NoVirusThanks OSArmor: An Additional Layer of Defense

1.7.5 test 6 is yar (running fine) on Win7.

 

We've released OSArmor v1.7.5:
https://www.osarmor.com/download/

Here is the changelog:

If you have automatic updates enabled then OSArmor should auto-update in the next hours.

Else you can install it "over-the-top" of the installed version, reboot is not needed.

*** If you are running the test builds you need to manually update to this final version.

If you find false positives or issues please let me know.

 

Great! Thank you. Waiting for the internal updater to kick in...

PS: Got v1.7.5 via internal updater a couple of minutes ago. Thanks.

 

@novirusthanks -- thanks for keeping OSA at the leading edge. 1.7.5 is running smoothly on my Win7.

 

We've released OSArmor v1.7.6:
https://www.osarmor.com/download/

Here is the changelog:

If you have automatic updates enabled then OSArmor should auto-update in the next hours.

Else you can install it "over-the-top" of the installed version, reboot is not needed.

If you find false positives or issues please let me know.

@Buddel @bellgamin

Great, thanks for the feedback

 

Thanks so much! Burning the midnight oil again

 

Thanks Andrea. Installed over the top and testing it, so far so good

 

Here is a new video of OSArmor:

Testing OSArmor with Magniber, Maldocs, Qbot, IceID, Bumblebee
https://www.youtube.com/watch?v=kdtHxUqDNMc

The duration is 25 minutes, is spoken in English and there are chapters for important sections.

Some particularly interesting parts are when testing LNK, IMG, ISO, MSI, EXE (signed) and HTML samples.

Hope you'll enjoy the video

 

@novirusthanks

Salutations/Greetings,

Thank you for sharing the new video OSArmor. With Testing OSArmor with Magniber, Maldocs, Qbot, IceID, Bumblebee.
Very Helpful. Enjoy the video with details.
Would love to see more videos in the near future, maybe every couple of weeks. Your details are especially important showing
how you setup of OSAmor. Before testing....

Always the best,

 

Interesting video. Thanks for uploading it.

 

We've released OSArmor v1.7.7:
https://www.osarmor.com/download/

Here is the changelog:

If you have automatic updates enabled then OSArmor should auto-update in the next hours.

Else you can install it "over-the-top" of the installed version, reboot is not needed.

If you find false positives or issues please let me know.

@Moose World @Buddel

Glad you liked the video!

Will see if more videos can be made on the next weeks.

 

Updated automatically to 1.7.7. I'm still having the issue where I have to keep the mouse pointer within the Search box of the Configurator in order to keep typing in there.

Also, I read about this. I know it's exceedingly rare for a Home user but for Enterprise version at least, would it be relevant to make a rule about calc .exe? It wouldn't necessarily have to be enabled by default but just to have. I looked briefly under the Restrict Windows Programs heading but didn't see it there.

Would be another interesting thing to include in your next video maybe.

 

.doc, .xls and .ppt are old office file types, all of which are blocked here by default. What about the newer office file types .docx, .xlsx and .pptx? I presume that OSA can also block newer office files if they are malicious in one way or another.

 

@plat1098

Not yet fixed, will need to discuss about some UI improvements in the protections tab before fix it, but is on the todo list =)

The sample on the article you shared is already blocked, on the video it can be seen at 10:30 timeline:

Code:

https://www.youtube.com/watch?v=kdtHxUqDNMc&t=630s

It is blocked by protection option "Block execution of suspicious processes" (enabled on all protection profiles).

For an additional protection you may want to enable this option:

"Block system processes on user space"

@Buddel

Of course, any MS Word/PowerPoint/Excel extension is covered (they all open the respective MS Office applications that are monitored).

On the video at 22:03 you can see Excel maldocs have various extensions like .xls, xslx, xlsm, xlsb:

Code:

https://www.youtube.com/watch?v=kdtHxUqDNMc&t=1323s

I wrote only main MS Office file types .doc, .xls, .ppt on the video description else it was too long if I had included all file types.

 

Thanks for the explanation, NVT. Much appreciated.

 

Oh, OK about the search box item. Whenever is good.

I just read here that the calc side-loading doesn't work in Windows 10 any longer anyway--that the deployers are using Windows 7 for this activity. Thanks for that bolded note, @Gandalf_The_Grey . Scanned right over it. But enough are still using Windows 7 in the Enterprise world, it seems.

https://malwaretips.com/threads/qbo...loading-to-infect-devices.114891/#post-997282

Hey, if you don't ask, you don't get.

 

Here is a pre-release test 1 version of OSArmor PERSONAL v1.7.8:

Code:

https://downloads.osarmor.com/osarmor-personal-1-7-8-setup-test1.exe

You can install it "over-the-top" of the installed version, reboot is not needed.

Let me know if you find issues or FPs.

This is the changelog so far:

The new Windows Terminal app can be abused to proxy execution of other processes:
https://twitter.com/novirusthanks/status/1552805567076483077

May be used soon on Qakbot or maldocs so if you don't use it you may want to block it with the new OSA option.

 

Here is a 30% OFF coupon code for this summer:

SUMMER2022

The discount is applied also for next renewals and is valid for a total of 25 orders (hurry up ).

Have a great weekend everyone!

 

@novirusthanks thanks i really appreciate this

 

@novirusthanks

thank you so much again!

 

@novirusthanks -- I am uncertain about the details of the summer sale.....
1) My current license is good through Jan 8, 2023
2) I'm not sure if the discounted license would add time to my present license's expiration date, OR if the discounted license would be a replacement for my current, unexpired license.
3) I thought you were going to have a Christmas sale in December & had planned to wait for that one. If not, it's no problem -- your full price for OSA is quite reasonable IMO.

I truly appreciate your kindness to us Wilders folks. Aloha from Hawaii, as always.

 

@bellgamin

Sorry for the delay, mainly we offer discounts at Summer (June/July) and in December (so we'll offer discounts for this December too).

The discounts are valid only for new licenses (cannot be applied to already purchased licenses).

Hope that helps

 

Thanks @novirusthanks for the information. I will wait for December to re-new (Merry Christmas!).

Another question I should have thought of in my prior post...

WHEN does a license take effect:
1- On the date it is purchased?
OR
2- On the date it is activated & put into use?

 

Just wan to share..

-- It may be #1. On licenses that are awarded in "giveaways", the start date is when the license has been generated and sent to the winner's email not when you activate it. Once generated the license will be "in-use" and clock will tick till it's end life.

 

Thanks @jasonbourne -- you are probably correct but I would still like to hear NVT's "official" answer. BTW, NVT's sales are not "giveaways."