Reply to thread

Message

<blockquote data-quote="NoVirusThanks" data-source="post: 712965" data-attributes="member: 68429">Here is a new v1.4 (pre-release) (test36):<a href="http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test36.exe" target="_blank">http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test36.exe</a>*** Please do not share the download link, we will delete it when we&#039;ll release the official v1.4 ***So far this is what&#039;s new compared to the previous pre-release:+ Improved detection of suspicious folders+ Improved detection of suspicious command-lines+ Block execution of processes on All Users folder+ Prevent attrib.exe from setting +h or +s attributes+ Exclude &quot;/a&quot; execution for &quot;Block execution of Shutdown.exe&quot;+ Renamed &quot;Block execution of PsExec.exe from Sysinternals&quot; to &quot;Block execution of PsTools Suite from Sysinternals&quot;+ Block execution of PsTools Suite from Sysinternals+ Renamed &quot;Prevent reg.exe from hijacking OSArmor settings&quot; to &quot;Enable OSArmor self defense (basic)&quot;+ Enable OSArmor self defense (basic) -&gt; Moved on Settings+ Improved detection of known fake file extensions+ User must be in the Administrators Group to change protection (Configurator -&gt; Settings, disabled by default)+ Block execution of taskkill.exe+ Minor fixes and optimizationsTo install it, first uninstall the previous build, then reboot (not really needed but may help), and install the new build.The basic self defense now blocks net.exe, net1.exe, taskkill.exe, sc.exe, reg.exe, pskill.exe, etc from terminating\hijacking OSArmorDevSvc.It also prevents silent uninstallation via /VERYSILENT and /SILENT (unins000.exe).We&#039;ll add better self defense via kernel-mode driver in the next version.[USER=58943]@ForgottenSeer 58943[/USER]We definitely welcome such possibilities.[USER=26718]@silversurfer[/USER]Is that error appearing for the first time with test 35 or was it present also in older builds?[USER=29489]@Azure Phoenix[/USER]That would be awesome!Question:For users who reported the &quot;30000 timeout&quot; issue with the service:Is the new build 35 or 36 working fine now?Let me know if you find any error message on the Event Viewer related to OSArmorDevSvc.</blockquote>

[QUOTE="NoVirusThanks, post: 712965, member: 68429"] Here is a new v1.4 (pre-release) (test36): [URL]http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test36.exe[/URL] *** Please do not share the download link, we will delete it when we'll release the official v1.4 *** So far this is what's new compared to the previous pre-release: + Improved detection of suspicious folders + Improved detection of suspicious command-lines + Block execution of processes on All Users folder + Prevent attrib.exe from setting +h or +s attributes + Exclude "/a" execution for "Block execution of Shutdown.exe" + Renamed "Block execution of PsExec.exe from Sysinternals" to "Block execution of PsTools Suite from Sysinternals" + Block execution of PsTools Suite from Sysinternals + Renamed "Prevent reg.exe from hijacking OSArmor settings" to "Enable OSArmor self defense (basic)" + Enable OSArmor self defense (basic) -> Moved on Settings + Improved detection of known fake file extensions + User must be in the Administrators Group to change protection (Configurator -> Settings, disabled by default) + Block execution of taskkill.exe + Minor fixes and optimizations To install it, first uninstall the previous build, then reboot (not really needed but may help), and install the new build. The basic self defense now blocks net.exe, net1.exe, taskkill.exe, sc.exe, reg.exe, pskill.exe, etc from terminating\hijacking OSArmorDevSvc. It also prevents silent uninstallation via /VERYSILENT and /SILENT (unins000.exe). We'll add better self defense via kernel-mode driver in the next version. [USER=58943]@ForgottenSeer 58943[/USER] We definitely welcome such possibilities. [USER=26718]@silversurfer[/USER] Is that error appearing for the first time with test 35 or was it present also in older builds? [USER=29489]@Azure Phoenix[/USER] That would be awesome! Question: [U]For users who reported the "30000 timeout" issue with the service:[/U] Is the new build 35 or 36 working fine now? Let me know if you find any error message on the Event Viewer related to OSArmorDevSvc. [/QUOTE]

Verification