Reply to thread

Message

<blockquote data-quote="RoboMan" data-source="post: 754360" data-attributes="member: 53544">It depends upon the case. To start with, VS will allow by parent process by default. So, many malware could abuse this in order to infect you. OSA can intercept such abuse. If this VS option is disabled, then remember VS needs to be turned off every time an installation takes place. In such cases, you cannot be 100% protected, even if you only download known software from reputable sites. I highlight CCleaner&#039;s case. There&#039;s no way VoodooShield could have intercepted that since it had to be disabled to install CCleaner. I&#039;m not saying OSA would have blocked it, i&#039;m just mentioning VoodooShield has limits.Plus, VS includes no own signatures, only VirusTotal, which only work online and compare the executable with VT av&#039;s, still not the intructions the executable includes, so if it&#039;s a zero day and VirusTotal doesn&#039;t throw a proper alert, and you choose to install the software, you&#039;re fked. OSArmor may detect the use of specific processes by that file given the case.</blockquote>

[QUOTE="RoboMan, post: 754360, member: 53544"] It depends upon the case. To start with, VS will allow by parent process by default. So, many malware could abuse this in order to infect you. OSA can intercept such abuse. If this VS option is disabled, then remember VS needs to be turned off every time an installation takes place. In such cases, you cannot be [B]100% protected[/B], even if you only download known software from reputable sites. I highlight CCleaner's case. There's no way VoodooShield could have intercepted that since it had to be disabled to install CCleaner. I'm not saying OSA would have blocked it, i'm just mentioning VoodooShield [B][U]has limits[/U].[/B] Plus, VS includes no own signatures, only VirusTotal, which only work online and compare the executable with VT av's, still not the intructions the executable includes, so if it's a zero day and VirusTotal doesn't throw a proper alert, and you choose to install the software, you're fked. OSArmor may detect the use of specific processes by that file given the case. [/QUOTE]

Verification