VoodooShield/Cyberlock

Cool, thank you... obviously I appreciate that . If you do not have a VS Pro license, please email me at support at voodooshield.com and I will set one up for you. BTW, if any of the other wilders users would like a license, please let me know!

 

With regard to dismhost: As in whitelisting c:\users\xxxx\appdata\local\temp\*\dismhost.exe - can that be done in VS?

 

is it Yesnoo's brother? (ie-no)

 

LOL!

Nice finding! BTW VS works on the principle "yes - no" to starting process.

 

I have an issue with VS context menu not responding at times.

 

lol, all we need now is our sister, egyes

 

Thank you for the idea... yeah, something like that. Actually the dismhost fix that Vlad along with some of the wilders came up with together is a super cool idea that will work really well, but there is a bug somewhere. We have tons of information about this bug that we can convey to Vlad, so it will be a super easy fix for him. Thank you!

 

Vlad added wildcard listing a few months ago... I have never used it, but it should be fully functional. Please keep in mind that dismhost can run from a lot of different locations, so I think the other dismhost fix will work the best. Thank you!

 

Hehehe, you guys crack me up .

 

Ohhh, I see what you are saying... great point, sorry about that, you are correct . I have a lot of my mind right now and I am not thinking too clearly .

 

Yeah, Vlad is a truly amazing coder, I hope to be able to hire him full time one day, but he is doing quite well in his career, so I would hate to pry him away from that.

BTW, I forgot to mention something that I realized while watching CS's video. We need to add the VoodooAi results to the mini prompts, and this will work great because by the time the mini prompt is shown, the VoodooAi results are already calculated. So instead of the mini prompt saying "VoodooShield blocked an Unknown File", if the VoodooAi result is unsafe for the blocked file, the mini prompt will say "VoodooShield blocked a malicious file" (or something like that, and the text will be in red). That way, it reduces the change the the user will click on the mini prompt and ultimately run the file. It is just a small tweak, but I think it will be pretty cool. There are actually tons of small tweaks that I want to add in the next few months. Thank you!

 

I am using windows 10 64 bit and voodooshield330 in auto mode and its running fine for me, there is no "dismhost.exe" blocked notices from voodooshield..

 

A Disk Cleanup (cleanmgr.exe) should invoke it ...

 

Just tried ...nothing...came up

 

Cool, thank you guys! I wonder if UAC has anything to do with it? The reason that I ask is because in some versions of Windows, UAC will enable "Windows Protected Folders" for certain folders... but this is kind of a guess, I have not tested this theory. Do you have UAC enabled?

 

I think we can, assuming that the .tmp files are standard portable executable files that happen to just have the .tmp extension, it would probably work. Thank you!

 

Yeah, exactly... actually VS spawns a .tmp file during the install as well. I just need to make sure that they are standard PE files, and if so, I can add the .tmp extension. And if they are standard PE files, are they always? I think they are, but I am not sure, so we just have not added the .tmp extension yet.

Thank you!

 

Yeah, I think you are correct. We can add the .tmp extension, but if there is a .tmp file that is not a standard PE file, then VS might freeze or throw some weird exception (like if some odd .tmp file is blocked on a user's computer, that I was not aware of and have not tested). Once we know for sure, it will be easy to add. Thank you!

 

Installers packed with "Innosetup" are executing .tmp-files

Example:
Installation:
Process: C:\Users\xxx\AppData\Local\Temp\is-61194.tmp\mbae-setup-1.08.1.1196.tmp
CommandLine: "C:\Users\xxx\AppData\Local\Temp\is-61194.tmp\mbae-setup-1.08.1.1196.tmp" C:\mbae-setup-1.08.1.1196.exe"
Deinstallation:
Process: C:\Users\xxx\AppData\Local\Temp\_iu14D2N.tmp
CommandLine: "C:\Users\xxx\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files (x86)\Malwarebytes Anti-Exploit\unins000.exe"

 

I just did a fast ring upgrade from current release build of Win 10 to build 14393 which may well be the final RTM of the upcoming anniversary update. All went well. I reset the whitelist and rebooted a few times with no ill effects. Cryptoprevent, Webroot, adguard, and MBAE all in attendance too alongside VS 330.
So far so good.

 

Cool, thank you! And actually, if you guys get a chance (and you do not mind doing this), whenever we see a .tmp, if we find it on disk, then make a copy of it and rename the extension to .exe, then drag and drop it to VS, we will know for sure . I will do that whenever I see a .tmp file from now on. Hopefully they are all PE files and we can include them in the VoodooAi analysis.

 

Very cool, thank you for letting us know!

 

"Do you have UAC enabled?" my insider build updated yesterday as well.

I have UAC set to high. had another bunch of blocks. there were more then screen shot but could not fit them all in.

 

Just wondering if there is any benefit in running UAC together with VS. I have had UAC disabled for sometime now and cannot see any benefit in enabling it but I would appreciate any views as to why I might want to change. Using Win 7 Pro x64.

 

Just to add I always turn off UAC it's a PITA and VS is why better IMO.