NoVirusThanks OSArmor: An Additional Layer of Defense

Andreas has intimated it would be incorporated in next release (1.5?).

https://www.wilderssecurity.com/thr...-layer-of-defense.398859/page-21#post-2730347

 

My Intel Celeron is 1.7 Ghz. 1998 vintage. OSA runs just fine. In your case, the problem might be a software conflict. Or...??

 

Nice

 

I don't think that the problem occurs with Windows XP since I am using an Intel Celeron 1.33Ghz. I have only observed the issue with Windows 7.

 

OIC. Mystery then. How much RAM with your win7?

 

3 gigabytes and a WDC Black Label SATA HDD defragged with Raxco Perfect Disk.

 

I expect that only those who have a prehistoric snail's pace PC like mine (single core 1.8 Ghz AMD Sempron 3000+ 64bit) will experience the issue. I am guessing that there is a timing problem. It does not occur in an Intel Celeron 1.3Ghz PC with 512MB RAM and Windows XP.

For everyone else, it is an academic problem only.

 

Installed today - if the installer is left as is, it installs in it's own folder called OSArmorDevSvc on the main drive.
The exe OSArmorDevUI icon does not show up in the task bar.
I have run a schedules task with the highest privileges to run OSArmorDevUI.exe with the argument minimized to tray - and it does show up in the taskbar, but it is not minimized - so it is like my free version of rehips, and starts with with the user interface screen maximized.

 

It sounds to me like you are using one of the very early test builds. Grab the latest build, I think it is test34, and it should perform a real lot better. Search this thread and you will find a download link for it.

 

OSArmorDevUI should be launched by OSArmorDevSvc automatically.
Try the latest test build and see if it happens again:

 

thanks for version 1.4
version 1.3 did not show the icon in taskbar tray or show the info window popped up on start up even when set as a scheduled task.
the only way to show version 1.3 was to restart OSArmorDevUI with process hacker, then it would show the icon in the taskbar.
version 1.4 showed really early on during the boot in the tray icon, and the popped up info window because of the scheduled task.
I disabled the task scheduler for OSArmorDevUI and on the reboot the tray icon still showed up, and also still really early in the boot.
Don't know how this compares to version 1.3 start up if the icon would have shown, and if it would have been this early.
version 1.4 also has a few more options.
side note - qihoo 360 security flagged this OSArmorDevUI and OSArmorDevSvc, I said they were allowed of course.
I only use 360 security because avast doesn't work on my computer anymore - avast later versions of 17 and now version 18 hammer my cpu
on install with avast offer, and hammer the cpu on start up with services/processes that were seen by my hips, but of course I had to let avast run.
If anyone knows a good antivirus better than qihoo, which is only good with bitdefender and avira on, please tell me - I was going to try eset, but heard
it can interfere with other safe files/ processes.

 

Osarmor version 1.4 user interface icon is not showing in the taskbar - I have to restart OSArmorDevUI.exe in process hacker task manager, and then the icon shows in the taskbar.

 

Are you by any chance using Avast? Some users found conflicts with Avast.
What other security softs are you running? What OS?
I am not qualified to troubleshoot this, but if you give the dev enough info, maybe he can reproduce the issue, and solve it.

 

I can't install the latest versions of avast on my computer, because avast hammers the cpu - but I think qihoo 360 security is blocking the osarmor user interface taskbar icon. I used 360 security to replace avast, but i don't really like it. I am thinking of trying eset. qihoo 360 security flagged both osarmordecsvc.,exe and osarmordevui.exe on install - I allowed both, but I don't think 360 security accepts them. I am going to disable 360 security and do a reboot.

 

@novirusthanks

I was running process monitor on my machine and noticed a number of "Name not found" registry entries against OSArmorDevSvc.exe

One example was the value AntiExploitAcrobatReader which i assume represents the protection status of the Anti-exploit for Adobe Reader (below)

Code:

Operation:    RegQueryValue
Result:    NAME NOT FOUND
Path:    HKLM\SOFTWARE\NoVirusThanks\OSArmorDev\AntiExploitAcrobatReader

I looked in the key HKLM\SOFTWARE\NoVirusThanks\OSArmorDev\ and found there were no values beginning with the word AntiExploit... (which I found odd, because I had all the Anti-Exploits enabled in the Configurator).

I decided to toggle "Protect Adobe Acrobat Reader" off and on in the gui and re-check the registry. I opened regedit and sure enough the value "AntiExploitAcrobatReader" was now there. I repeated this for other exploits and the keys for them also were added to the registry.

My question is, is this expected behavior and are the protections active if they're enabled in the gui, but absent from the registry?

Can anyone else confirm if this is confined to my machine?

 

I have not a single "AntiExplot ..."-entry in the registry, but the Anti Exploit feature is "active" and is blocking processes.

 

Thanks! That's good to know it's working. I still find it strange the registry values are created by the gui but don't appear to be used. Maybe it's old code that's now redundant.

 

Problems updating Root and revoked Certificates on Windows XP if the rule below is active:

"Block suspicious processes started from Rudll32"

already notified to the Developer.

You must also enter an exception for the rule in the "Main Protection" section below:

"Block Execution of processes with .com extension"


https://sendvid.com/7j6p3ebk

 

@askmark

Yes it is expected. If no entry on HKLM key then OSA considers the option as enabled by default.

@Sampei Nihira

Yes thanks for the info, will take a look at it asap.

Thanks also for the video.

@jacemace

Try to use ESET and see if OSA works fine, in my tests it worked without issues.

The issue with the "icon on the taskbar not showing" has been fixed in recent v1.4 test builds.

So it may be the other security software that prevents OSArmorDevUI.exe from running at startup.

 

That's makes sense. Thanks for clearing up the confusion

 

Here is a new v1.4 (pre-release) (test35):
http://downloads.novirusthanks.org/files/osarmor_setup_1.4_test35.exe

*** Please do not share the download link, we will delete it when we'll release the official v1.4 ***

So far this is what's new compared to the previous pre-release:

+ Fixed detection of SoftMaker Office 2012
+ Improved detection of suspicious processes
+ Fixed an issue on Windows 10 32-bit OSs
+ Prevent reg.exe from hijacking OSArmor settings (on Main Protections, enabled by default)
+ Improved "Block processes named like *keygen* or *crack*"
+ Updated some text on Configurator
+ Minor fixes and optimizations
+ Fixed some false positives

To install it, first uninstall the previous build, then reboot (not really needed but may help), and install the new build.

Let me know if you find any FP or issue, we plan to release v1.4 in the next days if all is well.

@Antarctica @Buddel

Please confirm me if this new build works fine for you.

It should have fixed that "30000 timeout" issues on 32-bit OSs.

 

Thanks. Is Waterfox protected?

 

Yes, it is.

 

Missed that, thank you.