Adlice Protect (formerly RogueKiller) 16.7.0

[harlan4096]

V16.7.0 06/30/2026

- Updated to core 9.0.4 (carries 9.0.2 / 9.0.3 fixes folded in)
* Real-time stats are now pushed from the service to the UI once per second (total scanned, last scanned path) instead of polled
* Real-time protection: prefetch privilege LUIDs before kernel callbacks fire — faster verdict latency, less syscall churn
* Real-time protection environment refresh now also covers the user-context environment (previously only the system-context cache was kept up to date)
* Real-time protection service: faster startup (heavy work deferred until needed) and recovery from non-crash exits without WER prompts
* Real-time-protection filter pump: a faulting verdict callback no longer kills its worker thread or leaves the kernel waiting on a missed reply (fail-open by design, logged for diagnostics)
* Driver / kernel protocol hardening: event parsing validated against protocol version, monitors disabled before driver unload, filter unload authorized before retraction, IOCTL buffer leak fixed in monitored-path adds
* UCheck: deduplicates Microsoft Store entries against the registry and probes PE bitness from the executable
* UCheck: falls back to the PE FileVersion when DisplayVersion is malformed, so version comparisons stay accurate
* UCheck: matches MSI installers by ProductCode and validates downloaded file format before launching
* UCheck: caps winget upgrade / list at 30s wall-clock to recover from a wedged package manager
* UCheck: surfaces Wintrust signer / issuer / source on Installed entries so the UI can show trust details in tooltips
* UCheck: handles silent download failures more gracefully and adds the groundwork for TLS clock-skew bypass on systems with wrong dates
* Windows Update scan: 5-minute wall-clock cap on the WUA search, with proper recovery when the Windows Update service is wedged — the scan no longer hangs forever and the "Abort scan" button actually escapes immediately
* Reporting: hash the link target (LNK / JUNCTION) instead of the link itself, so the same content reports the same hash regardless of how it was linked
* Process::Create: bound the output-drain loop by wall-clock budget, preventing hangs when a child process spins on stdout
* Digital signature scanner: whitelist now correctly overrides blacklist / graylist findings
* Better behavior under Windows 11 for checkbox rendering in tabular controls
* System sounds no longer attempt playback on machines without audio output (fixes log noise on headless / VM hosts)
* Telemetry payload now includes a stable machine identifier; routes to staging when staging mode is enabled
* Dynamic configuration: staging mode, service URLs, app URLs, and tier prices
* Public report URL switched to panel.adlice.com
* Redesigned Activate (Marketing + License Registration) and My Account pages with a modern interface:
* Marketing pricing table: side-by-side Free / Personal / Technician tiers with highlighted features and tier color coding
* License Registration: tabbed flow (License key / Sign in / Free trial) with inline validation, spinner during server check, and a post-login license picker
* Free trial now exposes Personal and Technician options and disables itself once trial has been used on the machine
* Account view: status card colored by license state (valid / about to expire / invalid / trial), copy buttons for email and license key, calendar glyphs for dates
* Manage activations: per-machine cards, "Current machine" pill that protects your own activation from being removed by mistake
* Portable configuration card visible only for Technician licenses, with a modernized validity dropdown (Never expires hidden on trial)
* Refreshed support form
* Indonesian and Korean translation bundles now wired up
* Translation polish for Ukrainian installer strings (prefix fix) and Hungarian punctuation
* Notifications: lazy WinToast initialization to avoid AUMID side-effect on startup
* Form indicators (checkbox / tree / table) normalized to 16×16 px
* Real-time protection hardened against RPC failures during shutdown and kernel-callback paths
* NTFS attribute parsing: bounds checks against malformed volumes
* Crash reporter filters out dumps belonging to third-party host processes, and skips uploading any dump that doesn't belong to the program
* MalPE_AI: catch out-of-memory when converting model buffer
* Reduced memory copies when collecting Chrome / Edge preferences during scan
* Fixed Windows 11 issue where opening the AdliceDisabled folder spawned a stray Explorer window
* Fixed locale leak when formatting a zero size value
* Various stability and audit hardening
- Redesigned dashboard interface with modern card-based layout: shield badge with live score, KPI tiles for Scanned / Blocked / Quarantined, Quarantine / Scheduled Scans / Modules cards on the second row, with light and dark theme support
- New scan progress page: live status ring, current step / scanned / detected counters, threat-name + hover-path "Last Detection" row, rotating campaign banner kept intact
- Real-time module toggle: switches now respond instantly with a busy spinner while the service confirms, instead of bouncing back during the IPC round-trip
- Protection score now reflects which modules are active — turning off a single module no longer collapses the whole score to a single number; turning off everything is critical, not just a warning
- "Click to retry" link when the service is down, "Click to enable protection" link when every module is off — both wired to re-enable the right things with one tap
- Scan history chart: now distinguishes scan reports from their linked removal reports, so a scan whose detections were successfully removed shows green ("Threats removed") instead of red
- Last Detection on the dashboard is clickable when populated and navigates to the History → Events page
- Quarantine card: now shows the original path under each threat name (with a tooltip for long paths) and only shows the family badge when meaningful (no more duplicate "Cloud" next to "Cloud.Generic")
- Scheduled scans: day-of-week badge now displays correctly (was showing the literal format tokens), frequency labels match the Settings page wording, link reads "+ Add" when empty or "Modify →" when at least one entry exists
- Scan KPIs on the Protection card abbreviate large counts (1.2K / 12K / 1.2M) with the exact value on hover
- Default window size bumped to 1100x720 for better legibility
- Notifications now always render via the in-app renderer so elevated processes receive them reliably
- Translation refresh across 15 languages: added the new dashboard / scan-progress strings; previously-unfinished entries now cover Arabic, German, Spanish, Persian, French, Italian, Japanese, Dutch, Polish, Portuguese, Brazilian Portuguese, Turkish, Ukrainian, Simplified Chinese, Traditional Chinese
- Fixed rendering glitches on hybrid-GPU laptops (NVIDIA Optimus / Intel + NVIDIA) where parts of the dashboard would not paint
- RogueKillerShell: Version 1.3.0.0:
* Fixed: when loaded as a shell extension into Windows Explorer, no longer registers a system-wide crash redirection that captured Explorer crash dumps into the program's debug folder
* Installer now correctly replaces legacy 1.2.0.0 builds on upgrade
- RogueKillerMon: Version 1.3.0.0:
* Fixed: when injected into a host process, no longer registers a system-wide crash redirection that captured the host's crash dumps into the program's debug folder
* Installer now correctly replaces legacy 1.2.0.0 builds on upgrade

 RogueKiller | Documentation : Changelog • Adlice Software