System Safety Monitor

[Curt]

I have known about System Safety Monitor for some years, but never thought of it to be worth my attention - until today when I received an e-mail from Agnitum (the maker of Outpost firewall) where they interviewed some ex-hacker, and of course asked him what firewall he would recommend. He did answer Outpost, they claim, but to my surprise the first firewall he named was System Safety Monitor. His answer made me think twice. The Outpost license I have will run out this summer, and maybe its time I should dare to use something else - maybe I should listen to this ex-criminal's expert opinion on the subject and try out System Safety Monitor?



Single user: $35, Family: $50, Competitive Upgrade Discount: 50%
- there is a downgraded FREE version as well.

Do you have an opinion on the pay version of System Safety Monitor? 

[cthorpe]

I have the pay version of SSM, and I find it to be fairly powerful as far as controlling applications and processes.  It can be noisy at first, but it calms down considerably after a week or two of heavy use.  The current version cuts down on some of the chatter by giving you options such as an "install mode" that automatically allows all of the processes spawned by an installer to run without intervention.

I don't use the firewall, but as far as I recall, it only handles outbound traffic, and does so in a very simplistic manner.  If you're behind a router, and just want to allow or deny programs from getting out, it might do what you want.  If you need inbound protection or want to use more complex rules, then it might disappoint.

Carl

ps - Do you have a link to the interview you mentioned?

[Curt]

ps - Do you have a link to the interview you mentioned?

[attachimg=#] http://www.agnitum.com/news/securityinsight/issues/april2007

[cthorpe]

It looks like he is talking about SSM as an anti-malware program rather than a firewall.

[Curt]

It looks like he is talking about SSM as an anti-malware program rather than a firewall.

Q: So there’s no magic bullet?

A: Well, System Safety Monitor – the program that tracks Windows activity in real-time – is as good a place to start as any for combating Pinch-like malware. And, yes, you’ll be pleased to hear that Outpost is likely to do a decent job too.

Yes, I should have paid more attention to the details in the wording. Only, I thought of it to be an inaccurate translation because Outpost was named in the same sentence, but of course Outpost PRO is a "firewall with anti-spyware".

[attachimg=#]

[dk70]

May be an idea to look at 1 program covering this area - was one of the reasons I bought Kaspersky. Seem to have more interest for system than virus Check out a fully working 30 day trial and you will see. Also is strong on pure malware detection so no need for anything else. Quite enough - works fast with scanning but sometimes I feel it is watching every move I make. Must be what some Symantec customers complain about. The not so rare pops from "Proactive defense" confirm there is something watching. Im glad I have fast computer, dont know what you have. Ive been to Kaspersky user forums may be 20 times, each time with important question. Not for everyone but actively developed, well supported on site and exciting new things in beta. They cant deal with being run over by Avira and NOD32, not an option. Worth the money for sure but expect some effort to be required - help files should be read. Must be geeky enough for you, also here own registry entries can be added. Not sure that goes for many popular suites. Download MJ Registry Watcher and fill up until you puke. Unfortunately not possible to get such package from freeware market. KAV is Virus suite, may you want KIS - the internet suite which includes Firewall and some not so useful extras.

Kaspersky close to overkill for me as it is so lack words for SSM. Matter of how you compute I think. I sure dont need Kaspersky hourly or so updates to feel secure, dont need Kaspersky at all - but a nice package and good value. Previously I did run Windows Defender just for the light system monitoring. More than covered now. I prefer the task of getting to know 1 and only 1 program really well.

Other companies have same type of offers - check them out. Im advertising for the old AV brands attempt to stay in business If AV dont take care of rootkits it is no good today! Well I think Kaspersky have convincing value and mean business.

[Curt]

Maybe I will look more into Kaspersky some day, but not for now as my NOD32 license will last for another 1½ year. I am even thinking about extending the license for Spyware Doctor within the next month; it just removed a Trojan.Spy.Banker.AEC which came with UBCD4WIN.

BTW: Anyone who has a coupon code for Spyware Doctor? I am a little short on cash because of this new PC I suddenly had to buy.

[MrCrispy]

There are many free anti-spyware programs you can use instead. Two things to remember -

1. most decent anti-virus programs detect malware
2. spyware protection doesn't need to be realtime. In fact in all the tests I've done and read about, I've never seen an anti-spyware app catch something before it ran.

You can try SpywareTerminator, Superantispyware (on demand is free), as well as the old warhorse Spybot S&D.

[Curt]

to remember -

1. most decent anti-virus programs detect malware

Outright wrong!

[f0dder]

to remember -

1. most decent anti-virus programs detect malware

Outright wrong!

Perheps you missed the word decent in there?

And heh, from that "interview" I'd label the guy as a script kiddie and not a hacker. Wonder what his company affiliations are anyway... perhaps the company behind SSM?

[Curt]

to remember -

1. most decent anti-virus programs detect malware

Outright wrong!

- sorry for the harsh wording!    - you might say I was too curt...  [attachimg=#]

Yes, I did notice the word 'decent', but I cannot think of anyone that will say that NOD32 is not a decent anti-virus program. Can you? NOD32 did not detect Trojan.Spy.Banker.AEC. I am more surprised that no-one yet commented on UBCD4WIN launching a Trojan!

[dk70]

But does it? Have you checked their site/forum? Im 99.99% sure that is a false positive. As are the 6 infections Kaspersky notify about. Well, it calls them "riskware" keyfinders etc. It is hysteric, when installing Quicktime it sense a hidden install when plugins are copied to browser folders - also riskware. Riskware can be turned off thank god, I really think life is too short for such popups. But what file should have that trojan? and did you get ubcd4win from this page http://www.ubcd4win.com/downloads.htm ?

If NOD32 was not enough for me I would look into why that is so. May be I should change download patterns! NOD32, some Anti-spyware plus System Monitor is too much. Probably conflicting as well. Spyware Doctor also have AV now, they all try to cover as much ground as possible. A tool like SSM you should get because you want to not because who ever says it is cool. May be set up a rule like only allowing your self to buy 1 security program - which you already have done. Good choice even. May be you can jump the NOD32 security suite when it is ready http://www.wilderssecurity.com/showthread.php?t=170556

[Curt]

...did you get ubcd4win from this page http://www.ubcd4win.com/downloads.htm ?

Yes; http://downloads.littlbuger.info/index.php?dlid=522
- and I believe you're right about it being a false positive.

... jump the NOD32 security suite when it is ready http://www.wilderssecurity.com/showthread.php?t=170556

"when its ready" - yeah. It IS ready, for beta-testers, but I do not dare to have a final "version 01" release replace Outpost; Eset + users might find that it takes a lot to catch up with the best.

But it sure is looking neat already:

[attachimg=#]

[dk70]

Dont see why they should have problems - matter of money more than anything. Eset might have bought developers from one of those free firewalls which strangely dont seem to get long life. May be only exist to promote themself towards other companies lacking firewall.

Anyway when you get virus always check with Jotti, Virustotal http://wiki.castlecops.com/Online_antivirus_scans#Multiple_engine_scans besides Google it. Not so important with ubcd4win perhaps but deleting wrong files could be a security risk in itself. If I followed all advice from Kaspersky computer would start to misbehave very quickly. Also not very likely to get virus from that program, includes Avira! - can never be absolutely sure, how AVs make money