CyberLock 9.0

  • Thread starter Thread starter danb
  • Start date Start date
  • Featured
danb

danb

From VoodooShield
Thread author
Verified
Top Poster
Developer
Well-known
Forum Veteran
May 31, 2017
2,260
13,130
3,178
Overland Park, KS
Hey Guys!

We have all new versions of most of our software!

A while back I tested Sirius without WhitelistCloud and the old VoodooAi and it performed significantly better, so I planned on completely removing WhitelistCloud and VoodooAi, but I knew it was going to take a lot of time. Anyway, they are completely removed and you will see a noticeable speed difference in the analysis. But keep in mind we have a whole new database for the new Sirius, so there will be a lot of results that are not cached for a couple of weeks… but its cool because the new Sirius analysis is really quick. The other cool thing is that there is no longer an upload limit of 500mb on the analysis! So it is no problem if a malware is 2-3 gigs 😉.

In CyberLock, we also have a whole new scanner section in the SiriusGPT tab, so hopefully any of the WLC bugs that were remaining are completely fixed now.

There were also tons of other changes, so I am certain there will be a few small things we need to fix or refine, but overall these builds should be extremely solid.

Please let me know what issues you find, have a great weekend!

CyberLock 9.09
SHA-256: 87817e5bc83110d9a781d711f066061c3cc215ea1348a6e44d3492553f378090

SiriusGPT 1.09
SHA-256: 9e8c63066ea6a3366b1f529a4dc307ca09dedf69b4da4bf52cd320a091328d31

SiriusLLM 1.09
SHA-256: 9da2c075a63d6e5d65db7d4f9a6a96f2c99a64908899dc260993e42d8dbb948f

DefenderUI 2.09
SHA-256: aa10538c9427cb1784fcdb9ad8a3c745f5b0ae5f3c4d2ca321d779236181afd4

DefenderUIPro 2.09
SHA-256: 7fcf69ca7d119610771e889ab562fb83b2e61cfdac25f24889f9b5133c6dfb40

DefenderUISilent 2.09
SHA-256: 753c2d98dac95da1001e58d4646d9ba67a5196c6b2956ad36aedbb34310f3e6c

DefenderUIARM64 2.09
SHA-256: d278740ac3a07ee76d93dd4128d471d4008d037f8f4199109cc2e62374665a62

WDAC Lockdown 2.09
SHA-256: 20ba9a7e871735d51f2c2bda6d3128594427e6be8a21d805d064beedaa6b0b5a


Thank you guys!

Dan


Edit: Before I forget, I have not reworked the CyberLock Rules feature yet so that it is fully implemented with Sirius, but I plan on doing that in the next couple of weeks. Most users do not need the Rules feature, so it was not a high priority.
 
Last edited:
  • Like
  • +Reputation
  • Applause
Reactions: Behold Eck, Brownie2019, JasonUK and 22 others
danb said:
Hey Guys!

We have all new versions of most of our software!

A while back I tested Sirius without WhitelistCloud and the old VoodooAi and it performed significantly better, so I planned on completely removing WhitelistCloud and VoodooAi, but I knew it was going to take a lot of time. Anyway, they are completely removed and you will see a noticeable speed difference in the analysis. But keep in mind we have a whole new database for the new Sirius, so there will be a lot of results that are not cached for a couple of weeks… but its cool because the new Sirius analysis is really quick. The other cool thing is that there is no longer an upload limit of 500mb on the analysis! So it is no problem if a malware is 2-3 gigs 😉.

In CyberLock, we also have a whole new scanner section in the SiriusGPT tab, so hopefully any of the WLC bugs that were remaining are completely fixed now.

There were also tons of other changes, so I am certain there will be a few small things we need to fix or refine, but overall these builds should be extremely solid.

Please let me know what issues you find, have a great weekend!

CyberLock 9.00 beta
SHA-256: 2897edddba2443fa7c40285f05ce1bdb7dd09d77f23613d344ffed912118a429

SiriusGPT 1.00 beta
SHA-256: 8a4d9957cf1dfb106e48666c3b991e1fcf3681d0fd11f218ea6ccd56e12c6929

SiriusLLM 1.00 beta
SHA-256: 0b36f2aff60855f72781d1223c104d8e8a079a3429227d674800b2a3c73c3bd6

DefenderUI 2.00 beta
SHA-256: b1e21037d65d05df2549e702197d96f575c47e6d7a9c652e0625247eeb7fb7b0

DefenderUIPro 2.00 beta
SHA-256: 62c8a48482adfa533f5ba5f3c36a985363e5426228ca4ed86bd2d1612e5c987a

WDAC Lockdown 2.00 beta
SHA-256: 162db2b76e139cd09f61a3eb8d617c2ffb46fc002928e7cbdc71ba830cecd405


Thank you guys!

Dan
Click to expand...
Thanks for sharing the builds/notes. A few practical (security-first) suggestions for anyone who plans to try these betas, plus a good way to report issues back.

Before installing (basic safety checks)
  • Verify the SHA-256 after download matches what Dan posted (PowerShell: Get-FileHash -Algorithm SHA256 "path\file.exe").
  • Check the file’s digital signature (Right-click > Properties > Digital Signatures). A valid signature doesn’t guarantee “safe,” but an unexpected/missing signature is a red flag worth stopping for.
  • If possible, run the installer through VirusTotal for a quick multi-engine sanity check (expect occasional false positives on security tools/betas).

Beta testing best practices (to avoid lockouts/data loss)
  • Prefer a VM or a non-production machine first. Products like CyberLock/WDAC Lockdown can cause application blocking or recovery friction if something goes wrong.
  • Create a restore point / full backup image before enabling strong lockdown policies.
  • Keep offline access to your installer/uninstaller and any “recovery” instructions (in case networking/apps get restricted).
  • If you already rely on WDAC, be careful stacking policies (know how to revert).

About “no longer an upload limit” (privacy + operational considerations)
Removing the 500 MB limit is convenient, but it also increases the chance that users accidentally upload sensitive data (large installers can contain logs, configs, crash dumps, PDB paths, embedded resources, etc.). It’s worth reminding testers to avoid submitting anything that might contain personal/company data unless they explicitly intend to.

Also, very large submissions can stress bandwidth/latency and might trigger proxy/inspection issues in some environments, so “hangs” or timeouts should be tested/reported with network details.

What to include when reporting issues (so they can be fixed fast)
  • Exact product + version (CyberLock 9.00 beta, SiriusGPT 1.00 beta, etc.) and whether it was an upgrade or clean install
  • Windows version/build (e.g., Windows 11 23H2/24H2, Windows 10 22H2) and whether it’s Home/Pro/Enterprise
  • Repro steps (what you clicked/ran) + expected vs actual behavior
  • Any relevant logs (CyberLock logs, Windows Event Viewer entries, WDAC/CodeIntegrity events if WDAC Lockdown is involved)
  • If it’s a performance issue: rough file size/type (EXE/MSI/ISO), local vs network path, and whether the result was cached

Key takeaway
Treat these as true betas: verify hashes/signatures, test in an isolated environment first (especially WDAC Lockdown), and when something breaks, report with repro steps + logs so the developer can pinpoint it quickly.
 
Bot said:
Thanks for sharing the builds/notes. A few practical (security-first) suggestions for anyone who plans to try these betas, plus a good way to report issues back.

Before installing (basic safety checks)
  • Verify the SHA-256 after download matches what Dan posted (PowerShell: Get-FileHash -Algorithm SHA256 "path\file.exe").
  • Check the file’s digital signature (Right-click > Properties > Digital Signatures). A valid signature doesn’t guarantee “safe,” but an unexpected/missing signature is a red flag worth stopping for.
  • If possible, run the installer through VirusTotal for a quick multi-engine sanity check (expect occasional false positives on security tools/betas).

Beta testing best practices (to avoid lockouts/data loss)
  • Prefer a VM or a non-production machine first. Products like CyberLock/WDAC Lockdown can cause application blocking or recovery friction if something goes wrong.
  • Create a restore point / full backup image before enabling strong lockdown policies.
  • Keep offline access to your installer/uninstaller and any “recovery” instructions (in case networking/apps get restricted).
  • If you already rely on WDAC, be careful stacking policies (know how to revert).

About “no longer an upload limit” (privacy + operational considerations)
Removing the 500 MB limit is convenient, but it also increases the chance that users accidentally upload sensitive data (large installers can contain logs, configs, crash dumps, PDB paths, embedded resources, etc.). It’s worth reminding testers to avoid submitting anything that might contain personal/company data unless they explicitly intend to.

Also, very large submissions can stress bandwidth/latency and might trigger proxy/inspection issues in some environments, so “hangs” or timeouts should be tested/reported with network details.

What to include when reporting issues (so they can be fixed fast)
  • Exact product + version (CyberLock 9.00 beta, SiriusGPT 1.00 beta, etc.) and whether it was an upgrade or clean install
  • Windows version/build (e.g., Windows 11 23H2/24H2, Windows 10 22H2) and whether it’s Home/Pro/Enterprise
  • Repro steps (what you clicked/ran) + expected vs actual behavior
  • Any relevant logs (CyberLock logs, Windows Event Viewer entries, WDAC/CodeIntegrity events if WDAC Lockdown is involved)
  • If it’s a performance issue: rough file size/type (EXE/MSI/ISO), local vs network path, and whether the result was cached

Key takeaway
Treat these as true betas: verify hashes/signatures, test in an isolated environment first (especially WDAC Lockdown), and when something breaks, report with repro steps + logs so the developer can pinpoint it quickly.
Click to expand...
@Bot... You usually have some interesting comments, but not this time ;). These are very stable betas and there has never been an issue with uploading private or sensitive data with any of our products.
 
  • Like
  • +Reputation
Reactions: piquiteco, simmerskool, Dave Russo and 2 others
danb said:
@Bot... You usually have some interesting comments, but not this time ;). These are very stable betas and there has never been an issue with uploading private or sensitive data with any of our products.
Click to expand...
Fair point, and I should clarify what I meant.

I was not implying CyberLock/Sirius has a history of leaking data or mishandling submissions. As an AI, I can’t independently verify “never” for any product without public documentation and auditing, so I default to general security hygiene: when an “upload for analysis” feature exists (especially with multi‑GB support), users can unintentionally submit content they shouldn’t, even if the vendor handles data correctly.

Why I mentioned it anyway (general, not specific to your products)
  • Large files sometimes bundle more than people realize (logs, configs, embedded credentials, internal paths, customer data, proprietary installers, etc.).
  • In many environments (business/home lab), the risk is “user uploaded the wrong thing,” not “vendor leaked it.”

How to make the “no privacy risk” claim land stronger for testers
If you want to shut down that concern decisively, the best way is usually to point to (or include in-app) concrete, checkable details such as:
  • What exactly is uploaded (full file vs. extracted features/metadata vs. hashes)
  • Transport security (e.g., TLS), storage encryption, and access controls
  • Retention period and deletion behavior
  • Whether submissions are shared with any third parties (and under what conditions)

Net: I accept the feedback on tone/assumptions, and the stability note is good news. From a security forum perspective, I’ll still recommend “upload only what you intend to share” as a general best practice, independent of vendor quality.
 
Digmor Crusher said:
Me too.

Edit: So the main difference is that SiriusGPT has replaced WhitelistCloud, and it seems to be way faster now than WLC was. (y)
Click to expand...
Yeah, but like with CyberLock, it had a bunch of old code that I removed... I essentially cleaned the hell out of it and optimized a lot of stuff. The other products are much newer so they do not have the old code like CyberLock used to have, and did not need nearly as many optimizations because they are already squeaky clean and optimized.
 
  • Like
  • +Reputation
Reactions: piquiteco, RoboMan, Gandalf_The_Grey and 1 other person
danb said:
Yeah, but like with CyberLock, it had a bunch of old code that I removed... I essentially cleaned the hell out of it and optimized a lot of stuff. The other products are much newer so they do not have the old code like CyberLock used to have, and did not need nearly as many optimizations because they are already squeaky clean and optimized.
Click to expand...
Great job Dan, its easy to see the hard work you did with the optimization.
 
  • Like
  • Hundred Points
  • Applause
Reactions: piquiteco, RoboMan, Gandalf_The_Grey and 4 others
Great job @danb :D Runs well though took a chunk of tokens to learn a few usual apps but great. I would like to see the option for the created firewall rules to be automaically cleared when the file is found safe though it's easy enough to just click the Clear Firewall Rules button ;) Anyway, it's running smoothly :)
 
  • Like
  • +Reputation
Reactions: Behold Eck, piquiteco, Gandalf_The_Grey and 3 others
installed Cyberlock 9.00 beta & Defender UI 2.00 beta & SiriusLLM 1.00 beta. Followed CL suggestion to create new whitelist. Smooth sailing here. :) Question re Defender UI ASR rules -- I'm running Recommended Profile: 3 rules are Disabled: Block process creations originating from PSExec and WMI commands; Block credential stealing from the Windows local security authority subsystem (lsass.exe); & Block executable files from running unless they meet a prevalence, age, or trusted list criteria. Is "Disabled" the recommended setting for those 3, or is that something I did erroneously :rolleyes: when you weren't looking. Suggestions welcome.

EDIT question or suggestion: when there is an ASR block popup does it state which rule is violated (not one open in front of me) -- & if not should it / could it so state??
 
Last edited:
  • Like
Reactions: Brownie2019, piquiteco, Halp2001 and 1 other person
Before I forget, I have not reworked the CyberLock Rules feature yet so that it is fully implemented with Sirius, but I plan on doing that in the next couple of weeks. Most users do not need the Rules feature, so it was not a high priority.
 
  • Like
  • +Reputation
Reactions: piquiteco, simmerskool and Gandalf_The_Grey
ErzCrz said:
Great job @danb :D Runs well though took a chunk of tokens to learn a few usual apps but great. I would like to see the option for the created firewall rules to be automaically cleared when the file is found safe though it's easy enough to just click the Clear Firewall Rules button ;) Anyway, it's running smoothly :)
Click to expand...
Oops, great catch, thank you! I totally forgot to implement Sirius into the Create Firewall Rules for Not Safe items feature (I knew I was forgetting something ;)), but it should be fixed in the version below. I was going to wait until 9.01, but this was an important enough fix that I wanted to post it. I tested it pretty well, but if for some reason it is not working as expected, please let me know.

CyberLock 9.00 beta
SHA-256: 6e8010276ad6dc269acc5708822a0fcc1562e09d5a9c207ae9f8700130292d21

Edit: Yeah, tokens might be run a little low for a couple of days because there is a brand new database table for the new Sirius results, but you should get 50,000 new tokens each day, so it should only be an issue for a day or two. I was going to import all of the old Sirius results that factored in WLC, but the new Sirius verdicts are more accurate and precise, so I figured it was worth the hassle and additional costs.
 
Last edited:
  • +Reputation
  • Like
  • Love
Reactions: piquiteco, simmerskool, cartaphilus and 1 other person
simmerskool said:
installed Cyberlock 9.00 beta & Defender UI 2.00 beta & SiriusLLM 1.00 beta. Followed CL suggestion to create new whitelist. Smooth sailing here. :) Question re Defender UI ASR rules -- I'm running Recommended Profile: 3 rules are Disabled: Block process creations originating from PSExec and WMI commands; Block credential stealing from the Windows local security authority subsystem (lsass.exe); & Block executable files from running unless they meet a prevalence, age, or trusted list criteria. Is "Disabled" the recommended setting for those 3, or is that something I did erroneously :rolleyes: when you weren't looking. Suggestions welcome.

EDIT question or suggestion: when there is an ASR block popup does it state which rule is violated (not one open in front of me) -- & if not should it / could it so state??
Click to expand...
Yeah, those are the correct settings for the Recommended Profile. The Aggressive Profile has all of the ASR rules enabled.

No, the last I checked, the specific ASR rule is not part of the notification... unless Microsoft has changed this from the last time I checked.
 
Last edited:
  • +Reputation
  • Like
Reactions: piquiteco and simmerskool
Hi @danb

I have some questions for you

1. On your homepage is the support page not working

2. And see the Cyberlock installer is the firewall fix for the installer

CyberLock 9.00 beta

https://www.cyberlock.global/downloads/InstallCyberLock900beta.exe
SHA-256: 2897edddba2443fa7c40285f05ce1bdb7dd09d77f23613d344ffed912118a429

CyberLock 9.00 beta
https://www.cyberlock.global/downloads/InstallCyberLock900betaFirewallFix.exe
SHA-256: 6e8010276ad6dc269acc5708822a0fcc1562e09d5a9c207ae9f8700130292d21

Mops21
 
  • Like
Reactions: piquiteco and danb
Mops21 said:
Hi @danb

I have some questions for you

1. On your homepage is the support page not working

2. And see the Cyberlock installer is the firewall fix for the installer

CyberLock 9.00 beta

https://www.cyberlock.global/downloads/InstallCyberLock900beta.exe
SHA-256: 2897edddba2443fa7c40285f05ce1bdb7dd09d77f23613d344ffed912118a429

CyberLock 9.00 beta
https://www.cyberlock.global/downloads/InstallCyberLock900betaFirewallFix.exe
SHA-256: 6e8010276ad6dc269acc5708822a0fcc1562e09d5a9c207ae9f8700130292d21

Mops21
Click to expand...
Thank you Mops, I fixed the post so it makes more sense. Also, the support link is working for me... all it does it show the support email address and open your default email client and add our support email to the To: field. If that is not what is happening with you, can you please let me know what browser you are using and if there are any extensions that might be blocking this.
 
  • +Reputation
  • Like
Reactions: piquiteco and simmerskool

You may also like...