NoVirusThanks OSArmor: An Additional Layer of Defense

Maybe it's got something to do with new drivers because versions with the "old" drivers could be installed here (Win10, 32bit).

 

@novirusthanks

Test 31 works just fine on my W.10 x64.
Good.

In SUA disabling OSA Protection does not require administrative rights:



Can malware "easily" do the same?
TH.

 

@Buddel

That is strange, as other security app you have only EAM correct?

Your OS is Windows 10 Pro 32-bit and Secure Boot is disabled?

Do you have any logs in the Event Viewer?

Also, how do you install the new build? Can you try this:

- Uninstall old build and reboot
- Remove C:\WINDOWS\System32\drivers\OSArmorDevDrv.sys (if present)
- Remove C:\Program Files\NoVirusThanks\OSArmorDevSvc\
- Delete registry key HKLM\Software\NoVirusThanks\OSArmorDevSvc\
- Now try to install build 31

@jimb949

Thanks for reporting the FP, it'll be fixed in the next build.

OSA can prevent the execution of a ransomware by blocking the exploit payloads and suspicious processes.

It doesn't protect directly the UEFI\BIOS.

@Charyb

We'll try to contact MS about the FP with Windows Defender.

Strange because our exes are all digitally signed by both SHA1 + SHA256 code sign.

I'll fix that RuntimeBroker.exe FP on the next build.

@Sampei Nihira

The GUI uses a smart and secure way to communicate with the service so that should be no problem.

On the next version we can add a password protection so to disable OSA user would need to type the correct password.

 

Process: [3844]C:\Windows\explorer.exe
Parent: [5680]C:\Windows\System32\RuntimeBroker.exe
Rule: BlockProcessesFromRuntimeBroker
Rule Name: Block processes executed from RuntimeBroker
Command Line: "C:\Windows\explorer.exe"
Signer: Microsoft Windows
Parent Signer: Microsoft Windows

Code:

[%PROCESS%: C:\Windows\explorer.exe] [%PROCESSCMDLINE%: "C:\Windows\explorer.exe"]

 

I had suspected that the filemanager is "somehow whitelisted" but now i know that there is indeed an internal whitelist

Yes, Exclusions.db is the solution if a user want to block these tools completely (and to prevent other users from launching these tools)
Would be good to have a password protection in addition, so the user can't disable the protection but it was mentioned some minutes ago that it will be added soon

 

Request: Protection for Cyberfox. Thank you.

 

Great!

 

You're not alone. I got that too!

 

I have just tried all of the above, and always with admin rights (I don't even have a "Standard" account").
- I uninstalled build 28 and rebooted
- C:\WINDOWS\System32\drivers\OSArmorDevDrv.sys > not present
- Remove C:\Program Files\NoVirusThanks\OSArmorDevSvc\ > not present
- Delete registry key HKLM\Software\NoVirusThanks\OSArmorDevSvc\ > not present
I installed build 31, same disappointing result. Back to build 28, which still works fine.

---------------------------------------------------------------------------------------

Yes, only EAM.

 

Smooth sailing with test 31.
7x64

 

Here is a new v1.4 (pre-release) (test32):
http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test32.exe

*** Please do not share the download link, we will delete it when we'll release the official v1.4 ***

So far this is what's new compared to the previous pre-release:

+ Fixed an issue on Windows XP
+ Fixed all reported false positives

To install it, first uninstall the previous build, then reboot (not really needed but may help), and install the new build.

This new build should fix an issue on 32-bit OSes.

@Buddel

Can you try this new build 32?

It fixes an issue related to 32-bit OSs and I noticed you use Win 10 32-bit.

@bjm_ @jimb949 @Charyb

All FPs should be fixed, thanks for reporting them.

@bjm_

I would personally just match the process and the parent process in your exclusion rule:

Code:

[%PROCESS%: C:\Windows\explorer.exe] [%PARENTPROCESS%: C:\Windows\System32\RuntimeBroker.exe]

This way the exclusion rule is specific to the rule "Block processes executed from RuntimeBroker".

Thanks everyone for the feedbacks.

 

Same result, it won't install. I wonder why I didn't have any problems with builds 1 to 28. Only the most recent builds do not seem to be compatible with my computer.

 

A little test:
Test builds 1 to 29: They can all be installed without any problems.
Test builds 30, 31, 32: These builds cannot be installed here, so the problem started with the release of test build 30.

 

@novirusthanks
What about creating a new build but with the old driver?
If this build now magicially works we know now that there seems to be a problem with the new driver (co-signed by Microsoft).
Edit: Or try to provide an additional installer (one installer with a co-signed driver and the other installer without a co-signed driver [to find out if the driver is the wrongdoer])

In build 30 and newer builds the driver is co-signed by Microsoft too (32-bit OS).

 

Okay...."exclusion rule, specific to the rule"....Thanks

 

Buddel, build 30 was the first build to have both 32 and 64 bit drivers co-signed by Microsoft, may or may not be cause of your issue.

 

This is also my guess. Problems started with build 30; no problems whatsoever with any previous builds.

 

Running EAM also, will give it a try.

 

Running XP.

Had same issue as Buddel with test 30. Returned to test 28. Skipped test 30 & 31. Installed test 32. Test 32 now running A-OKAY !

In sum, XP runs test 32 fine after:
1- Uninstall OSA using OSA's internal uninstaller.
2- Reboot. (See NOTE)
3- Install test 32

NOTE: After step 2 I visually checked OSA's windows folder AND OSA's registry for any untoward leftovers. There were none.

 

No problem installing here, EAM behaviour blocker box popped up during install and I had to click "Allow", but installation went fine, running OSArmour ok now. Only other security software in real time is MB3. Secure boot is not supported on my computer if that matters.

 

I disabled EAM before uninstalling/installing OSA but this didn't help, either. Something must be wrong with builds 30 and newer.

 

Sorry for the question, may be it's already said here, but 37 pages to read are too many : NoVirusThanks OSArmor can protect from the exploit of Spectre using Browser's Java Scripts ?

 

What I meant is that EXE Radar already protects against exploits out of the box. Because if some process is not white-listed it can't execute, and ERP also blocks vulnerable system processes from loading. But OSArmor is a set and forget tool, I'm not sure if I really need it though.

No it can't, it's an execution blocker, but it won't block scripts inside the browser.

 

I use an Intel Pentium 4 3.2GHz dual core processor on my Windows 7 SP1 64bit system. When OSArmor is installed and the Microsoft Meltdown mitigations are enabled (Steve Gibson's inspectre.exe facilitates this) then the system becomes so slow as to be unusable when I run Google Chrome. If I disable the Microsoft Meltdown mitigation, no such difficulty occurs. OSArmor Test32 was installed.

 

Thank you.