EXE Radar Pro v4 (Beta)

[Deleted member 178]

Does the "Allow all software from the Programs File folder" also cover the Programs Files (x86) folder too ?

It does.

 

[AMD1]

@NoVirusThanks


Yes.

about options for alerts:

Option 1 is easier to handle for basic users, option 2 would be overwhelming for them.
Option 2 is better for more advanced users.

why not do both:
option 1 is the default then put an "advanced option" button in the alert dialog leading to option 2?

About the merging, i'm favorable to it, less windows to open, easier the use.

I am a basic user and looking to learn more and I agree that "why not do both: option 1 is the default then put an "advanced option" button in the alert dialog leading to option 2? " covers both scenarios for basic and advanced users and would be the way to go

 

[AMD1]

It does.

Perhaps wording to that affect would help so users know for sure.

 

[NoVirusThanks]

@Umbra

Good point, wrote that on the todo list

@AMD1

Sure, can rename that option to "Allow all software from the Programs File folder (x86 included)"

 

[AMD1]

@NVT
If V4 is to be a paid product, would there be an upgrade from V3 paid ?

NB I wasn't aware that V3 Beta was freeware or existed at the time I purchased a license for V3 (which I am quite happy I did by the way)

 

[NoVirusThanks]

If V4 is to be a paid product, would there be an upgrade from V3 paid ?

Yes of course, in that case all users that bought V3 will get V4 for free.

 

[AMD1]

@Umbra

Good point, wrote that on the todo list

@AMD1

Sure, can rename that option to "Allow all software from the Programs File folder (x86 included)"

Just so I understand, does this mean that any program which finds its way into the Programs File Folder (including x86) is whitelisted as opposed the whitelisting just those that reside in these folders when you whitelist them ?

 

[Chimaira]

A few questions:

a) What do you think about this possible improvements for the Alert Dialog:

Option 1: We put "checks" on process fields that will be used when "Remember the action" is checked:

View attachment 181291

Option 2: We open "Rule Editor" when "Remember the action" is checked:

View attachment 181292
b) What do you think about joining "Rule Editor" and "Expression Builder":

View attachment 181293

@Umbra

You mean option to whitelist all .exe files on a folder and\or subfolders?

It is missing, we should add it soon.

I like Umbra's suggestion about having both, I would also wonder about adding an option in the context menu so that you can right click on a program or installer, select the option and have it pull up one of the rule editor/expression builder menus.

 

[Deleted member 178]

Just so I understand, does this mean that any program which finds its way into the Programs File Folder (including x86) is whitelisted as opposed the whitelisting just those that reside in these folders when you whitelist them ?

seems the case.

i copied a portable apps into Program Files, no peep from ERP

 

[NoVirusThanks]

@AMD1

If a program is located in Program Files or Program Files (x86) it is allowed automatically (if you have the option checked).

No rule is created, it is allowed on-the-fly without creating a specific rule.

@Chimaira

Added in the todo list

 

[AMD1]

I have a program I use for work which resides in the C\ . How do I now whitelist all of the processes in that folder without having to whitelist them all individually when prompted ?

 

[shmu26]

Guys, be careful with learning mode, it will whitelist all your vulnerable processes. If you ran learning mode after populating your VPL, you will have to fix it.
That's the behavior I saw, anyways: learning mode whitelists the whole process -- not just the command line like it did in ERP 3

 

[In2an3_PpG]

@NoVirusThanks, Really great software you got here. Easy to use interface. Gets right straight to the job its supposed to do. I like it.

So far no problems running on my end. Running smooth.

 

[Deleted member 178]

I have a program I use for work which resides in the C\ . How do I now whitelist all of the processes in that folder without having to whitelist them all individually when prompted ?

wait the next build

More seriously, if you can, put in in Program Files and tick "Allow all software in program files..."

 

[AMD1]

wait the next build

More seriously, if you can, put in in Program Files and tick "Allow all software in program files..."

I cant change the default path unfortunately so will have to wait - in V3 it was easy just to browse to the folder and whitelist the processes including those in sub folders - hoping something similar can be added. For now, i have added a category and a rule with expression builder path ticked equal to C:\MyWorkProgram which seems to have worked but whether it's properly correct I don't know.

 

[NoVirusThanks]

@AMD1

For now, i have added a category and a rule with expression builder path ticked equal to C:\MyWorkProgram

That is the correct way.

Additionally, you could sign all your programs with your Company's code sign (if you have it) and include Signer in the rule.

But it is fine as you did. To allow also processes in C:\MyWorkProgram\* (subfolders) just set the rule to "Like to" = C:\MyWorkProgram\*

 

[AMD1]

@AMD1



That is the correct way.

Additionally, you could sign all your programs with your Company's code sign (if you have it) and include Signer in the rule.

But it is fine as you did. To allow also processes in C:\MyWorkProgram\* (subfolders) just set the rule to "Like to" = C:\MyWorkProgram\*

Thanks that's the reassurance I needed that I was using the program as it should be used.

 

[lowdetection]

I am happy

Thanks dev and Umbra.

 

[shmu26]

The inclusion of parent process of the command line is great. It sets a new standard for anti-exe.

 

[codswollip]

Does the "Allow all software from the Programs File folder" also cover the Programs Files (x86) folder too ? If not, how does one exclude all these processes in one action.

As a corollary to this... does this setting also include Programs Files folders outside the OS "C:\"partition... for example...

D:\Program Files\
D:\Program Files (x86)\

EDIT 1: I noticed that the Events log is purged with each reboot. Is that intentional? I didn't see an option in settings for that.