NoVirusThanks EXE Radar Pro turns Freeware

[shmu26]

1.Like this
View attachment 126284

2. Like this
View attachment 126285

Version is 3.1 (24062015)
View attachment 126286

yes, everything looks good to me.

 

[shmu26]

one last thought: if it was me, before going into lockdown mode, I would put it in learning mode, and do a couple reboots, and sign in and out of all my user accounts. This will whitelist the crucial command lines, and save you headaches.
I don't think @Umbra would do it this way, though. He is more hard-core than me.

 

[Av Gurus]

@Av Gurus: about mshta, yes, you are right, the place to add it is vulnerable processes.
Anything that you add to that list will produce a prompt, even if you have whitelisted it somewhere else.
The only way to stop prompting for something on the VPL is to whitelist a particular command-line string.

For ex.

 

[Av Gurus]

one last thought: if it was me, before going into lockdown mode, I would put it in learning mode, and do a couple reboots, and sign in and out of all my user accounts. This will whitelist the crucial command lines, and save you headaches.

So, everything that was detected in learning mode will be whitelisted when put in Lockdown Mode?
Tips for installing new software (know to be good)...put in Allow/Learning/Disable Mode?

 

[shmu26]

For ex.
View attachment 126287

it won't work. that process is on the VPL, and VPL will override the whitelist. You would have to whitelist a command-line string that defines what exactly the vulnerable process is allow to do.

 

[shmu26]

So, everything that was detected in learning mode will be whitelisted when put in Lockdown Mode?
Tips for installing new software (know to be good)...put in Allow/Learning/Disable Mode?

View attachment 126288

yes, lockdown mode will respect your whitelist.

for installing new software, you can put it in alert mode if you are interested to see what is happening, or just disable, and whitelist the program after installation.
easiest way to whitelist after install is try to run it, let it get blocked, and then go to the log tab (or whatever they call it, I can't remember), and look for the red line, and right-click it and choose whitelist.

 

[Av Gurus]

yes, lockdown mode will respect your whitelist.

for installing new software, you can put it in alert mode if you are interested to see what is happening, or just disable, and whitelist the program after installation.
easiest way to whitelist after install is try to run it, let it get blocked, and then go to the log tab (or whatever they call it, I can't remember), and look for the red line, and right-click it and choose whitelist.

Like this:

 

[shmu26]

Like this:
View attachment 126289

that's exactly right.

Guys, I must admit that I don't actually have NVT ERP installed right now -- I am on vacation from default/deny.
I am just answering off the top of my mind.
If you want to connect with advanced users of this software, with people who really know it inside and out, here is the thread for you:
New Antiexecutable: NoVirusThanks EXE Radar Pro

 

[Av Gurus]

I'm watching that thread also
Tnx

 

[Davidov]

But I read that ERP is unable to prevent the attack in memory, therefore, is to erp, AppGuard and voodooshield The advised malwaebites antiexploit or hitmen to alert or emet.

 

[shmu26]

But I read that ERP is unable to prevent the attack in memory

correct, ERP is purely an anti-executable. But remember that if the malware cannot execute, then you don't even need to block it in memory.

The exception to this rule is:
1 exploits that run purely in memory
2 dll attacks.

That is why ERP also has a vulnerable processes list: it prevents these from happening.

So ERP properly configured provides full protection.

But if you want multi-layered protection, then you can add the other software you mentioned.
VS will not add much protection. And MBAE is weak.
HitmanPro.Alert is a great app, as long as it does not cause hardware or software conflicts (which it does a lot)
Appguard is the ultimate app for hard-core security, but it is expensive, and has a learning curve.
EMET is not great and not terrible. I never used it, personally.

 

[Deleted member 178]

i cant live without Appguard

 

[XhenEd]

i cant live without Appguard

Me too.

As to NVT ERP, I hope its dev will continue to develop it. It has so much potential.

 

[shmu26]

i cant live without Appguard

hard-core.

 

[Davidov]

I also wanted AppGuard but the big prize for me otherwise I have also used micto novirustnx but is also good do not like antivirus.

PS:shmu26 You're also advise that you sleep sometimes .-))

 

[Av Gurus]

Should i whitehelist dismhost.exe?

 

[Andytay70]

Wheres the link for the free version?

 

[Mr.X]

Wheres the link for the free version?

Latest free beta version but stable and the best one:

http://downloads.novirusthanks.org/files/EXERadar_Pro_x86_x64_v3.1_24062015_BUILD1.exe

 

[shmu26]

Should i whitehelist dismhost.exe?

View attachment 126353

the way to do it is to whitelist it as a command line, and then edit the command line, replacing the string of random characters with an asterisk: *

 

[Mr.X]

Should i whitehelist dismhost.exe?

View attachment 126353

the way to do it is to whitelist it as a command line, and then edit the command line, replacing the string of random characters with an asterisk: *

I don't have dismhost.exe in any of ERP's lists. If triggered or run somehow, then it will alert me and block it as I think dismhost.exe is not used by my system Win8.1 x64 ever.

It is used if I run dism.exe on purpose for various tasks such as:
- Cleaning SxS store
- Service a Windows install.wim image
etc.