Spyware Warrior

Stem

Hello all,
Just thought it may be worth a mention,..
There is now a "Free Edition" of SSM, based on its "Full 2.0.8.574 version, with all features for that version"
Protection (summary below)

hornet777 · Posted: Sat Jul 01, 2006 1:58 pm Post subject:

Just as one might assume that we DOS-based Win users were yet again being abandoned, the SSM-team comes through again.

mikey · Posted: Mon Jul 03, 2006 6:03 am Post subject:

Thx for the heads up, Stem. I think it was a very wise move on their part to offer a freebie. It should serve to make folks more aware of them and the product's considerable abilities.
_________________
-
W2K/2K3/XP/2K8/Vista/W7/RHE/DEBIAN/SUSE

Spyware/Adware is NOT freeware, it costs all of us dearly.

Mikey's Stuff

Fiddler and friends...essential web diagnostic, forensic, & development tools.
-

bob30880 · Posted: Mon Jul 03, 2006 6:41 am Post subject:

Any opinions on how this compares to Process Guard?

I've been using the licensed version of PG for a couple of years now and swear by it.
_________________
DYSLEXIC'S UNTIE!

mikey · Posted: Mon Jul 03, 2006 7:48 am Post subject:

OK IMO it isn't a matter of quality when comparing those two products. SSM is just more robust. It has been in dev for many years. I tend to think SSM users want more understanding and control of how they are protected. Both are great tools.

As a SOHO admin, my personal choice is AbtrusionProtector.

BTW There are also several other good tools for process filtering around.

For those who don't yet know;
'Why do I need this layer in my defenses? Because you can't be infected if the infection can't initiate.'
_________________
-
W2K/2K3/XP/2K8/Vista/W7/RHE/DEBIAN/SUSE

Spyware/Adware is NOT freeware, it costs all of us dearly.

Mikey's Stuff

Fiddler and friends...essential web diagnostic, forensic, & development tools.
-

fcukdat · Posted: Mon Jul 03, 2006 9:00 am Post subject:

Stem · Posted: Mon Jul 03, 2006 12:12 pm Post subject:

Stem · Posted: Tue Jul 04, 2006 9:47 am Post subject:

System Safety Monitor Free Edition was released, build 2.0.8.575

What's new:
* added several language updates.

bob30880 · Posted: Wed Jul 05, 2006 7:39 am Post subject:

Stem · Posted: Wed Jul 05, 2006 8:35 am Post subject:

Hi bob30880,
Really, at this time, the advantage of the "Full Version" is "NT Services Installation and State Change (significantly improved)" the adding of "Low level disk access" protection (killdisk), and the upgrade of the "registry protection", which is now a "registry monitor" (I would describe this as a "Registry firewall", as there are registry application rules that can be entered (registry rules per application)).

Stem · Posted: Wed Jul 05, 2006 9:01 am Post subject:

Hi bob30880,
I forgot to mention, if you did decide to purchase the full version of SSM, due to you having a full licence for PG,.. you could claim "Competitive Upgrade 50% Off Discount"

bob30880 · Posted: Wed Jul 05, 2006 9:56 am Post subject:

Stem · Posted: Fri Jul 07, 2006 10:12 am Post subject:

System Safety Monitor 2.0.8.576 Free Edition was released
What's new:

* now all executable files (PE) are signed with the System Safety Limited software publisher certificate;
NOTE: Windows 9x users may not be able to verify the digital signature due to the absence of the appropriate cryptographic provider.

Bugs fixed:

* Sometimes SSM did not catch physical memory access attempts.

mikey · Posted: Fri Jul 07, 2006 2:59 pm Post subject:

aBenG · Posted: Sat Jul 08, 2006 8:38 am Post subject:

fcukdat · Posted: Sat Jul 08, 2006 1:54 pm Post subject:

Thanks Mikey for the informative link

I would like to say that a was'nt having a swipe at the layered security approach model but was purely aimed at process filtering software part of a good layered solutio
.

Not to thread Hijack,will start a new topic to carry on with this soon hopefully since i think there some good quality info to come yet Wink

_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

mikey · Posted: Sun Jul 09, 2006 4:12 pm Post subject:

voltz · Posted: Mon Jul 10, 2006 2:03 pm Post subject:

[quote="bob30880"]
I decided to give SSM a try....and you're right about the options, I like the wider range of control.

I've now given PG the boot.
[/quote]

That would make an excellent testimonial! :)

SSM has really improved since I last tried it back in its early development.

I'm still testing its capabilities, but so far I'm impressed.

fcukdat · Posted: Tue Jul 11, 2006 11:13 am Post subject:

Ok i said i would'nt thread hijack but after the last post it seems that PG is very much part of this thread so i'll take that back.

Ok's Mikey and other learned members following or posting on this topic your wisdom is required since i am still learning and maybe not a 100% correct in my interpretations Shocked

1st point

SSM offers more tweaks(control points/checks) than PG,all good if you have the sans to understand them Cool

but PG is more user freindly to someone new to process filtering/control ?

2nd point and this comes from my own experience(using PG free version)whilst collecting/testing malware and not from any POC's or proven code and is with reguards process filtering/control on code execution and specific to any software that ensnares this modis operandi.

I have yet after visiting hundreds of exploit laiden urls,activeX downloads,archived malware launching from CD or PC hard drive encountered one instance where the execution protection of PG has not captured and foiled by my instruction the malware attempt to execute by alerting to it Very Happy

I have yet to find installers that can drop global hooks,load drivers or DLL inject without the initial code being allowed to execute.
With that i admit i am a hobbyist and no expert so beyond POC's that i have not encountered am i correct in assuming that if code is prevented from executing all/any of its effects are nullified ?

If it cannot execute,it cannot deploy and infect ?

Mikey this is what i was referring to the rest of the check points being g33k fodder(ie PG free versus PG paid) Wink

With that how important is execution protection to a layered and effective security approach Wink

_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

herbalist · Posted: Tue Jul 11, 2006 4:02 pm Post subject:

mikey · Posted: Wed Jul 12, 2006 4:53 am Post subject:

Maybe after I've had some coffee I'll respond here about the issues but for now I just wanted to throw my laughter out;

mikey · Posted: Wed Jul 12, 2006 11:41 am Post subject:

fcukdat · Posted: Wed Jul 12, 2006 12:54 pm Post subject:

Moore · Posted: Wed Jul 26, 2006 3:31 am Post subject:

mikey · Posted: Thu Aug 03, 2006 7:07 am Post subject:

Hey Moore,

You might find this of interest; http://www.voiceofthepublic.com/reports/loadorder-SSM1.html
_________________
-
W2K/2K3/XP/2K8/Vista/W7/RHE/DEBIAN/SUSE

Spyware/Adware is NOT freeware, it costs all of us dearly.

Mikey's Stuff

Fiddler and friends...essential web diagnostic, forensic, & development tools.
-

Moore · Posted: Thu Aug 03, 2006 5:45 pm Post subject:

Thanks Mikey.. Smile

Looks like safemon.sys has about 200 + kernel hooks. The current free version is really a lot better experience than the last version I tried , I almost gave up on it forever. I'm actually liking it again.

Processguard catches files executing before SSM / Abtrusion Protector catches any files though.

Probably doesnt mean much as the files will probably still be caught by SSM regardless if PG wasnt there.

SSM alerts are a bit more informative :

I have all three running at the same time at the moment , and Outpost 4 which also has some similar new protection features that are working nicely to prevent malware entering the system too.

Well anyway , SSM free gets a thumbs up from me Very Happy

mikey · Posted: Fri Aug 04, 2006 4:58 am Post subject:

Technically speaking, the higher the load, the more control you have over the entire sys. However, IMO, it doesn't really matter much as all of these products will stop any foriegn initiation and thereby stopping any infection dead.

All three of the products mentioned in this thread are now simple enough for any user to learn and there is no excuse for anyone to ever suffer any unwanted ware ever again.

If a user combines a little content filtering along with this process filtering, he should not even ever need see anything unwanted. For example, the only time I ever see a third party ad is when I drop my shields in order to see/study raw source.

============

As noted in that LoadOrder report, I've tried doing simultaneous comparisons but found the results conflicting. I found a better comparison by using event snapshots to capture identical routines on separate appliances.
_________________
-
W2K/2K3/XP/2K8/Vista/W7/RHE/DEBIAN/SUSE

Spyware/Adware is NOT freeware, it costs all of us dearly.

Mikey's Stuff

Fiddler and friends...essential web diagnostic, forensic, & development tools.
-

mikey · Posted: Sun Aug 06, 2006 9:38 am Post subject:

mikey · Posted: Fri Aug 11, 2006 7:51 am Post subject:

Another OT on monitoring;

I forgot to mention the obvious. Folks testing should of course also monitor the usage. Resources can be monitored easily with freebies such as ProcessExplorer also from Sysinternals or FaberToys.

Again you can look up the links. Smile

_________________
-
W2K/2K3/XP/2K8/Vista/W7/RHE/DEBIAN/SUSE

Spyware/Adware is NOT freeware, it costs all of us dearly.

Mikey's Stuff

Fiddler and friends...essential web diagnostic, forensic, & development tools.
-

Moore · Posted: Fri Aug 11, 2006 9:40 am Post subject:

----------------------------------------

System Safety Monitor 2.0.8.581 Free Edition hotfix

mikey · Posted: Fri Aug 11, 2006 11:43 am Post subject: