Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 707300">Heads up if you forcefully restart the OSArmor processes it could break, I still remember VoodooShield... Easily broken and then it would require a full re-installation. You could try re-installing it for that matter though, I guess it wouldn&#039;t hurt to see if it changes anything for your situation.I have another thing for you to test if you&#039;re up for it but be careful because I am not sure about compatibility with your environment and I&#039;d hate for a BSOD to occur (since the next one relies on a product which does some hefty undocumented things).1. <a href="https://www.bleepingcomputer.com/download/pc-hunter/" target="_blank">PC Hunter Download</a> / <a href="http://www.majorgeeks.com/files/details/pc_hunter.html" target="_blank">Download PC Hunter&nbsp; - MajorGeeks</a>2. Run it as Administrator3. Navigate to the Kernel tab4. See if the NVT OSArmor device driver (*.sys) is in the list and post a screenshot of the results where it is displayed if it isHopefully it will be shown as having registered a &quot;CreateProcess&quot; callback, which represents PsSetCreateProcessNotifyRoutine/Ex/2 kernel-mode callback. If it isn&#039;t displayed then this indicates that the callback routine isn&#039;t being registered for whatever reason and this would be why the process monitoring is failing, so if you want to help narrow down the cause a bit more then this is the next step <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Deleted member 65228, post: 707300"] Heads up if you forcefully restart the OSArmor processes it could break, I still remember VoodooShield... Easily broken and then it would require a full re-installation. You could try re-installing it for that matter though, I guess it wouldn't hurt to see if it changes anything for your situation. I have another thing for you to test if you're up for it but be careful because I am not sure about compatibility with your environment and I'd hate for a BSOD to occur (since the next one relies on a product which does some hefty undocumented things). 1. [URL='https://www.bleepingcomputer.com/download/pc-hunter/']PC Hunter Download[/URL] / [URL='http://www.majorgeeks.com/files/details/pc_hunter.html']Download PC Hunter - MajorGeeks[/URL] 2. Run it as Administrator 3. Navigate to the Kernel tab 4. See if the NVT OSArmor device driver (*.sys) is in the list and post a screenshot of the results where it is displayed if it is Hopefully it will be shown as having registered a "CreateProcess" callback, which represents PsSetCreateProcessNotifyRoutine/Ex/2 kernel-mode callback. If it isn't displayed then this indicates that the callback routine isn't being registered for whatever reason and this would be why the process monitoring is failing, so if you want to help narrow down the cause a bit more then this is the next step :) [/QUOTE]

Verification