VoodooShield/Cyberlock

All seems to work fine now, no SPPVSC balloons, all executables were blocked.

 

I just ran an update for Zemana AntiLogger, first in training mode. It failed to install.



I then tried again with VS protection disabled, and the install was successful.






Msiexec was blocked twice, once that prevented the Zemana upgrade, and again after the install.



P.S. I reposted but, somehow the image attachments went missing - LWM: recovered attachments from previously deleted post.

 

Zemana's update file is in AppData, Voodooshield shouldn't block it I think if It was in training mode from what I understand, but normally everything in AppData is blocked by default by Voodooshield. Btw I never experienced that (Voodooshield to block something when in training mode), try to use version .5 if you have an older version and reset VS to default.

 

Are you sure?

 

Well, VS is not supposed to block anything in the appdata folder if it is training, but it is not supposted to whitelist them either (as long as this option is enabled in settings). So basically, it just allows it one time and does not whitelist it. This is to stop hackers from spoofing updates, like acrobat reader update, etc. If you need to whitelist something in the appdata folder, you can disable the do not whitelist appdata folders in settings. All of this is further complicated by the msiexec / cmd issue, but one way or another, that will be fixed very soon . Thank you!

 

Very cool, thank you!

 

I have not done any testing with flash drives yet. I had several emails from other vendors asking me if I could test some new builds of their software. I will do it now.

 

Yes the USB protection works with Flash Drives.

Daniel

 

Smart Mode stopped working before I had a chance to test USB flash drives. I have VS in Smart Mode, but it's protection stays enabled all the time now. This started after I shut down, and then rebooted.

 

I've rebooted twice more since then. I switched VS to Always On Mode, and then back to Smart Mode. VS's protection stays enabled when switching back to Smart Mode. I switched to Training Mode, and then back to Smart Mode. VS's protection stays enabled.

Maybe Shadow Defender is interfering with VS's functionality. I will try exiting Shadow Mode, and reboot two more time to see what happens.

 

It could be a conflict with Shadow Defender I have no issues on Win 7 x64 with WSA & Look'n'Stop Firewall, VoodooShield 1.25 they work very well.

Daniel

 

I tried rebooting 3 times after exiting Shadow Mode, and VS still stayed in Always On Mode even though I had selected Smart Mode. I tried toggling back, and forth between Modes. VS continued to stay in Always On Mode even though it was in Smart Mode. I tried shutting down VS several time, and restarting it. VS continued to stay in Always On Mode. I plugged in a flash drive, and VS changed from "On" to "ON USB". After I unplugged the flash drive VS disabled it's protection. Smart Mode is finally working again.

 

How about Exit and turn it back on next time you have that issue?

Daniel

 

Do you mean shut down VS, and then turn it back on again? I tried that several time, but it did not work.

 

My first thought was maybe it could be Shadow Defender, but I don't understand how SD could interfere with VS. If I had excluded directories that VS resides on from with SD then I could see that happening, but the only exclusion I have set in SD is users/user/downloads. Maybe Dan will know. Smart Mode is working for now. I will try it again later while in Shadow Mode, and rebooting 3 times to see if it occurs again.

 

Do you have a usb drive inserted when VS is showing ON in smart mode? If so, this is the bug that I was talking about in the pm a couple of days ago. For some reason, if you have a usb drive in, and reboot, VS knows that there is a usb flash drive inserted, so it stays ON, but the USB label is not visible. I will fix this soon, it should be easy.

If you reboot in smart mode with no usb drives inserted, VS should say "OFF". If not, something is activating it, and we just need to find out what it is!

I think this is what you are talking about, if not, please let me know! Thank you guys for the help!

 

I'm not sure if it's my pc or if it's a bug in VS, but sometimes when I want to allow something and the alert pops up, when I click it it does nothing and freezes and I have to manually close the window and sometimes when I have no web apps running smart mode stays blue

 

I had a Western Digital external drive connected, but I disconnected it before rebooting. Once I rebooted I noticed that VS's protection was still enabled even though I was in Smart Mode. You can see in the screen shot in my post above that I did not have any application running that would trigger VS to enable it's protection in Smart Mode (nothing visible from the desktop anyway). I will run process monitor when it happens again, and send you the log. I also did not have anything plugged into a USB slot other than my cordless mouse.

 

If possible, may you put a different color when disabled with the the option "Disable Protection"?

Sometimes i confuse when is disabled or in training mode.

 

I am running VoodooShield in conjunction with Shadow Defender and am not experiencing issues, so Shadow Defender probably isn't the cause. I have set the VoodooShield folders in the user profiles as SD exclusions though, so I don't know if that makes any difference.

 

You would be more likely to have problems by setting an exclusion for VS in SD than if you did not have any exclusions. I guess SD is not the cause then. Thank you for letting me know.

 

Dan, I'm still having the same problem, and I have not used Shadow Mode at all this time. I do not have any USB device plugged in other than my wireless mouse, and I am not using any applications that would trigger VS to enable it's protection in Smart Mode. I'm going to pm you a link to my Process Monitor Log, and my AutoRun Log. Maybe something is running in the background that i'm not aware of. You can see in the screen shot below that VS is indeed in Smart Mode, and I do not have any applications running that would trigger VS's protection in Smart Mode.

 

Just pm'd you the link for the logs.

 

Works fine for me. No Browser open I put in USB Flash Drive and see this and then I remove then I get this looks good to me.

HTH,

Daniel

 

It depends... if it is a cmd or msiexec, you will get that error. The next time that happens, can you post the path to the file listed on the alert that caused the problem? That will help me explain what it going on. Thank you!

Edit: We are still trying to determine what is causing VS to activate in smart mode for no apparent reason. Hopefully we will figure it out soon!!