App Review Christmas Special Test of ThreatFire 4.7 (6 years old behavior blocker!)

[RejZoR]

Born as CyberHawk, risen as ThreatFire (PCTools) and was crucified by Symantec (Norton). And yet it's still so effective even after all these years of not being maintained or updated at all.

I know it missed many recent samples, but it was still detecting plenty. And what shocked me the most was the last part of the test with ransomware. I'm pretty sure it'll shock you as well!

This is why I love behavior blockers and why they fascinate me so much.

 

[Aktiffiso]

nostalgic... i have p c tools av free from my isp providor

 

[Antimalware18]

This is why someone, somewhere needs to develop a free True behavior blocker that works and is not bundled with something else (firewall, ect)

Please, I'm begging, and have been for years

 

[509322]

This is why someone, somewhere needs to develop a free True behavior blocker that works and is not bundled with something else (firewall, ect)

Please, I'm begging, and have been for years

Emsisoft used to have Mamutu. There were other standalone behavior blockers, but I suspect sales were not enough to support continued development or the products were purchased. I know they were not widely popular back then and there is no reason to suspect today would be any different.

 

[Deleted member 178]

Mamutu was the best BB ever made. Emsisoft was a geek vendor "all hail Online Armor ! "; best AV, best BB, Best FW/HIPS (the only FW that surpassed Comodo), and they decided to take the simplistic road with a suite to get more "average Joe" users... sadly for me , good for their finances

 

[Antimalware18]

Emsisoft used to have Mamutu. There were other standalone behavior blockers, but I suspect sales were not enough to support continued development or the products were purchased. I know they were not widely popular back then and there is no reason to suspect today would be any different.

I really wish they would. Pipe dream most likely but one can hope!

@RejZoR

I acctualy Lol'd when it caught the first few ransomwares

oh and "Holy poop" that one made me LOL as well

+1 from me all day long.

 

[jamescv7]

I liked how a typical traditional behavior works effectively without relying very much on signatures or cloud.

That is the true BB unlike nowadays where possible of ignore detection may occurred due to reference basis.

 

[Av Gurus]

Is this on x32 or x64bit OS?

 

[HarborFront]

Is this on x32 or x64bit OS?

It worked on my Win Pro 64-bit before

 

[Av Gurus]

I got one version and it didn't work on x64, now i find new one and it work in Win 10 x64

 

[RejZoR]

I think they've updated it last when Symantec sacked entire PCTools lineup.

 

[HarborFront]

Hi

That was great video. Thanks

I wonder if someone can gather a few anti-ransomware software (like BD, RansomFree, MWB v3, ZAL, SBGuard etc) and do a thorough test on a broad range of ransomware with ThreatFire as an anti-ransomware. HMPA & Kaspersky would not be suitable as they only target the cryptomalware family of ransomware.

That will be great as well.

Thanks

 

[Av Gurus]

@RejZoR
Did you tested on default settings or maybe change some of them?

 

[Nightwalker]

Mamutu was the best BB ever made. Emsisoft was a geek vendor "all hail Online Armor ! "; best AV, best BB, Best FW/HIPS (the only FW that surpassed Comodo), and they decided to take the simplistic road with a suite to get more "average Joe" users... sadly for me , good for their finances

It was a necessary and a very important long time choice, if Emsisoft didnt do that they would join others vendors like TallEmu Online Armor, Ghost Security, System Safety Monitor, Geswall and finally Malware Defender.

Unfortunately BBs, third party firewalls and classical HIPS are "toys" for geeks and security enthusiasts; the majority of windows users dont care and dont want to care about those.

 

[RejZoR]

@RejZoR
Did you tested on default settings or maybe change some of them?

View attachment 128614 View attachment 128615

Everything was left at default settings.

 

[Av Gurus]

Custom Rules can also be customized and add a new one:


Any idea what good custom rules can be added to hardened security?

 

[conceptualclarity]

Born as CyberHawk, risen as ThreatFire (PCTools) and was crucified by Symantec (Norton). And yet it's still so effective even after all these years of not being maintained or updated at all.

I know it missed many recent samples, but it was still detecting plenty. And what shocked me the most was the last part of the test with ransomware. I'm pretty sure it'll shock you as well!

This is why I love behavior blockers and why they fascinate me so much.

I have the setup file for the last ThreatFire. I'm thinking of running it on my next system.

How resource-intensive is it?

This is why someone, somewhere needs to develop a free True behavior blocker that works and is not bundled with something else (firewall, ect)

Seems like I remember a couple of years ago McAfee put out a freeware freestanding behavior blocker, but I haven't heard about it since then. Maybe it was just beta.

 

[RejZoR]

Oh man, seeing this rules creator reminded me how easy it would be for avast! to create ransomware protection which they have never done...

IF application tries to WRITE access any *.jpg file (or any other file affected by ransomware) and APPLICATION X is NOT on TRUSTED LIST (which would be harnessed from their Hardened mode whitelist), BLOCK request and WARN the user.

Granted, you can hijack other processes and use them, but surely they could track if UNTRUSTED app tried to use TRUSTED app to do a specific task.

I also realized the problem here is that this trusted list isn't being updated anymore for ThreatFire which is probably the reason why its protection isn't as good as it should be.

 

[Behold Eck]

Everything was left at default settings.

If I remember correctly the advanced settings let you add protection for hosts,registry etc ? Plus letting it run on your system for a while before testing might give an even better result ?

Still good results from an old codger on default settings,imo.

That was a Christmas treat, thanks.

Regards Eck

 

[Windows_Security]

Custom Rules can also be customized and add a new one:
View attachment 128667 View attachment 128668 View attachment 128669 View attachment 128670 View attachment 128671

Any idea what good custom rules can be added to hardened security?

Just do a Google search for Kees1958 Wilders Security Threatfire custom rules and you will find a lot custom rules.

Kees1958 was my old nickname at Wilders