Features

System Safety Monitor offers the following features:

Allows you to control which programs and applications can be opened on your computer.

Offers a choice of two modes – User and Administrator. In Administrator mode you can set your preferences to control programs. Access to this mode can be protected with an encrypted password to prevent anyone changing your settings. In User mode no changes can be made to your settings.

Supervises changes to important registry keys when you install new programs.

Will block or alert on any attempt to change guarded registry keys.

Allows you to control which programs run at system startup.

Maintains a list of running applications and allows you to terminate any application immediately.

Maintains lists of Black–Listed (banned) and Trusted (allowed) programs and applications for the Administrator and other users. These lists can be easily edited.

Allows you to block specific windows (including websites) from opening.

Can be set to run automatically on system startup, with the system tray icon visible or hidden.


Installation

 If you are upgrading from a previous version, and want to start fresh, first shut down System Safety Monitor if it is running – In Administrator mode, select Close in the system tray pop–up menu. Then delete all the program files from the folder where System Safety Monitor is installed (or move them to another folder if you want to keep them).
Create a folder for the program; for example, C:\Program Files\System Safety Monitor.
Note: Once the program has been installed in a particular directory, you will have to delete configuration backup (see Uninstall tab-page) from the system registry to install future versions in another folder.
Copy ssm.zip to this folder and unzip it.
Double–click on SysSafe.exe to start the program.
The program icon should be visible in the system tray.


Basic Function

System Safety Monitor (SSM) guards against any changes that might be made to the main program registry keys. One purpose of this is to protect against potential worm and virus attacks.
The following registry keys are "guarded" by default:

Autorun key
Windows automatically executes all programs located in this key. These programs can configure your system when they are started automatically every time your computer boots up. Although these keys are used to execute your regular programs, they may also be accessed by worms and trojans.

.exe-File open parameters key
A trojan or virus will often change this key allowing it to intercept program executions.

Mirabilis ICQ autorun key
ICQ automatically executes all programs located in this key. These programs can configure your system when they are started automatically every time your ICQ starts.
You can also configure the program to act like a program firewall, allowing you to control which programs and processes may run on your system.


Preferences

 When you start System Safety Manager for the first time, its icon should be visible in the system tray.

To configure SSM, click your left mouse button twice on this icon, or right–click once and select Preferences.

The following pages explain each tab in the Preferences window:
Registry
Applications
Captions
Registry Keys
Trusted Applications
Options
Information
Uninstall


Registry

 Under the Registry tab is the list of the registry keys for programs that have been set to start automatically when you start up your computer. Here you can configure these autorun keys to prevent any unnecessary programs from being loaded at startup.

On your keyboard, press Insert to add a new program on startup, Delete to remove it, or Enter to run a selected item.

It's a good idea to check your autorun keys occasionally and prevent all unnecessary programs from being loaded at startup.

Check the Monitor Registry box to ensure your registry is being watched for any changes. You can also toggle this feature on/off from the system tray popvup menu.


Applications

Under the Applications tab is a list of all process that are currently running. You can shut down any process by selecting it and pressing the Delete key on your keyboard. When you have killed all unnecessary tasks, check the Watch App Activity box.
When a new (i.e. not on the Trusted List) application is started, System Safety Monitor will ask whether you want to:

add it to the Trusted List (can be run by the Administrator and by Users)
add it to the Black-List (can not be run by the Administrator or by any User)
add it to the Trusted List for the Administrator but the Black-List for Users
allow it to be executed this one time only
This last option is best used for one time only programs and applications you know you won't likely run again, such as program installations and uninstallations. This will prevent your list of Trusted Applications from getting needlessly cluttered.
Also, many program installations use setup programs with the same name (install.exe or setup.exe) and uninstall programs (ininstall.exe). If you mark these as "Trusted" any user would be able to install and/or uninstall a program on your system.

The above procedure is the simplest way to set up and configure a program firewall for your common programs and applications. It's also a good way to find out which applications are started to run a particular program.
Caution: If you uncheck (clear) the Watch App Activity box, all programs and applications will start without any input from you. This effectively removes any program firewalling.


Captions

 Captions allows you to prevent any window from opening where the caption in the title bar contains the characters or text that you enter. This will apply to programs, word processor documents, web browsers, websites, etc. This a powerful and extensive firewalling and privacy tool that will block any window where the title bar contains the characters you specify. It is especially useful for preventing users from accessing particular websites, or your private document files.

Note that this feature is applied in User mode only – it is not active in Administrator mode.

To add an entry, type it into the window.

Note: You should be aware of the following:
  • Entries are not case sensitive – "R" is treated the same as "r", and vice–versa.
  • Windows that have the text that you specify in any part of the caption will be blocked. For example, if you wanted to prevent a user from accessing your file "Expenses"and entered only "exp", such programs as "Internet Explorer" and "Outlook Express" would also be blocked.

    • To enable this feature make sure that the Filter window captions box is checked. You can also toggle this feature on/off from the system tray pop– up menu.


Registry Keys

 Under the Registry keys tab is a list of the registry keys that the program is monitoring. To change the status of a key, first uncheck the Monitor Registry box, and then type in your preference.

Check the Monitor Registry box when you have made your changes.

To restore the original settings press the Defaults button.
Caution: As always, you should know what you are doing before making changes to your registry.


Trusted Applications

 In Trusted Applications you can view how your programs and applications have been classified. If you have enabled Watch App Activity under Preferences|ApplicationsV (or in the system tray pop– up menu), your preferences are added to these lists automatically. Here you can manually add, remove or re–classify a program in any of the three categories:
Black–Listed
Trusted in User and Administrator modes
Trusted in Administrator mode only
Trusted applications are colour-coded. To change the status of a Trusted application, highlight it and click on your choice below the pane.

If you want to change the status of an application to allow it to be executed one time only, or to reclassify it the next time it is opened, just highlight it and delete it.

You can also move an application from Trusted to Black-Listed (and vice-versa) by right-clicking on it and dragging it to the other list.

If you want to refresh your list of Trusted programs, check the Watch App Activity box in Preferences|Applications and delete all programs in the Trusted Applications window. You will be asked again how you want classify each running application.

Caution:
You should classify all running applications as soon as possible. If you switch System Safety Monitor to User-mode and a critical system service remains unclassified, the application might be blocked or killed causing your system to lock up or crash.


Options

 Under the Options tab you can set the following preferences for program behaviour:
Set the program to start automatically (minimized in the system tray) every time you start your computer.
Set the program to always start in User mode. User mode allows a user to run only those programs and applications that have been allowed by the Administrator. Users do not have access to Preferences, etc.. If this box is cleared the program always starts in Administrator mode.
Terminate your system if a User attempts to shut down System Safety Monitor.
Allow a user to start any application (except of Black-Listed) even if the program is running in User mode.
Caution: This partially removes program firewalling.

Set an Administrator password. Only the Administrator can make changes to the program's settings, including shutting the program down. Setting a password prevents a user from switching to Administrator mode.

The first time you set a password, enter it in the New and Confirm boxes only.

If at any time you want to change your password, fill in all three boxes.

If you want to remove password protection, enter the current password in the Old box and leave the others blank.

Passwords are case sensitive ("R" is not the same as "r").

When choosing a password, try to follow the basic rules for a good secure password – it should be at least 8 characters long; contain a mix of letters, numbers and other keyboard characters; and not be a word that can be found in any dictionary. Avoid using your name, address, phone number, postal or zip code. These kinds of passwords are easy to crack.

Assign a hotkey to show/hide the system tray icon.
Show/hide the system tray icon at startup.
Note: While either of these two options will mean one less icon in your tray, and setting an Administrator password and hiding the program icon obviously adds an extra level of security, you would now also have to remember the key sequence to show the icon. You might prefer either or both of the above options if you don't need the solid security of an Administrator password or can't be bothered with the hassle, but still want to hide the program from the casual (not power) user and so prevent them from altering your preferences.


Information

 The Information tab displays information about the current program and links to related websites.


Uninstall

 To remove System Safety Monitor from your system, select the Uninstall tab and click on the hyperlink.
Note: Since this uninstaller operates from within the program itself, be sure to manually delete the SSM folder and any remaining files.


Alert

If the "Alert" window pops up, this means that a guarded registry key has changed. If the item is highlighted in red the action was blocked. If the item is highlighted in green the action was permitted. You can block or unblock an application by pressing F2 or F3 on your keyboard.

The Alert window can be accessed by selecting Show Log from the tray icon pop–up menu or by clicking the Show Log button in Preferences|Common.


Problems

 If you encounter a problem with SSM . . .

Close the program. If it fails to close, terminate it using Ctrl–Alt–Delete. If it still doesn't work, reboot your computer in Safe Mode
To prevent the program from running at system startup, run the System Configuration Utility (MsConfig) by going to Start|Run, typing "msconfig" (sans quotes), and pressing OK.
Select the Startup tab and uncheck SystemSafe.
If the program "msconfig" is absent on your system, run "regedit" from Start|Run. Open the key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and delete the value "SystemSafe" to prevent the program running at system startup.
You can now delete the System Safety Monitor (SSM) folder/files from your hard disk drive. This removes the program completely from your system.
Any problems or bugs, please contact the author at bugsbunny@e-mail.ru. Your assistance is appreciated!


About

 Websites
Download the latest version at http://kormushkin.narod.ru/ssm.zip
© Max Computing, 2002. http://maxcomputing.narod.ru/

Questions & Problems
Please read this help file carefully before mailing questions. If you want to report a problem, please contact the author at bugsbunny@e-mail.ru

Thanks to:
Abraham Koshie
Chris Burke
Inba Software
Kshitij Gupta
Mickle
 abrahamkoshie@yahoo.com
pcpburke@hotmail.com
inba2k@gala.net
kshitijg@tis.co.in
mikle@rosebush.org.uk

Donations
This program is entirely freeware - no fees, no ads, no spyware. If you would like to support its development please send a donation to:

170042, Tver, Blagoeva 15, 191
Russian Federation


Front Page

SSM help in French:
Online: http://babin.nelly.free.fr/ssm.htm
Locally saved at 05.14.2002


ssm

System Safety Monitor

Ce programe monitorise et accepte ou refuse à la demande tout changement dans la base de registre sur des clés importantes. Pendant qu'il tourne, vous êtes assurés qu'aucun programme (trojans, vers ou virus par exemple) ne sera capable de s'ajouter aux clés de démarrage automatique ou intercepter l'ouverture de fichiers *.exe.

Avertissement : ce petit programme est très puissant et réservé à des utilisateurs confirmés voire avancés pour certaines options : ne pas jouer à l'apprenti-sorcier.

Alternative moins puissante : StartupMonitor 1.02 (60 Ko) Ce petit logiciel vous préviendra chaque fois qu'une nouvelle application, légitime ou non, cherche à s'installer au démarrage de Windows. Très discret : ne se manifeste qu'en cas d'installation.

Il est primordial d'installer ces applications sur un système sain, exempt de virus ou de trojans

Caractéristiques
Vous permet de contrôler complètement quels programmes et applications peuvent s'ouvrir sur votre poste.

Deux modes : Utiisateur et Administrateur.
En mode Administrateur, vous pouvez déterminer vos préférences. Ce mode peut être protégé par mot-de-passe.
En mode Utilisateur, aucun changement à vos paramètres ne peut être effectué.

- Monitorise les clés importantes lors de l'installation de nouveaux programmes : bloque ou alerte en cas de changement sur les clés sous surveillance.
- Permet de contrôler quels programmes sont lancés au démarrage du système.
- Tient à jour une liste des applications en cours et permet de tuer une application immédiatement.
- Tient à jour une liste de programmes et applications interdits et autorisés facilement éditable.
- Autorise aussi le blocage de fenêtres spécifiques (sites Web inclus). Utilisateurs avancés
- Peut et doit être paramétré pour se lancer au démarrage du système.

Installation

System Safety Monitor v1.8.4 Free (273 Ko) Full information en Anglais : maxcomputing.narod.ru

Créer un nouveau dossier, par exemple C:\Program Files\System Safety Monitor.
Copier ssm.zip dans ce dossier et le décompresser. Le lancer en cliquant sur SysSafe.exe

Attention : Une fois installé dans un répertoire, SSM ne pourra plus être installé dans un autre. Suivre la procédure de désinstallation et supprimer le répertoire avant d'upgrader.

Fonctions de base et paramétrage

Complément idéal aux Firewall, Antivirus et Anti-trojans grâce au contrôle des programmes et processus autorisés sur votre système, vous protége par là même d'attaques potentielles de vers, virus et trojans.

Clés protégées par défaut :
- Autorun
Windows exécute automatiquement tous les programmes situés sous cette clé.
Bien que ces clés soient utilisées pour exécuter des programmes légitimes, certains vers et trojans peuvent aussi y accéder.

- Fichier.exe open
Trojans,virus et spywares changent souvent ces clés, leur permettant d'intercepter l'exécution de programmes pour s'y greffer.

- Mirabilis ICQ autorun
ICQ exécute automatiquement tous les programmes situés sous cette clé. Ces programmes peuvent configurer votre système lorsqu'ils sont lancés automatiquement au démarrage d'ICQ (ICQ est ce qui se fait de mieux point de vue insécurité)

Les différents onglets
Au démarrage SSM, son icone est visible dans le systray. Pour configurer SSM, double-cliquer sur l'icone et choisir Préférences.

Onglet Registry : la liste des clés de registre pour les programmes paramétrés pour démarrer automatiquement au démarrage du PC. Vous pouvez configurer ces clés autorun pour éviter le chargement des programmes inutiles au démarrage. Insert pour ajouter un nouveau programme, Delete pour l'enlever, ou Enter pour lancer l'objet sélectionné à l'aide du clavier.
Cocher "Monitor Registry" pour monitoriser les changements. Egalement accessible depuis les options du menu (clic droit sur l'icone)

Onglet Applications : la liste de tous les processus en cours. Vous pouvez arrêter un processus en le sélectionnant et en pressant la touche delete du clavier. Après avoir arrêter toutes les tâches inutiles, cocher "Watch App Activity". Quand une nouvelle application (non reprise dans Trusted List) est lancée, System Safety Monitor vous demandera si vous voulez l'ajouter dans cette liste, dans la Black List; l'ajouter dans la Trusted List pourl'Administrateur mais dans la Black List pour les utilisateurs, ou n'en permettre l'exécution que cette fois seulement.
Attention : Si vous décochez "Watch App Activity", tous les programmes et applications démarreront sans votre intervention.

Onglet Captions : permet ou autorise l'ouverture de n'importe quelle fenêtre dont la barre de titre contient les caractères ou texte que vous avez entré. S'applique aux programmes, documents Word, navigateurs, sites, etc... Attention : outil très puissant qui bloquera n'importe quelle fenêtre dont la barre-titre contient les caractères spécifiés : Prudence.
Les entrées ne sont pas sensible à la casse "R" et "r" sont traités de la même façon.
Les fenêtres contenant le texte spécifié dans n'importe quelle partie de la barre seront bloquées. Par exemple si vous avez entré simplement "exp" pour interdire l'accès aux utilisateurs à vos fichiers "Expenses" des programmes tels "Internet Explorer"et "Outlook Express" seront aussi bloqués !
Cette fonction ne s'applique qu'en User mode, non active en mode Administrateur.
Cocher "Filter window captions" pour l'appliquer. Option a éviter : très restrictif

Onglet Registry keys : s'y trouve la liste des clés de registre que le programme monitorise. Pour changer le status d'une clé, d'abord décocher "Monitor Registry", et entrer vos préférences. Recocher ensuite "Monitor Registry" Pour restaurer le paramétrage original, cliquer sur "Defaults".
Attention : Vous devez savoir EXACTEMENT ce que vous faites avant de changer quoique ce soit dans le registre, un point de restauration est toujours conseillé avant tout changement.

Onglet Trusted Applications : y apparaît la façon dont les programmes et applications ont été classifiés. Activez "Watch App Activity" à l'onglet Application. Vos préférences sont ajoutées dans les listes automatiquement et vous pourrez manuellement ajouter, supprimer ou reclasser un programme dans n'importe quelle catégorie.

(Explications détaillées en Eng dans le fichier SMM.txt accompagnant le logiciel)

Configurer le programme pour qu'il démarre au boot (minimisé dans le SysTray) en User ou Admin mode le mode Admin est suffisant pour le but recherché ici, le mode User est plus sécurisé si vous avez plusieurs utilisateurs afin de leur interdire de modifier vos préférences), Seul l'administrateur y a accès et peut protéger celui-ci par mot-de-passe (sensible à la casse)

Sélectionner un raccourci clavier pour montrer/cacher l'icone dans le SysTray.

Si la fenêtre "Alert" apparaît, cela signifie qu'une clé monitorisée a été modifiée, Rouge : l'action a été bloquée, vert, l'action a été autorisée. Vous pouvez bloquer ou débloquer l'action à l'aide de F2 ou F3 au clavier. Cette fenêtre est accessible depuis l'option "Show Log" du menu en cliquant du droit sur l'icone ou en cliquant "Show Log" dans Preferences