App Review RansomOff - First Look at New User Interface

[shmu26]

What do the alerts say about the blocking of dropbox or chrome? There are a few different reasons why RO will block an app and the alert will list the reason.

Installations are tricky to deal with but we'll see if there's something we can improve. Do you have a particular installation that you had trouble with?

And what kind of interference with shutdown?

The interference with app launching and the other things was without alerts. It was silent. But exiting RO resolved the issues.

 

[Porama6400]

It looks really suspicious...

 

[cimmay]

What security apps do you have installed?

I did see the docs about getting error with the Agent. RO was installed again in Advanced mode, but same problem. I rebooted and did not run Agent manually, just waited. Then system was unresponsive and needed a reset.

The security apps are :
1. Eset Internet Security 11.0.144.0
2. AppGuard 4.4.6.1
3. HitMan Pro 3.7

As said before I restored all file/folder permissions to default levels using Windows Repair 2018. As suggested in RO Advanced, I white listed RO in AppGuard as "untouched". Eset does not have white listing.
The OS is Windows 7 Ultimate 64 bit with sp1 and all updates. However I did remove "Application Experience" service for privacy.

I will try restoring permissions again and give update...
Windows File permissions were restored to Default. But RO has same problem as before.
It restored permissions in:
all services
users\cimmay\
programdata
program files (x86)
program files
windows
I had messed up system32 folder with script, taking control of TrustedInstaller, but looking at it again it may have been reversed. I'm unsure if windows repair 2018 corrected it or not.

 

[shmu26]

I did see the docs about getting error with the Agent. RO was installed again in Advanced mode, but same problem. I rebooted and did not run Agent manually, just waited. Then system was unresponsive and needed a reset.

The security apps are :
1. Eset Internet Security 11.0.144.0
2. AppGuard 4.4.6.1
3. HitMan Pro 3.7

As said before I restored all file/folder permissions to default levels using Windows Repair 2018. As suggested in RO Advanced, I white listed RO in AppGuard as "untouched". Eset does not have white listing.
The OS is Windows 7 Ultimate 64 bit with sp1 and all updates. However I did remove "Application Experience" service for privacy.

Just for the record, I would try without HMPA, which is a known troublemaker, and is bound to conflict with the mitigations of RO.

 

[cimmay]

Just for the record, I would try without HMPA, which is a known troublemaker, and is bound to conflict with the mitigations of RO.

I'm not using HMPAlerts. and the RO issue was before HMP was installed yesterday. But thank you for ideas.

 

[HeiDef]

transition effect doing a bad experience, taking miliseconds in response.

In a VM or regular system?

 

[shmu26]

I'm not using HMPAlerts. and the RO issue was before HMP was installed yesterday. But thank you for ideas.

Oops, I misread your post. Sorry...

 

[Prayag]

Hey @HeiDef I have 2 false positives to report.(both of them existed in previous rc also and hasn't been resolved yet).
Please test ransomoff's false detection with citra emulator and reboot restore Rx(both at the time of installation and uninstallation).
Hope this issue gets fixed soon.
Thanks.
Keep on improving this great stuff.

 

[HeiDef]

Hey @HeiDef I have 2 false positives to report.(both of them existed in previous rc also and hasn't been resolved yet).
Please test ransomoff's false detection with citra emulator and reboot restore Rx(both at the time of installation and uninstallation).
Hope this issue gets fixed soon.
Thanks.
Keep on improving this great stuff.

Thanks for the report. We'll take a look.

 

[Lightning_Brian]

Keep up the great work that you are doing @HeiDef ! We appreciate your great work.

 

[shmu26]

It did not uninstall clean. It left behind 2 drivers.

 

[HeiDef]

It did not uninstall clean. It left behind 2 drivers.

Thanks. Will take a look.