NoVirusThanks OSArmor

[shmu26]

We've released the official OSArmor v1.4 (final) version:




You can download it from our website:
Prevent Malware and Ransomware with OSArmor | NoVirusThanks

We'll start to work on v1.5 from middle of July * See below for important features in the todo list *




Thanks everyone for the help, suggestions and testing!

If you find any FP or issue please share them here.

Thanks, Andreas

 

[shmu26]

@NoVirusThanks: Please add our old request back to the wishlist, for a clear difference in icon color between on and off.

 

[NoVirusThanks]

Sure, they're already in the todo list =)

 

[Hi Brothers]

Not sure if this issue has already been reported: when notifications are enabled, after the notification is gone, the notification window remains when holding Alt + Tab which switches between active windows

Example, that notification is from a few hours ago (I was messing with the options), it shouldn't be shown when holding Alt + Tab, and cycling with Tab while continuously holding Alt

 

[Deleted member 178]

Not happening on my side.

 

[redsworn]

Not sure if this issue has already been reported: when notifications are enabled, after the notification is gone, the notification window remains when holding Alt + Tab which switches between active windows

Example, that notification is from a few hours ago (I was messing with the options), it shouldn't be shown when holding Alt + Tab, and cycling with Tab while continuously holding Alt

Are you on Win 8.1? Because I had similar issue on Win 8.1 when I tested this software.

 

[Hi Brothers]

Are you on Win 8.1? Because I had similar issue on Win 8.1 when I tested this software.

Windows 10 Pro 1803 17134.112 , happens with Voodoo Shield notifications sometimes too, but it's rare, with OSArmor it happens every time (?) I think

 

[Azure]

You know now that version 1.4 has been officially released, it would be nice if someone could test it. Both with default settings and whatever advance setting the tester thinks would be useful.

 

[shmu26]

You know now that version 1.4 has been officially released, it would be nice if someone could test it. Both with default settings and whatever advance setting the tester thinks would be useful.

I don't think that it differs substantially from the last beta build. If it had differences, they too would need to be tested prior to the stable release. So I don't think there should be any surprises under the wrapping.

 

[codswollip]

I really don't want to throw this out here... but just in case someone else has a related issue...

I uninstalled the last beta and installed 1.4. Within an hour of that, I mounted a Macrium Reflect image to grab a file version I needed. After copying the file from my image, I attempted to dismount the image. Nothing happened. When I tried to repeat that I noticed that my OS (Win8.1 x64) was unresponsive. The mouse moved... but nothing I clicked, or keyboarded responded. I had to forcibly power off.

When I rebooted I arrived at the same place. My desktop loaded, but many of my tray icons were not loaded. I tried to bring up Task Manager, but again the mouse clicks did nothing. Again I forcibly powered off, and then booted into Macrium to reimage my machine.

This was not fun. Since I was unable to check Task Manager, Event Viewer, etc., I'm unsure what brought this on. I suspect OSA didn't like what Macrium was doing in the mount/dismount cycle... but I really don't know. I'm not of the posture to repeat this at this time, and it's possible that the OSA 1.4 install is unrelated. But I thought I'd share my experience if there is anyone running this combination that might be challenged to test this. FWIW, I had many of the advanced settings checked (none red, but several orange).

 

[Deleted member 178]

@Telos i use OSA with Macrium, no issues.

 

[shmu26]

I really don't want to throw this out here... but just in case someone else has a related issue...

I uninstalled the last beta and installed 1.4. Within an hour of that, I mounted a Macrium Reflect image to grab a file version I needed. After copying the file from my image, I attempted to dismount the image. Nothing happened. When I tried to repeat that I noticed that my OS (Win8.1 x64) was unresponsive. The mouse moved... but nothing I clicked, or keyboarded responded. I had to forcibly power off.

When I rebooted I arrived at the same place. My desktop loaded, but many of my tray icons were not loaded. I tried to bring up Task Manager, but again the mouse clicks did nothing. Again I forcibly powered off, and then booted into Macrium to reimage my machine.

This was not fun. Since I was unable to check Task Manager, Event Viewer, etc., I'm unsure what brought this on. I suspect OSA didn't like what Macrium was doing in the mount/dismount cycle... but I really don't know. I'm not of the posture to repeat this at this time, and it's possible that the OSA 1.4 install is unrelated. But I thought I'd share my experience if there is anyone running this combination that might be challenged to test this. FWIW, I had many of the advanced settings checked (none red, but several orange).

I don't have a problem with mounting and unmounting Macrium, and I have most of the advanced settings enabled in OSA.
I am just throwing out a guess: if you are using Windows Defender, and you enabled Controlled folder access, that is probably the problem. You will need to whitelist a few processes for Macrium to work smoothly, and it isn't immediately evident which ones.

 

[CMLew]

Not sure if this issue has already been reported: when notifications are enabled, after the notification is gone, the notification window remains when holding Alt + Tab which switches between active windows

Example, that notification is from a few hours ago (I was messing with the options), it shouldn't be shown when holding Alt + Tab, and cycling with Tab while continuously holding Alt

I dun hv this issue too.

Sidenote: that's one hell of a browser with over 80+ tabs.

 

[Azure]

I don't have a problem with mounting and unmounting Macrium, and I have most of the advanced settings enabled in OSA.
I am just throwing out a guess: if you are using Windows Defender, and you enabled Controlled folder access, that is probably the problem. You will need to whitelist a few processes for Macrium to work smoothly, and it isn't immediately evident which ones.

I haven't used controlled folder, so it's possible Microsoft already does this.

But couldn't they implement the smartscreen database into controlled folder so that users don't have to constantly whitelist processes?

Either way, it does sound like Microsoft could have handle it better.

 

[shmu26]

I haven't used controlled folder, so it's possible Microsoft already does this.

But couldn't they implement the smartscreen database into controlled folder so that users don't have to constantly whitelist processes?

Either way, it does sound like Microsoft could have handle it better.

Controlled folder access is a real mess.

 

[Deleted member 178]

But couldn't they implement the smartscreen database into controlled folder so that users don't have to constantly whitelist processes?

Either way, it does sound like Microsoft could have handle it better.

MS had good ideas with Exploit Guard; Controlled Folder, etc...but the way they implemented them is 100% BS, making them unpractical.

 

[codswollip]

I am just throwing out a guess: if you are using Windows Defender, and you enabled Controlled folder access, that is probably the problem. You will need to whitelist a few processes for Macrium to work smoothly, and it isn't immediately evident which ones.

I think you may have pointed me in a good direction here. I'll check this out when I'm ready to brave the waters. Presently I'm consumed re-doing my network after repeated power outages rendered my router incommunicado.

 

[JB007]

Hello,
How can I report a false positive ?

 

[Deleted member 178]

Hello,
How can I report a false positive ?

by posting it here, copy-paste the log part of the FP.

 

[JB007]

by posting it here, copy-paste the log part of the FP.

Thanks @Umbra
Hello @NoVirusThanks , I think below is a false positive:

Date/Time: 02/07/2018 10:02:41
Process: [4728]C:\Users\Robert\RS\AV\GDATA\Nouveau dossier\GDATAMeltdownSpectreScan.exe
Process MD5 Hash: D9868B987E6B85ABC4DDF66042057D41
Parent: [4108]C:\Windows\explorer.exe
Rule: BlockProcessesOnSuspiciousFolders
Rule Name: Block processes located in suspicious folders
Command Line: "C:\Users\Robert\RS\AV\GDATA\Nouveau dossier\GDATAMeltdownSpectreScan.exe"
Signer: G DATA Software AG
Parent Signer: Microsoft Windows
User/Domain: Robert/ROBERT-PC
System File: False
Parent System File: True
Integrity Level: Medium
Parent Integrity Level: Medium


Date/Time: 02/07/2018 10:02:07
Process: [5372]C:\Users\Robert\RS\AV\GDATA\GDATAMeltdownSpectreScan.exe
Process MD5 Hash: D9868B987E6B85ABC4DDF66042057D41
Parent: [4108]C:\Windows\explorer.exe
Rule: BlockProcessesOnSuspiciousFolders
Rule Name: Block processes located in suspicious folders
Command Line: "C:\Users\Robert\RS\AV\GDATA\GDATAMeltdownSpectreScan.exe"
Signer: G DATA Software AG
Parent Signer: Microsoft Windows
User/Domain: Robert/ROBERT-PC
System File: False
Parent System File: True
Integrity Level: Medium
Parent Integrity Level: Medium

I do not understand why OSA did not react when the exe is on the desktop ?