Foltyn SecurityShield (beta)

flags RCC as unsigned. it is signed , just self signed.

 

What do you see in the file-properties of RCC.exe after you have signed it. Do you see a valid signature, or is it not valid?

 

I thought I looked yesterday and it was signed by the program maker but today I don't see it.

 

I don't see RCC.exe signed too, so the message "no signature found on the file" from Foltyn SecurityShield is correct.

 

FWIW I downloaded RCC.exe (v1.69.012) on December 6 and it wasn't signed ever since. Btw, FSS does not flag it and let it run freely. Strange cause FSS is supposed to monitor unsigned files, isn't it?

 

MisterX that is the same version of RCC I have

mood is FSS flagging it for you?

 

Weird, seems like the app has been removed for download on the site? I wonder what's going on.

 

Download link:

Code:

http://www.foltyn.com/fss.exe

 

@ Mister X

Thanks, but what I meant is that the link has been removed, and now all of a sudden you can upload apps for analysis in a sandbox? I hope they will continue to develop this app, because it does look promising. Or perhaps they took my advice and made a deal with the guys from SpyShelter.

 

According to the following posts, yes:

 

Can't turn off protection.
When I click on the link "turn off" nothing happens and the program keeps logging/monitoring processes.

Is this program under a closed beta?
I look very silent this thread.

 

And nooowww!!

http://www.foltyn.com/

 

I think its good, they have realised probably via comments made here at wilders that it was flawed and have decided to rethink its code and methodology...Its shows that they are open to suggestions unlike so many developers.

 

I will give them the benefit of the dought here. if they don't disappear like returnil did without any notice I will accept their offer.

 

Well, it did get a 100% score, it managed to stop 28 ransomware variants, but I'm not sure if it relied on the user to make the block decision. So I don't think the product was bad, but they probably felt like it might generate too many false positives. But I have no clue what they mean with "application white-listing", that doesn't sound really pro-active to me.

 

..."based on application white-listing"
Whitelisted apps can run and non whitelisted apps are blocked, or something like that.
So it's like an AE.
But we'll see in the next weeks what they have to offer (Dec 2016/Jan 2017)

 

Yes I understand, but it sounds very basic to me. Anyone can build such an app, they can make a list of trusted publishers (see link), if you're not on the list you can't run. This is what I call "baby-sitting" apps. I don't need an app for that, I can do that myself, by simply downloading apps that are listed on trusted sites. I'm more interested in behavioral monitoring.

http://whitelist.kaspersky.com/catalogue

 

BTW, did you test it against ransomware, and if not, can you do so? I wonder if you get better results than with RansomFree.

 

It's supposed to alert you about ransomware related activity. So did you try your ransomware samples, and what happened?

 

Well...I have a proof it worked (in a way).A (good) game with unusual installer (pointed by many GOG-users).A lots of quick-saves worked just fine,and after 3,5 hours wanted to make one "full" save,and quit gaming.No luck - game crashed to desktop.After that - every other quick/full save attempt had the same (crashing to desktop) result.I suspected bugs,uninstalled it and waited for patches...never thaught FSS was to blame.There was no warning at all.

 

I still have the install file but they claim they are making a better solution now.