NoVirusThanks OSArmor

[NoVirusThanks]

A quick update:

We've officially released NoVirusThanks OSArmor v1.6.2:
Download OSArmor for Windows 7, 8, 10 (32 & 64-bit) | OSArmor

Changelog 14 Nov 2021:

+ Added Block installation of Windows Apps via AppInstaller
+ Fixed UTF-8 encoding when loading TrustedVendors.db
+ Fixed UTF-8 encoding on Exclusions Helper
+ Improved detection of some known bad behaviors
+ Fixed all reported false positives
+ Minor improvements

The new protection option "Block installation of Windows Apps via AppInstaller" can be used to mitigate this:

BazarLoader ‘call me back’ attack abuses Windows 10 Apps mechanism

The unusual technique invokes the Windows App Installer to deliver malware

news.sophos.com

Here is a screenshot of when "ms-appinstaller:" HREF link is clicked:

The targets of the attack are (for now) companies, so home users may not need to enable that option.

If you find FPs or issues please let me know.

Thanks guys!

 

[bjm_]

A quick update:
We've officially released NoVirusThanks OSArmor v1.6.3:
Download OSArmor for Windows 7, 8, 10 (32 & 64-bit) | OSArmor
[20-Nov-2021] v1.6.3.0
+ Fixed all reported false positives
+ Minor improvements

 

[bjm_]

November is the month of updates

We've officially released NoVirusThanks OSArmor v1.6.4:
Download OSArmor for Windows 7, 8, 10 (32 & 64-bit) | OSArmor
[21-Nov-2021] v1.6.4.0
+ Improved installer scripts
+ Added more signers to Trusted Vendors list
+ Fixed Merge TrustedVendors.db with updated list when product is upgraded

 

[NoVirusThanks]

Another quick update:

We've officially released NoVirusThanks OSArmor v1.6.5:

Download OSArmor for Windows 7, 8, 10, 11 (32 & 64-bit) | OSArmor

Download the setup file for OSArmor Personal, Business and Enterprise version for Windows 7, 8, 10, 11 (32 & 64-bit). All executable files are digitally signed and free from adware.

www.osarmor.com

Changelog:

+ Fixed all reported false positives
+ Added new internal rules to block suspicious behaviors
+ Minor improvements

We've added covering of more LOLbins, and also InstallerFileTakeOver PoC:

New Windows zero-day with public exploit lets you become an admin

A security researcher has publicly disclosed an exploit for a new Windows zero-day local privilege elevation vulnerability that gives admin privileges in Windows 10, Windows 11, and Windows Server.

www.bleepingcomputer.com

Looks like the PoC exploits Microsoft Edge's Elevation Service to elevate the payload as SYSTEM (local privilege escalation).

As always, if you find FPs or issues please let me know.

Thanks!

 

[plat]

I already box Edge w/dropped Admin. rights but this will add to the protection and any future exploits (not that they're common to begin with for Home users). Exited UI and installed over top. Until next time....

PS: It seems this new rule is under the Main Protections in orange-colored text so it's easy to find and was already enabled when I searched for it.

 

[bjm_]

PS: It seems this new rule is under the Main Protections in orange-colored text so it's easy to find and was already enabled when I searched for it.

Um, what new rule did you search?
I think ... + Added new internal rules to block suspicious behaviors are "internal rules".

 

[Mops21]

Hi all

Here is a pre-release test build of OSArmor Personal 1.6.6

NoVirusThanks OSArmor: An Additional Layer of Defense

No, never had to start it manually myself as it's always been set as "Automatic" in Services. It starts with Windows also as does the other exe...

www.wilderssecurity.com

https://downloads.osarmor.com/osa_v1.6.6_personal_setup_test1.exe

Changelog so far:

+ Fixed all reported false positives
+ On OSArmor UI you can view the last applied protection profile
+ Added button Contact Us on OSArmor UI on main menu Help
+ Small improvements on OSArmor UI design
+ Added Block unsigned processes with high privileges on user space
+ Added Block unsigned processes with system privileges on user space
+ Added new internal rules to block suspicious behaviors
+ Updated NVT License Manager with latest version
+ Minor improvements

Regarding this "On OSArmor UI you can view the last applied protection profile" you will have to re-apply the protection profile so it will be saved in the registry and OSArmor UI can correctly show it, else it will show "Basic Protection (Default)".

The protection option "Block unsigned processes with system privileges" can be useful to mitigate InstallerFileTakeOver PoC (or other similar PoCs) since when it overwrites the target file to gain system privileges the payload is unsigned:

Let me know if you find any issues.

With best Regards
Mops21

 

[bjm_]

Here is a new pre-release OSArmor Personal v1.6.6 (test 3):

https://downloads.osarmor.com/osa_v1.6.6_personal_setup_test3.exe
What's new compared to previous test 1 changelog:

+ Added more signers to Trusted Vendors list
+ Added Block unsigned processes modified less than 15 days ago
+ Added Block processes marked as hidden files

 

[ItsReallyMe]

is this software free?

 

[Gandalf_The_Grey]

is this software free?

No, License Type: Shareware

Prevent Malware & Ransomware Infections on Windows PC | OSArmor

OSArmor is a Windows application that focuses on preventing malware and ransomware infections by blocking malware delivery methods and suspicious processes behaviors.

www.osarmor.com

Pricing for OSArmor Personal, Business & Enterprise | OSArmor

You can purchase OSArmor Personal (for Home use), Business and Enterprise. View available pricing plans to purchase OSArmor licenses for Windows PC.

www.osarmor.com

 

[bjm_]

Version 1.6.6 of OSA released.

Code:
+ Fixed all reported false positives
+ On OSArmor UI you can view the last applied protection profile
+ Added button Contact Us on OSArmor UI on main menu Help
+ Small improvements on OSArmor UI design
+ Added more signers to Trusted Vendors list
+ Added Block unsigned processes with high privileges on user space
+ Added Block unsigned processes with system privileges on user space
+ Added Block unsigned processes modified less than 15 days ago
+ Added Block processes with hidden file (+H) disk attribute
+ Added new internal rules to block suspicious behaviors
+ Updated NVT License Manager with latest version
+ Minor improvements
Change log: Changelog History | OSArmor
Download: Download OSArmor for Windows 7, 8, 10 (32 & 64-bit) | OSArmor

Users that installed the pre-release test 1 and test 3 builds should upgrade to the official release.

 

[bjm_]

We've released OSArmor v1.6.7:
Here is the changelog:

+ Fixed all reported false positives
+ Removed Block unsigned processes modified less than 15 days ago
+ Improved internal rules to block suspicious behaviors
+ Improved detection of processes signed with a malformed certificate
+ Added Block signers known to bundle installers with adware
+ Improved detection of some known bad behaviors
+ Improved the saving of new protection options during an update
+ Improved installer and uninstaller scripts
+ Minor improvements

The option "Block unsigned processes modified less than 15 days ago" was causing too many FPs, thus we have removed it. Better to use the already present option "Block unsigned processes on user space" if needed.

Another important update is that now when the product is upgraded it correctly apply new protection rules based on protection profile.

Change log: Changelog History | OSArmor
Download: Download OSArmor for Windows 7, 8, 10 (32 & 64-bit) | OSArmor

 

[NoVirusThanks]

Here is a small Xmas gift for everyone:

Use coupon code XMAS2021 for 𝟰𝟬% 𝐎𝐅𝐅 on OSArmor Personal:

Pricing for OSArmor Personal, Business & Enterprise | OSArmor

You can purchase OSArmor Personal (for Home use), Business and Enterprise. View available pricing plans to purchase OSArmor licenses for Windows PC.

www.osarmor.com

Valid until 31 December 2021 for OSArmor Personal version | The discount is permanent and applies to all next renewals.

Happy and warm holidays to everyone

 

[ItsReallyMe]

what this does " Block execution of format.com" ? it prevent a drive from formatting or what?

 

[bjm_]

what this does " Block execution of format.com" ? it prevent a drive from formatting or what?

NoVirusThanks - Support wrote:
Format.com is a system process used to format a disk, more info:
What is format.com?
Some companies requested to add that rule to block its execution.
Hope that helps.
Best regards,
Andreas

~ admitting the "" was ?

 

[steven168]

is this software free?

it is free till OSArmor 1.4.3.

i still using it.

 

[ItsReallyMe]

~ admitting the "" was ?
View attachment 263180

okii thanks!

 

[Gandalf_The_Grey]

Here is a pre-release test build for OSArmor Personal v1.6.8:

https://downloads.osarmor.com/osa_v1.6.8_personal_setup_test1.exe

This is the changelog so far:
+ Fixed all reported false positives
+ Added more signers to Trusted Vendors list
+ Improved internal rules to block suspicious behaviors
+ Improved detection of malformed/obfuscated command-lines
+ Minor improvements

If you find issues or FPs please let me know.

NoVirusThanks OSArmor: An Additional Layer of Defense

Those versions are OK. Just as bjm posted. Yesterday I found a post about OSA v1.5 where Andreas said that the Licence manager will stay at 1.3. I...

www.wilderssecurity.com

 

[Gandalf_The_Grey]

Here is a pre-release test 2 for OSArmor Personal v1.6.8:

https://downloads.osarmor.com/osa_v1.6.8_personal_setup_test2.exe

This is the changelog so far:
+ Fixed all reported false positives
+ Added more signers to Trusted Vendors list
+ Added Block execution of any process related to Python
+ Improved internal rules to block suspicious behaviors
+ Improved detection of malformed/obfuscated command-lines
+ Minor improvements

If you find issues or FPs please let me know.

@plat1098

FPs you have reported should be fixed now.

NoVirusThanks OSArmor: An Additional Layer of Defense

Those versions are OK. Just as bjm posted. Yesterday I found a post about OSA v1.5 where Andreas said that the Licence manager will stay at 1.3. I...

www.wilderssecurity.com

 

[NoVirusThanks]

Here is a pre-release test 5 for OSArmor Personal v1.6.8:

https://downloads.osarmor.com/osa_v1.6.8_personal_setup_test5.exe

This is what's new compared to the previous test build:

+ Fixed some false positives on Windows Server 2016
+ Added Block any process related to Jernej Simončič (wget & netcat signed)
+ Added Block execution of wget.exe
+ Include process and parent process file size in blocked-process events
+ Improved monitoring of processes with large file size (e.g 50+ MB)

If you find issues or FPs please let me know.