NoVirusThanks OSArmor

[DavidLMO]

the easy whistling option

??? What is this

 

[_CyberGhosT_]

@_CyberGhosT_: The dev made it an open beta. Why not just go ahead and do it?

rgr, I didn't notice it was open beta, thanks

 

[ichito]

Here is a new v1.4 (pre-release)

Have you tried also to exclude OSArmor on Privatefirewall?

You should enable all "Allow" options for OSArmorDevSvc.exe, OSArmorDevUI.exe, OSArmorDevCfg.exe.

Or add OSA to trusted publisher list - it's avaliable in small box "Trust this Publisher" on the top of alert. The button to open and manage such list you can find in "Settings/tab Advanced.

 

[NoVirusThanks]

Here is a new v1.4 (pre-release) (test18):
http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test18.exe

*** Please do not share the download link, we will delete it when we'll release the official v1.4 ***

So far this is what's new compared to the previous pre-release:

+ Fixed "black background" issue on Windows XP
+ Fixed "tray icon not shown" issue on Windows XP
+ Fixed startup issues on Windows XP
+ Improved internal rules
+ Fixed false positives

To install this pre-release, first uninstall the old one.

@Stas

Let me know if this test18 fixes the issues you reported on XP.

Other users on Wilders confirmed the issues are fixed in this test18 build.

@ForgottenSeer 58943

The FP with Bullguard should be fixed now, thanks for reporting it.

@l0rdraiden

We'll discuss about an "ask" dialog and a button to automate exclusions (or similar) on the next version.

For now we added "Exclusions Helper" GUI to facilitate the writing of exclusions.

 

[Chimaira]

I have been testing each release silently, and I can report I have experienced zero bugs.

 

[Sunshine-boy]

OSArmor doesn't autostart on Sua acc.

 

[Chimaira]

OSArmor doesn't autostart on Sua acc.

Hmm, it autostarts for me on SUA

 

[Stas]

@Stas

Let me know if this test18 fixes the issues you reported on XP.

Other users on Wilders confirmed the issues are fixed in this test18 build.

test18 boots in 16sec very fast on my XP and Privatefirewall service started on boot so problem fixed

 

[Evjl's Rain]

I also noticed in all versions that sometimes, OSArmorDevUI.exe failed to start on boot (fast boot/startup) on my windows 8.1 laptop. OSArmorDevSvc.exe is fine
I'm trying test18 and I will report back later if it behaves the same

today, I got a blocked message from OSA which blocks slimjet's build-in update (failed to extract the archive). I solved myself by making an exclusion

[%PROCESS%: C:\Users\*\AppData\Local\Temp\Slimjet\Slimjet Archive.exe] [%PARENTPROCESS%: *\Slimjet\slimjet.exe] [%PARENTSIGNER%: FlashPeak Inc.]

this is the message

Date/Time: 1/10/2018 3:11:47 PM
Process: [3968]C:\Users\evjlsrain\AppData\Local\Temp\Slimjet\Slimjet Archive.exe
Parent: [3840]C:\Program Files\Slimjet\slimjet.exe
Rule: AntiExploitSlimJet
Rule Name: (Anti-Exploit) Protect SlimJet Browser
Command Line: "C:\Users\EVJLSR~1\AppData\Local\Temp\Slimjet\Slimjet Archive.exe" -o"C:\Users\evjlsrain\AppData\Local\Slimjet\User Data\update_x64"
Signer:
Parent Signer: FlashPeak Inc.

EDIT: test 18 behaves the same. OSArmorDevUI.exe didn't start on fast boot on 1 out of 2 occasions. Not sure what causes it.
could you please add OSArmorDevUI.exe to startup or schedule task so it can boot properly?

 

[Sunshine-boy]

failed to start on boot

Same here but sometimes not always!

 

[Chimaira]

As far as all the options in the advanced tab, how many of them are simply security measures for the paranoid vs reasonable additions to security?

 

[Windows_Security]

@Chimaira and others impressed and overwhelmed by the many options of OSarmor

Andreas has put in many options of which some have a loose, medium and strict block variant. Some rules are a mystery because it is impossible to guess what is blocked ((e.g. the advanced rule: "block specific processes from self executing").

For members hesitating to take the dive, I have a composed a "safe" list of items to be blocked (compare it with Black Viper's safe list of Windows Processes to be disabled). Download the OsArmor.txt and rename it OSArmor.rules

Import this ruleset by clicking on OSarmor tray icon. Click the "Open Configurator" button, when configurator opens click the "Load from file" button and select the renamed OS.Armor.rules file. Next click on the "Anti-Exploit" tab and select all the programs you have running on your PC (so only enable the programs you recognize). Close the configurator.

Finally download the Exclusions.txt (this to make sure you can always install windows updates, might Microsoft use a way to update the system which is suspicious and blocked by the hardening rules of OSarmor).

Right click the OSarmor icon in the system tray, select Manage Exclusions. Allow the UAC elevation prompt. When the "NoVirusThanks OSArmor Exclusion Helper" screen appears click the "Open Exclusions" button. Now the content of the Exclusions.db file appears in Notepad. Open the Exclusions.txt file and copy and paste all lines from the Exclusions.txt to the Exclusions.db (you have two instances of Notepad open when you follow instructions correctly). Save the EXclusions.db and close the Exclusions.txt

 

[Prorootect]

@Windows_Security
Thank you very much!, but it's for NVT to natively do all this...I think

 

[Windows_Security]

@Windows_Security
it's for NVT to natively do all this...I think

Yep, fully agree with you, but give Andreas some time. Maybe in future @NoVirusThanks adds a slider and automate this for the average PC-user (with loose, medium, strict and paranoid as options on the slider). For the time being this is a safe set of options.

@Andy Ful would you please have a look and dubbel check the options I have enabled (but more important deselected). The idea is to allow scripts and shell (don't disable them), but block them from acting suspiciously (e.g add them to exploit protection and block spawning of processes by them).

 

[shmu26]

I think most users could enable everything except for the settings that block all unsigned processes in appdata. Would you agree?

 

[shmu26]

I think most users could enable everything except for the settings that block all unsigned processes in appdata. Would you agree?

Even the settings that block all unsigned processes in appdata could probably be enabled by most users, but only if the user is ready to disable OSA when installing and updating programs. Otherwise, he will be very frustrated.

 

[Sunshine-boy]

Would you agree?

Ye, it stopped my Cameyo and kerish doctor from installing.a lot of FP!

 

[Chimaira]

@Chimaira and others impressed and overwhelmed by the many options of OSarmor

Andreas has put in many options of which some have a loose, medium and strict block variant. Some rules are a mystery because it is impossible to guess what is blocked ((e.g. the advanced rule: "block specific processes from self executing").

For members hesitating to take the dive, I have a composed a "safe" list of items to be blocked (compare it with Black Viper's safe list of Windows Processes to be disabled). Download the OsArmor.txt and rename it OSArmor.rules

Import this ruleset by clicking on OSarmor tray icon. Click the "Open Configurator" button, when configurator opens click the "Load from file" button and select the renamed OS.Armor.rules file. Next click on the "Anti-Exploit" tab and select all the programs you have running on your PC (so only enable the programs you recognize). Close the configurator.

Finally download the Exclusions.txt (this to make sure you can always install windows updates, might Microsoft use a way to update the system which is suspicious and blocked by the hardening rules of OSarmor).

Right click the OSarmor icon in the system tray, select Manage Exclusions. Allow the UAC elevation prompt. When the "NoVirusThanks OSArmor Exclusion Helper" screen appears click the "Open Exclusions" button. Now the content of the Exclusions.db file appears in Notepad. Open the Exclusions.txt file and copy and paste all lines from the Exclusions.txt to the Exclusions.db (you have two instances of Notepad open when you follow instructions correctly). Save the EXclusions.db and close the Exclusions.txt

Thanks for this. I will be testing this configuration out. Will report back how it goes.

 

[Windows_Security]

Thanks for this. I will be testing this configuration out. Will report back how it goes.

Sorry I checked the rules, had one of my rules enabled, corrected it, please use the latest OSArmor.txt.

 

[DavidLMO]

The idea is to allow scripts and shell (don't disable them), but block them from acting suspiciously (e.g add them to exploit protection and block spawning of processes by them).

Would you please show an example of what this is? I know it would help me (and like others) to understand this important item. I have scratched my head trying to figure out to do just this thing.

TYVM