll, scr, ...) or what program covers more types?
In advance, nice weekend to all!

Hi, as far as I know, all of the four anti-exe program take effective approaches to monitor the interpreters of scripts, such as cmd, java, csript, wscript, powershell, etc.
So they are all able to block scripts.
Regarding dlls, AppGuard, Exe Radar Pro, and VoodooShield also monitor rundll32, so they can also prevents rundll32 from running unknown dlls.
We cannot infer from the setting panel of SecureAPlus that whether it monitors rundll32 or not. But according to some posts in wilderssecurity, it can also blocks unknown dlls.

Regarding the exact file types that are monitored by these four...sorry, I do not know.
But it seems easy to find the file types that are monitored by Bouncer.
I think Bouncer would look at the file types in the following screenshot:

As far as I know, this is not a full list of files that would be blocked by Bouncer.
According to the user manual, in fact, Bouncer does not scan for file extension.
Its driver will monitor any process that tries to load executable code into memory.
So it can also block things like "evil.exe.png".

 

[Moose]

Salutations, Friends!

> Opinions on VooDooShield?
> And will Bouncer work with Sandboxie?
> And what about ReHIPS?

Making today a great day, and tomorrow a better one!

 

[Raul90]

It's NVT for me but am waiting on the merging of NVT EXE Radar and the NVT Smart Object Blocker (--- beta still, hoping for the merge...).

NoVirusThanks Smart Object Blocker - NoVirusThanks

Umbra's Quick Review,
[Quick Review] NoVirusThanks Smart Object Blocker (v1.1 Beta )

 

[FleischmannTV]

Scrutiny from an Inquisitive mind: "POC or didn't happen" for AppCert Bypass

In case some of you missed the discussion on Wilders.

The researcher was kind enough to register on the forum and explain things. That alone is a great thing, as it rarely ever happens. Because folks over there (including developers) didn't even understand what he was saying, he was constantly asked to proof his findings in a video, of course without being compensated for his time and work. When he initially refused, he was treated in a condescending way and then, and only then, responded in kind. Then his postings were being removed for being condescending and his rights to post further were taken away as well, the thread was also locked.

He then responded with a POC on his blog. It turns out he was right from the beginning. The flaws he is pointing out are really embarrassing. I guess other researchers will take this as a reinforcement of their practice to abstain from active participation in forums like this.

So once again, we poor average home users have to rely on the promises of the industry only, because researches will either abstain or get censored, should they be so kind to share their findings with us.

 

[XhenEd]

Scrutiny from an Inquisitive mind: "POC or didn't happen" for AppCert Bypass

In case some of you missed the discussion on Wilders.

The researcher was kind enough to register on the forum and explain things. That alone is a great thing, as it rarely ever happens. Because folks over there (including developers) didn't even understand what he was saying, he was constantly asked to proof his findings in a video, of course without being compensated for his time and work. When he initially refused, he was treated in a condescending way and then, and only then, responded in kind. Then his postings were being removed for being condescending and his rights to post further were taken away as well, the thread was also locked.

He then responded with a POC on his blog. It turns out he was right from the beginning. The flaws he is pointing out are really embarrassing. I guess other researchers will take this as a reinforcement of their practice to abstain from active participation in forums like this.

So once again, we poor average home users have to rely on the promises of the industry only, because researches will either abstain or get censored, should they be so kind to share their findings with us.

But I think talking to each other via PM might have been more successful. Then, if there was really a bypass against VS, then Dan or r41p41 could explain what happened. Then, the hole could have been patched without any dramas created.

There was really no need for attacks from both sides. If Dan doesn't want to create a bounty, then r41p41 could have just stopped responding since the bounty is more important to him.

 

[Deleted member 178]

Finally he revealed himself again...

One reason i will never use VoodooShield is that his dev is an arrogant "i-think-im-da-best" type and is unable to take criticism positively. Long time ago he even harassed me via email, because i said here that his product was buggy and doesnt afford anything.

He has a grudge against me and @Littlebits because we were not fooled by his product (at the time we tested it)

Now i dont know how VS performed (and honestly i dont care) but with this affair seems things didnt changed. He seems still arrogant and his product still "buggy" (to be polite).

So that kind of reaction is not a surprise to me.

I dont say dont use VS , but you have many far better solutions.

 

[Moose]

@Umbra, and everyone else!

Will NoVirusThanks Smart Object Blocker - NoVirusThanks work with Sandboxie?
And is your pick for Best Anti-Exe/Application Whitelsiting software of 2015?

Or would do think ReHIPS would be better with Sandboxie? Your thoughts?

Making today a great day, and tomorrow a better one!

 

[Deleted member 178]

SoB is an beta version, it cant be compared with others.

Normally Sbie & Rehips should work together since they do different things.

 

[hjlbx]

Basically there are few options:

1. AppGuard
2. NoVirusThanks Exe Radar Pro
3. VooDooShield

NVT ERP

• Easy to use interface
• Easy to understand
• Easy to learn
• Good compatibility

Easy choice...

 

[Kate_L]

I hear people say that there is a free version of "NoVirusThanks Exe Radar Pro" but, I can't find it.

 

[FleischmannTV]

But I think talking to each other via PM might have been more successful.

For the vendor maybe, but definitely not for us. Besides, the researcher was asked in public and answered in public.

Thanks to the public discussion, the audience was able to learn several things, which never would have been revealed, if everything had been discussed behind closed doors. At best we would have been told there had been a hole and that it was fixed (after months maybe). The full scale of the technical incompetence of the people behind this "security software" would have remained well hidden.

 

[SHvFl]

@OpenSecLabs It's the beta version you can get it from the developer signature. It's the beta version mentioned there. He still didn't release it as stable from what i know.

New Antiexecutable: NoVirusThanks EXE Radar Pro | Page 193 | Wilders Security Forums

 

[hjlbx]

I hear people say that there is a free version of "NoVirusThanks Exe Radar Pro" but, I can't find it.

NVT ERP has been freeware for about 6 months. It is the beta versions for now, until the developer releases next stable version.

You can find it at Wilders > Other Anti-Malware Softs > A New Anti-Executable: NVT ERP. Search the thread in descending order, you will find the most recent beta posted...

Hee, hee... @OpenSecLabs beat me too it - AND - gave you the link !

 

[FleischmannTV]

I hear people say that there is a free version of "NoVirusThanks Exe Radar Pro" but, I can't find it.

The latest beta is free. The change is licensing hasn't been implemented in the stable release yet. It will be in the next final version.

 

[Moose]

And everyone of the above have been bypassed accept, VooDooShield. Correct me if I am wrong?

 

[hjlbx]

And everyone of the above have been by pass accept, VooDooShield. Correct me if I am wrong?

AG, NVT ERP and VS have all been bypassed.

Find bypass, report it, it gets fixed.

 

[Moose]

@hjlbx,

Good to know that even VooDooShield was bypassed. Wondering what above the turnaround
time-frame was of each Anti-EXE/Application White-listing software? Of how long before the fix was taken care of between each Anti-EXE/Application White-listing software?

Also, this link: NVTE, not recommended for use with VPN's?