VoodooShield/Cyberlock

In My Documents and it creates the (Outlook Files) folder during install of Office Pro Plus 2013 as in the picture above! http://office.microsoft.com/en-ca/o...tlook-data-files-pst-and-ost-HA102749465.aspx

Daniel

 

Can I run Voodooshield alongside EMET and Sandboxie?

 

With all new versions we can just install over the old version right? or is it best to un-install then re-install?

 

Oh, I see... is your main pst file named Outlook backup? I was thinking that was Outlook 2013 backing up your pst file.

I need to get 2013 as some point. But I doubt that it runs on my Windows 95 .

 

Sorry, I was misunderstanding you... for some reason I was thinking you were talking about "Documents" folder, not "Downloads". Sure, I can add that.

 

Yes, VS works with pretty much everything. A few people have issues with Sandboxie and VS, but I am working on that right now!

 

It really shouldn't matter, all the installer does is copy the files to your computer and create a startup entry in the registry (and disable UAC).

But going from 2 to 4 modes in this version... VS might run a little silly the first time you run it, since it does not know what mode it is in. But you should be able to exit out of VS and start it again, and it would work great.

BTW, you do not have to reboot on install or uninstall if UAC is already disabled. The only reason VS requires a restart is to disable UAC.

 

I never use UAC so I just clicked on it after I installed the latest version and everything is running great, thanks

 

Hi Dan it's exactly as in this picture but you don't see .pst file name.

https://www.wilderssecurity.com/showpost.php?p=2259404&postcount=1795

Daniel

 

I was just lurking in this topic and happened to see info on something that may help. http://www.tweakhound.com/tweaking-windows-8/4/

 

Thank you TH and innerpeace!

 

I am not very good at obeying rules. I don't modify any standard paths. All Data is kept on a partition called Data. Similarly with Downloads, Programs etc. That is why I though it might be simpler to have user defined area to protect as you can do with some programs.

Those users who veer from the standard will be capable of adjusting VS.

Just my thoughts.

 

Glad to report that the balloon is now working providing there is a browser running.

 

I noticed that some softwares like utorent, o&o Defrag and more have paths in App data, after running one from the list above VS prompts to allow or block, I allow them but VS keeps asking everytime I open them. Some softwares keep there the update manager and VS blocks them.

So the bug might be that VS is not saving what user allow from notifications, after I did another training and open everything, update and etc, all worked Ok.

 

Dan why would VS block rundll32.exe as it's in windows/system32 when the Browser is open and also the Shield just flickered no balloon?

Daniel

 

Something that has just occurred to me. If you miss a pop up is there a way to find out what it was?

 

Right Click on the Tray Icon and click View Log.

TH

 

I totally agree. I will add that on the next version, thank you! For this version, should VS be protecting "Documents" as well? I actually do the same thing on my main computer... All of my data is on the d drive. The new version will be ready in a couple of hours, and it includes protection of "Downloads". Should it include protection of "Documents" as well?

 

Cool, thank you. It took a while to get all of that right, but I think it turned out really well. It is easy to get confused when I am testing VS... like sometimes I will wonder why it does something, then a few seconds later, I am like "oh yeah, that's why".

 

Yeah, since viruses love to hang out in the appdata and program data folders, it is a little tricky to deal with. Basically, we do not want to whitelist anything in these folders unless the user really wants to... there is a setting called "Do not Whitelist items in the AppData Directories". I thought I had it so that if the user goes into Training Mode, it would whitelist them. But if the user is in Smart or Always ON mode, it should not whitelist them. Is this how it worked for you? Thank you for your help!

 

Good point! Actually it should say something like "Automatically allow all software from the Windows Systems folders when VS is ON, unless it is a blacklisted process" Does that make sense? If not, I can try to explain it another way. Thank you.

 

Thank you TH! I increased the balloon time in the version that you guys will get in a few hours. I would like to make that user adjustable, but for some reason they do not make it easy to do that. But there should be a way around it. But please look at the new balloon time and let me know if is a good duration. Obviously we want it to go away at some point, but we don't want it to disappear too fast. Thank yoU!

 

Yes it could say that but it has to do it, as I said it was Blocked and I only got a flicker from the VS Shield no Balloon or Pop-up.

Daniel

 

Ohh, I see what you are saying... what were you trying to run when VS blocked rundll32.exe? It was probably some program that had to call a dll.

But the reason it blocks rundll32.exe and only flashes once is because if VS prompts the user to run rundll32.exe, nothing will happen (rundll32.exe will not execute by itself).

But, what we might be able to do is to prompt the user to run the program they were trying to run when rundll32.exe was blocked.

So what were you trying to run when VS blocked rundll32.exe?

 

Nothing that I know of unless a back ground program process called for it? Would Today's Log File tell you if I sent it to you?

Daniel