Released a new version v1.3:
Prevent Malware and Ransomware with OSArmor | NoVirusThanks
[22-Dec-2017] v1.3.0.0
+ Block processes with known fake extensions (i.e .pdf.exe)
+ Prevent WMIC from using "process call create" via cmdline
+ Block command-lines that match *\Start Menu\Programs\Startup\*
+ Block command-lines that match shellcode-like patterns
+ Block execution of any process related to UltraVNC (unchecked by default)
+ Block execution of any process related to RealVNC (unchecked by default)
+ Block execution of any process related to Nir Sofer (unchecked by default)
+ Block execution of any process related to LogMeIn (unchecked by default)
+ Block known Bitcoin miners command-lines
+ Prevent wbadmin.exe from deleting backup catalog
+ Block unsigned processes located on root folder (i.e C:\) (unchecked by default)
+ Block SOAP WSDL requests via command-line
+ Block execution of syskey.exe
+ Block execution of cipher.exe
+ Number of pre-defined rules increased to 60
+ Do not delete the settings when the program is uninstalled
+ Improved showing of main window from tray icon
+ Fixed many false positives
+ Improved internal rules
All reported FPs should be fixed.
On the next version we will add support for exclusions.
@AtlBo
Yeah, we'll group rules later (first just want to make sure they are fine without FPs).
@Glashouse
We'll add option to disable\enable protection soon, it is on the todo list.
@harlan4096
That FP is fixed on this new version, thanks for testing
Prevent Malware and Ransomware with OSArmor | NoVirusThanks
[22-Dec-2017] v1.3.0.0
+ Block processes with known fake extensions (i.e .pdf.exe)
+ Prevent WMIC from using "process call create" via cmdline
+ Block command-lines that match *\Start Menu\Programs\Startup\*
+ Block command-lines that match shellcode-like patterns
+ Block execution of any process related to UltraVNC (unchecked by default)
+ Block execution of any process related to RealVNC (unchecked by default)
+ Block execution of any process related to Nir Sofer (unchecked by default)
+ Block execution of any process related to LogMeIn (unchecked by default)
+ Block known Bitcoin miners command-lines
+ Prevent wbadmin.exe from deleting backup catalog
+ Block unsigned processes located on root folder (i.e C:\) (unchecked by default)
+ Block SOAP WSDL requests via command-line
+ Block execution of syskey.exe
+ Block execution of cipher.exe
+ Number of pre-defined rules increased to 60
+ Do not delete the settings when the program is uninstalled
+ Improved showing of main window from tray icon
+ Fixed many false positives
+ Improved internal rules
All reported FPs should be fixed.
On the next version we will add support for exclusions.
@AtlBo
Yeah, we'll group rules later (first just want to make sure they are fine without FPs).
@Glashouse
We'll add option to disable\enable protection soon, it is on the todo list.
@harlan4096
That FP is fixed on this new version, thanks for testing
Last edited:
anymore, well, but it's an excellent program.
