Here is a pre-release test 8 version of OSArmor PERSONAL v1.7.8:
Wilders Security Forum Post Link
Here is a pre-release test 6 version of OSArmor PERSONAL v1.7.8: https://downloads.osarmor.com/osarmor-personal-1-7-8-setup-test6.exe You can...
www.wilderssecurity.com
Code:
Only added logging to file of Startup folder rules:
Date/Time: 09/08/2022 12:55:46
StartUp Folder File Deleted: C:\Users\Dev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Malware.lnk
Rule: AutoDeleteFilesOnStartupFolder
Rule Name: Automatically delete ANY file on Startup folder of ANY user
Date/Time: 09/08/2022 12:54:46
StartUp Folder Registry Key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
StartUp Folder Registry Value: Startup
StartUp Folder Registry Data Modified: %TEMP%\09402901\
StartUp Folder Registry Data Restored: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Rule: ProtectStartupFolderRegistryData
Rule Name: Protect original Registry Startup folder locations
@bjm_
The two options are not auto-enabled on Extreme protection.
They need to be enabled manually.
@moredhelfinland
We have users that use OSA on Enterprise LTSC and reported no issues so far.
OSA uses a kernel-mode driver to monitor processes executions and OSArmorDevSvc is a Windows Service.
OSA doesn't monitor registry keys or such, it monitors and blocks suspicious processes.
A malware to be able to edit registry or perform other tasks needs to be executed in the system, if the process is blocked or if the infection chain is stopped then the system is not altered.
That is the point of OSA: prevent malware/ransomware infection by blocking malware delivery methods and suspicious processes.
With Extreme protection you can "lockdown" the system (it blocks unsigned processes and processes signed by unknown vendors).
Here is OSA in action with recent malware samples and file types (LNK/ISO/IMG/etc):
@itman
OSA protects from suspicious processes started from LNK shortcuts, here is the chapter were we test malicious LNK files:
Also, the most malware will drop a malicious .lnk file to this directory.
A malware could drop any file there, such as vbs/js/vbe/wsf/hta/exe/scr/pif/com/bat/lnk/url/etc.
Better to delete any file type since if a file is dropped here it is done with the objective to execute the file when the PC starts.
OSA already blocks malware delivery methods so the Startup folder is not an issue (if the process/infection chain is stopped no file will be dropped there).
Additionally, OSA starts before Windows runs the files on Startup folder, so again no issues here:
But we wanted to add options to keep the Startup folder empty (we don't allow for exclusions there).
With best Regards
Mops21
).
