Defendos Security - Official Thread

[weena]

this is better then MSE?

No its not

[l0calh0st]

@Suhel,Thanks, do you have any suggestion?


@weena,
Thanks for the useless reply. As I said this is NOT a replacement of an anti-virus software. Btw MSE is not that good. Avast / Mbam / are way better.

[Hyperz]

Nice app . 3 things though:

1. The hosts file has nothing to do with the Windows kernel and as such modifying it does not improve kernel-level security.
2. Does it actually parse the file so that it doesn't for example change/remove user-defined localhost alias domains?
3. Any application can write to the hosts file without a UAC prompt by injecting exploror.exe. Lots of viruses/trojans will use this to, for example, make www.mybank.tld redirect to a different server (phishing). This is probably a much bigger threat than dodgy sites using java driveby's and other iframe'd BS. How does it deal with that?

[l0calh0st]

Thanks for your reply Hyperz.

Well Ive added a Hosts Customizer function so the user can insert his own custom hosts rules. It saves that info locally and appends the Defendos signatures after every update.

The main purpose of this app is that it prevents users to get their system infected (ofcourse not all). Its not something like a realtime scanner. Even better, if the hosts file gets injected by a virus it won't affect long term because everytime you enable/disable/update/restart Defendos takes a fresh copy of the hosts file and patches again.

Hope that its a bit clear now

Thanks

[Buddah]

If you can add ad servers(assuming you didn't), I'd recommend this program to people.

[l0calh0st]

I need to think about that. It already blocks bad ads but not all.

[Hyperz]

Even better, if the hosts file gets injected by a virus it won't affect long term because everytime you enable/disable/update/restart Defendos takes a fresh copy of the hosts file and patches again.

Just be aware that if a virus depends on the hosts file the do its thing it'll most likely prevent anything else from writing to it. Especially if it took refuge in the kernel which will be the case for most viruses/trojans.

Anyway, good luck with it. One suggestion I'd give you is to make the app send the hosts file to your server so you can scan it there and perhaps detect if something is preventing your app from writing to it or scanning for known phishing IP's etc. Second suggestion, make categories for blockable hosts. That way, like buddah suggested, users can choose to block specific ad sites or even things like DRM-related domains for not-so-legally-obtained-games.

[Suhel]

I have some suggestion

Scanner (malware remover)
Auto start when you log in to windows
Sandbox
Program scanner

[l0calh0st]

If you can add ad servers(assuming you didn't), I'd recommend this program to people.

I am not adding this feature. Because there are plenty of adblock addons for browsers. Defendos main target is dangerous websites.

Just be aware that if a virus depends on the hosts file the do its thing it'll most likely prevent anything else from writing to it. Especially if it took refuge in the kernel which will be the case for most viruses/trojans.

Anyway, good luck with it. One suggestion I'd give you is to make the app send the hosts file to your server so you can scan it there and perhaps detect if something is preventing your app from writing to it or scanning for known phishing IP's etc. Second suggestion, make categories for blockable hosts. That way, like buddah suggested, users can choose to block specific ad sites or even things like DRM-related domains for not-so-legally-obtained-games.

I will try to implement tamber protection for Defendos AND the hosts files. So it can't be edited. I will try.


Also understand that Defendos can NOT replace an anti-virus/malware tool. Defendos is preventive, once your system is infected it's the job of your AV to fix that.

I have some suggestion

Scanner (malware remover)
Auto start when you log in to windows
Sandbox
Program scanner

Thanks for the suggestions; as I said a malware scanner / program scanner is a job of your anti-virus. Not needed in Defendos. Sandbox, there is already a small working tool that does the job. Good suggestion tho.

[Bharat]

Seems good , another awesome release from you mate . Keep it up +1