Reply to thread

Message

<blockquote data-quote="NoVirusThanks" data-source="post: 702500" data-attributes="member: 68429">Here is a new v1.4 (pre-release) (test12):<a href="http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test12.exe" target="_blank">http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test12.exe</a>*** Please do not share the download link, we will delete it when we&#039;ll release the official v1.4 ***So far this is what&#039;s new compared to the previous pre-release:+ Improved the &quot;anti-exploit&quot; module used to block payloads+ You can now check\uncheck the apps monitored with &quot;anti-exploit&quot; module+ Created 3 tabs for grouping of rules+ Added %PROCESSSIGNER% and %PARENTSIGNER% vars for exclusions and custom-block rules+ Minor fixes and optimizationsThis pre-release version can be installed over the top of the previous one.New video of OSArmor tested against 30 doc\xls\swf\pdf exploits:<a href="https://www.youtube.com/watch?v=g90-lqBXNKM" target="_blank">Block Exploit Payloads with OSArmor</a>Here are the two new tabs on the Configurator:[ATTACH=full]177475[/ATTACH][USER=60675]@Sunshine-boy[/USER]That FP is generated by &quot;Block execution of unsigned processes on Roaming AppData&quot; and we may not fix it internally on OSArmor.You can add an exclusion rule like this to fix it:[code][%PROCESS%: C:\Users\Sunshine-boy\AppData\Roaming\VOS\Cameyo\PROG\%Program Files%\Cameyo\Packager.exe] [%PARENTPROCESS%: C:\Users\Sunshine-boy\Desktop\Cameyo.exe][/code]Alternatively you can allow all processes from Cameyo.exe:[code][%PARENTPROCESS%: C:\Users\Sunshine-boy\Desktop\Cameyo.exe][/code][USER=50782]@Windows_Security[/USER]I&#039;ve added 2 new vars %PROCESSSIGNER% and %PARENTSIGNER% for exclusions and custom-block rules.Let me know if they work fine if you&#039;ll test them.Strange, can you send me your C:\Windows\explorer.exe file via PM?</blockquote>

[QUOTE="NoVirusThanks, post: 702500, member: 68429"] Here is a new v1.4 (pre-release) (test12): [URL]http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test12.exe[/URL] *** Please do not share the download link, we will delete it when we'll release the official v1.4 *** So far this is what's new compared to the previous pre-release: + Improved the "anti-exploit" module used to block payloads + You can now check\uncheck the apps monitored with "anti-exploit" module + Created 3 tabs for grouping of rules + Added %PROCESSSIGNER% and %PARENTSIGNER% vars for exclusions and custom-block rules + Minor fixes and optimizations This pre-release version can be installed over the top of the previous one. New video of OSArmor tested against 30 doc\xls\swf\pdf exploits: [URL='https://www.youtube.com/watch?v=g90-lqBXNKM']Block Exploit Payloads with OSArmor[/URL] Here are the two new tabs on the Configurator: [ATTACH=full]177475[/ATTACH] [USER=60675]@Sunshine-boy[/USER] That FP is generated by "Block execution of unsigned processes on Roaming AppData" and we may not fix it internally on OSArmor. You can add an exclusion rule like this to fix it: [code] [%PROCESS%: C:\Users\Sunshine-boy\AppData\Roaming\VOS\Cameyo\PROG\%Program Files%\Cameyo\Packager.exe] [%PARENTPROCESS%: C:\Users\Sunshine-boy\Desktop\Cameyo.exe] [/code] Alternatively you can allow all processes from Cameyo.exe: [code] [%PARENTPROCESS%: C:\Users\Sunshine-boy\Desktop\Cameyo.exe] [/code] [USER=50782]@Windows_Security[/USER] I've added 2 new vars %PROCESSSIGNER% and %PARENTSIGNER% for exclusions and custom-block rules. Let me know if they work fine if you'll test them. Strange, can you send me your C:\Windows\explorer.exe file via PM? [/QUOTE]

Verification