App Review OSArmor vs malware - RoboMan

[imuade]

Best damn sentence i have seen in this forum in the last couple weeks. Makes one wonder why those that are perceive as professionals here, push to pile loads of security software inducing extreme paranoia with many, which in the end, introduce more bugs and issues to the users systems, thus making the chance of infection even greater. I certainly hope users do see this post and learn something from it.

That's very true, but it depends on everyone's habits.
If you have intercourses with your partner only, you don't need any protection. But if you like to jump from flower to flower, using a condom is advisable

 

[Andy Ful]

That's very true, but it depends on everyone's habits.
If you have intercourses with your partner only, you don't need any protection. But if you like to jump from flower to flower, using a condom is advisable

You can treat OSA + Avast Hardened Mode, VoodooShield and similar software as the very good protection, when jumping from flower to flower.
In the case of the true 0-day malware, that would be like jumping between war mines - it requires the restrictive default-deny setup.
Anyway, you are damn right about the habits. There is no protection that can save the user with bad habits, except the kiosk system locked by administrator.

 

[RoboMan]

Thanks for all the (useful) comments. I know OSA is weak against exes, that's why I splitted the test in two parts, scripts/docs and executables. And as for scripts and docs it's very efficient.

 

[upnorth]

That's very true, but it depends on everyone's habits.
If you have intercourses with your partner only, you don't need any protection. But if you like to jump from flower to flower, using a condom is advisable

LOL correct but even with many monogamous relationships that don't want a child, protection is required in one way or another.

Thanks for the test @RoboMan

 

[Brie]

This is simply not true. I have allow by parent process disabled and have never had to disable VS to install any software. In fact the only time I disable VS is when I update Windows 10 to the next major release.

Voodooshield is not perfect. No software is, but your comments do it a great disservice in my opinion.

do you have the paid version of voodooshield?

 

[askmark]

do you have the paid version of voodooshield?

Yes.

 

[shmu26]

We can't know whether Voodooshield is covering all the same points as OSA, because neither software has revealed their internal rules. Also, OSA has advanced rules that are manually enabled on a per-user basis, so that makes the comparison even harder.
I know that Dan said he already covered everything that OSA does, and I know he believes that to be true, but since he doesn't know the internal rules of OSA, I would take such a claim with a grain of salt.

 

[Deleted member 178]

Remember that OSA allow custom Block rules

Write rules to block custom processes
; Available variables to use are %PROCESS%, %PROCESSFILEPATH%, %PARENTPROCESS%, %PARENTFILEPATH%, %PROCESSCMDLINE%, %FILESIGNER%, %PARENTSIGNER%
; Here is an example rule to block process C:\Path\To\abc.exe with parent process C:\Path\To\parent.exe and command-line /param1 /param2
; [%PROCESS%: C:\Path\To\abc.exe] [%PARENTPROCESS%: C:\Path\To\parent.exe] [%PROCESSCMDLINE%: /param1 /param2]
; You can use wildcards pattern * to match any character of any length and ? to match a single character, example [%PROCESS%: *\abc.exe]
; You can also use regular expressions (PCRE) like this: [REGEX:%PROCESS%: \\abc[0-9]*\.exe]
; To comment a line you can use ; character, you can comment multi-lines with {}

I use them to block all execution from specific folders and non-system partitions.

If people don't care to use them, they have no right to complain and say OSA is weak...

 

[oldschool]

Thanks for the great video @RoboMan ! You definitely should make more videos. Nice discussion in this thread as well.

 

[shmu26]

Remember that OSA allow custom Block rules

I use them to block all execution from specific folders

At first, I added the various executable locations to the block list, but then I noticed that on the Main Protections tab, it has "Block processes located in suspicious folders".

 

[Deleted member 178]

@shmu26 i basically add non-system partitions.