VoodooShield discussion

[dvdke]

hello maybe not the right topic butt Hybrid Analysis is the same like virustotal?

 

[gorblimey]

I have the .exe for Android Studio on another disk, let's call him Z:\, ...

Da. VS is always looking at non-C: drives. I haven't worked out if this is annoying or just security. I do have to say that no other security dev does this to my knowledge. Having said that, it does make sense that sussing the install files (well that's all I have on my mausoleums) can give a good picture for child apps... Gotta love the security squad!

 

[gorblimey]

What ever "move option" you disable please at least have one left for users of adguard and so on.

+1. I'm with @Gandalf_The_Grey on this, but sometimes it is necessary to bring the shield onto the desktop... where it won't block other info.

FWIW, VS has never forgotten where I left the shield, unless I do a clean upgrade. I have seen a file "settingsmaster.db"...

 

[codswollip]

Personally I don't use the shield at all. I hide it. I like a clean desktop with minimal distractions.

I'm with you there, but the hassle of upgrading and installing new programs is easier for me to disable/enable VS from the shield, rather than finding the tiny tray icon. Different strokes...

 

[danb]

I like to see the shield as a visual reminder for what mode is active (my taskbar icons are so freaking small). What ever "move option" you disable please at least have one left for users of adguard and so on.

Yeah, that is the purpose of the shield...

1. It lets the user know the status of the lock at all times
2. It gives the user easy access to the lock
3. It makes them feel safe

I mean, a lot of times, a user is unsure of whether to click on something that could potentially be malicious, and they can simply look down and see that their computer is locked.

Will do, thank you!

 

[danb]

hello maybe not the right topic butt Hybrid Analysis is the same like virustotal?

I believe Hybrid Analysis includes VT and is a sandbox similar to Cuckoo Sandbox. Both are super cool!

 

[danb]

Da. VS is always looking at non-C: drives. I haven't worked out if this is annoying or just security. I do have to say that no other security dev does this to my knowledge. Having said that, it does make sense that sussing the install files (well that's all I have on my mausoleums) can give a good picture for child apps... Gotta love the security squad!

Hmmm, I am not sure what you mean, can you please give me an example? I was under the impression that all security software, including VS, monitors all files on the computer... so I am confused . Please let me know, thank you!

 

[danb]

BTW, I believe the desktop shield gadget issue is fixed... it should now save the position of the gadget, and will be included in 4.11. We will wait a couple of days to see what other bugs will appear... there will probably be a couple more .

Everyone have a great weekend, and thanks again for all of your help!

 

[danb]

Also, I just now fixed the weird right click bug in Settings / User log.

I am not aware of any other remaining bugs, so if I missed any, please let me know!

Over the next couple of months, I will be refining VS so that there are less and less blocks... pretty much exactly how I refined 3.59 over the period of several months. This process needs to be performed in careful steps in order to do it correctly and to make sure everything is secure. But I am under the impression that the level of current blocks in 4.10b is perfectly acceptable for public release.

Also, I think it is important to remember that VS is a deny-by-default product, so there will be blocks from time to time. I think a lot of people forget this, which I sincerely accept as a compliment. Thank you guys!

 

[codswollip]

Also, I just now fixed the weird right click bug in Settings / User log.

I am not aware of any other remaining bugs, so if I missed any, please let me know!

Not a bug, but I was wondering if it would be a big thing to have a resizable GUI that could be maxed to view screen dimension. That would reduce the need to scroll the whitelist, etc..

 

[Rainwalker]

Hello Dan....some time ago it was reported a few times that when switching User VS would not load unless VS was Disabled in the Admin account. It seemed only a few were experiencing this.I was one and reported it in the other forum. You said twice you would do the fix. I stopped using VS a few betas back with the hope that the issue would soon be fixed. Today I did a clean install of the latest beta and not only is the problem still there, it is worse. Now I am unable to use VS in any account other then Admin.

 

[FrFc1908]

@danb : I must say this release runs more snappy than all the other beta builds I have tested ( also including v 3.59 stable ) the gui reacts better , when trying to acces its settings , ram ussage is ok , about 40 megs , no slowdown , or lags whatsoever. I do like the new registration process , right of the bat during installation!( I have not tested your product for some time ) keep up your sensational work

 

[Lightning_Brian]

@danb : I must say this release runs more snappy than all the other beta builds I have tested ( also including v 3.59 stable ) the gui reacts better , when trying to acces its settings , ram ussage is ok , about 40 megs , no slowdown , or lags whatsoever. I do like the new registration process , right of the bat during installation!( I have not tested your product for some time ) the only thing I still not quite like is tye floating shield on the screen. I for one would prefer if we had an option to show or to hide in the taskbar. keep up your sensational work

Couldn't have said it better myself! @danb Keep up the great work!!! Simply amazing software that I am very impressed with.

 

[gorblimey]

I was under the impression that all security software, including VS, monitors all files on the computer... so I am confused .

Poor phrasing on my part. @lowdetection noticed what I saw in the Whitelist:


Some of those have not (yet) been installed, some may never be. As far as monitoring goes, most security apps will check out a new arrival--on writing--and then forget about it. None, AFAIK, will actively explore all the drives as part of its setup... Except VS. Having said that, VS is the only anti-exe I have experience with, so others may have the same approach.

But I do remember thinking that since Avast! liked hammering my hosts file for some obfuscated reason, I thought it would be worth adding the D:\Basement\_Dog-pile_\* where I keep my hosts backup to the exclusions list. Just in case.

@Rainwalker :


Enjoy!

 

[gorblimey]

Just "clean" installed 410 over 409. In Admin:
1. Exit VS;
2. Stop the VS Service;
3. Uninstall VS via Dan's uninstaller;
4. Make sure token is present in %Appdata\Temp%, %Roaming\VoodooShield% and Program Data\VoodooShield--I had to recreate this. Notice that "settings.db" is present in %Roaming\VoodooShield%, good.
5. Reboot;

In Admin:
1. Install 410;
2. Choose operating mode (Active, Blue);
3. Move and hide shield;
4. Open Settings, go to Utility (old settings not picked up yet);
5. Click on "Use same settings for all users";
6. VS says will need to exit and must be restarted;
7. Restart VS via menu;
8. VS says "Check registration OK/No";
9. Choose "No";
10. VS disappears;
11. Log out of Admin, into my LUA;
12. VS is in place, no request for registration check, all settings picked up and honoured.

 

[gorblimey]

Has anybody else noticed VS409+ briefly hanging log-offs and shut-downs?

Sometimes it's barely noticeable, others you can see the notice clearly on the screen for a second, but none long enough to read off which the culprit is. However, several times I have exited VS and stopped the service, and log-off hangs don't happen--or if they do they are so quick-fast I can't spot them. And naturally M$ does not provide log-off or shut-down audit capabilities (see Windows 7 Hangs Up When Logging Off ).

 

[codswollip]

4. Make sure token is present in %Appdata\Temp%, %Roaming\VoodooShield% and Program Data\VoodooShield--I had to recreate this. Notice that "settings.db" is present in %Roaming\VoodooShield%, good.
5. Reboot;

For a "clean install" you should delete the token in AppData (it is no longer used) and delete the VoodooShield folder in ProgramData.

Has anybody else noticed VS409+ briefly hanging log-offs and shut-downs?

We're on v4.10b now. Give that a shake.

 

[FrFc1908]

I am
also impressed by v 4.10 speedy startup during boot , way way way better than the previous versions that I have personally tested

 

[TheMalwareMaster]

Waiting for next stable

 

[danb]

I'm not using the beta, but in 3.59 when you click Update Check sometimes the pop-up window appears behind the main voodooshield settings window, so you have to switch to it, not sure if it works like this in version 4 but if it does it would be nice if you fix it

Also, again in 3.59, sometimes in the whitelist editor, when you delete something and then you scroll down with the mouse scroll middle button, it automatically returns to the top, would be another nice fix

And just in case you don't have anything else to do, in the whitelist editor it would be nice if there was a "delete similar items" button to automatically delete files that have the exact same path, like I'm using sumo, so the path is like desktop\sumo.exe, I then uninstall sumo to update the newer version since I'm using sumo free, then another sumo.exe is created there and now there are 2 desktop\sumo.exes in the whitelist editor, obviously in the beta I read that it's automatically deleted if it's no longer there, but nonetheless it could be a nice change, another nice change in the whitelist editor would be, when you select a few items with shift, then you release shift and you select another item with ctrl that is below those selected items with a gap in-between, and then you want to select another few items with shift below the selected item with ctrl, without a gap, it deselects the items that you selected with shift as your first action, so instead of having items selected with shift, item with ctrl and the other items with shift, the first ones with shift are unselected. It would also be nice if you could sort files in the whitelist editor by date last used, file extension, whether they are system files or not, how many times the file was executed since being added, and so on, also a button with "delete all files from the same path folder". Maybe even make it so we can change the system files color, maybe some1 has red color blindness or they just don't like red. Even better would be if we could choose files to blacklist (like powershell is by default), the same way that there is whitelist editor, why not a black list one?
Another thing that could be improved on, is if we could choose which engines should be counted for the "automatically quarantine with X or more positive detections". I don't want my file to be quarantined when detected by some random unheard-of engines that very frequently give false positives. Also for some reason Voodoo Shield doesn't start literally at system startup, I have at least 5 programs that start before it, does that mean that a malware set to auto-start could be executed before voodooshield service starts?

Thank you for the suggestions, I really appreciate all of your guys suggestions!

The first two items should be fixed in VS 4.0. The first thing I did when I started coding VS 4.0 was to fix around 30-40 minor annoyances / bugs that you guys or myself noticed over time... in hopes that when VS 4.0 was completely stable, that it would be extremely refined as well. So the first 2 items should be fixed... but if anyone finds any minor things that we need to polish, please let me know!

On the whitelist dups... VS has a feature that automatically removes dups when it starts. But the thing is, we need to refine a couple aspects of this feature. First, we should probably make it optional, or create a button for it, as recommended by one of you guys a few days ago. This will be super easy, we just need to figure out what works the best for everyone and go with it. The second issue is that items with the same path will not be removed if the original item was updated as some point, so then the whitelist contains the old versions and the newest version of the item, since they have different SHA-256 hashes. This is super easy to fix as well, like it will take all of 5 minutes... you guys and I just need to decide what works best for everyone.

Unfortunately, on your forth point... I wish I could add that as a feature, but I am not able to. It would be easy to add, but I do not want to break the rules . VS does have an automatic false positive detection for the engine that is hardwired in... and we can adjust them for everyone within the code. I actually need to make a couple of adjustments . It is super easy, in the VS code, we have 2 lists of engines... one with higher than average FP's and one with average / low FP's, and I just need to cut and paste from one list to the other.

Thanks again for your suggestions... if anyone else has other suggestions, please let me know!