Panda Cloud super tough protection tweak

Discussion in 'other anti-virus software' started by RejZoR, Aug 2, 2013.

Thread Status:
Not open for further replies.
  1. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    I'm not sure how this works and if it works as i think it should, but here it is. Only recommended for advanced users as this isn't properly tested yet.

    New Panda Cloud version 2.2 offers new feature called Data Shield that only allows certain apps to access protected files. But here is a tiny trick that can convert Panda Cloud regular protection into almost something similar to Comodo Defense+. If anyone can test this in virtual machine with real malware it would be even better (i currently don't have the test environment setup). :)

    How to setu Panda Cloud 2.2...

    Open main Panda Cloud interface and click the bubbles in the bottom right corner. Now select "Data shield" feature.

    PC_1.png
    First, add entire drive to the list of protected folders. If there are more of them, add all drives.

    PC_2.png
    Enabling "Allow access by secure apps" decreases the number of warnings by Panda Cloud.

    PC_3.png
    Make sure you add additional extensions to a list of protected stuff.
    I'm currently using the following extensions: exe,com,cpl,scr,cmd,lnk,msi,pif

    In theory (at least), this should provide superior protection against file infectors and patchers even if they sneak by the Panda malware detection systems.
    Data shield prevents any modifications done by unknown apps but allows modifications done by safe apps that are whitelisted by Panda, so it shouldn't interfere with clean apps (much). For those that aren't safe and try to modify protected files, Panda will display a popup, asking you what to do (Allow/Deny).

    I have set it up this way and i haven't got any popups yet except for Rocketdock. So, so far so good.
     
  2. guest

    guest Guest

    Thanks for the tip. That's pretty much how I configured OA's file shield, except a little bit more paranoid. :D

    A question, is there a learning mode for the allowed programs or we have to add them all manually?
     
  3. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Well, that "Allow acces by safe apps" automatically allows safe apps so you don't get asked for that. Allowed apps do get added when Panda asks you what to do, but that rarely happens anyway (in my case).
     
  4. anon

    anon Registered Member

    Joined:
    Dec 27, 2012
    Posts:
    4,087
  5. guest

    guest Guest

    Safe according to Panda's whitelist?
     
  6. BoerenkoolMetWorst

    BoerenkoolMetWorst Registered Member

    Joined:
    Dec 22, 2009
    Posts:
    3,764
    Location:
    Outer space
    Creative! nice idea :)
     
  7. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Yes. You can also leave that unchecked if you don't mind answering questions to all the system components trying to access the files...
     
  8. ichito

    ichito Registered Member

    Joined:
    Jan 14, 2011
    Posts:
    1,485
    Location:
    Poland - Cracow
    Great idea...thanks for sharing...but I think this solution is very similar to some feature in ThreatFire
    Advanced settings/Custom rules/Launch control/Modify/Any process/tries to access a file (write-delete-create-execute)/in the folder/C: (instead of Program Files)/Except when...
    Rule description: Controls installation, alteration and execution of any normally installed program.
    Mainly...it's great feature uncovered in PCA :thumb:
     
  9. treehouse786

    treehouse786 Registered Member

    Joined:
    Jun 6, 2010
    Posts:
    1,388
    Location:
    Lancashire
    will this also help against malware that stays in ram?
     
  10. ZeroDay

    ZeroDay Registered Member

    Joined:
    Jul 9, 2011
    Posts:
    693
    Location:
    Hogwarts.
    Nice find RejZoR :thumb:
     
  11. Brandonn2010

    Brandonn2010 Registered Member

    Joined:
    Jan 10, 2011
    Posts:
    1,849
    Wow, that's cool! I look forward to tests.
     
  12. plywood99

    plywood99 Registered Member

    Joined:
    Apr 23, 2013
    Posts:
    4
    Location:
    usa
    Very nice find Rejzor. :)

    Testing this now.
     
  13. fblais

    fblais Registered Member

    Joined:
    Jul 31, 2008
    Posts:
    836
    Location:
    Québec, Canada
  14. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    seems nice but just not a fan still of panda cloud. and for sure not a fan of to many annoying pop ups at least on my own system i know what im installing and why i dont need a program to tell me during the install what each and every file is doing unless im doing testing on a av. ill test it sometime this week to see how it does set up like this.
     
  15. taleblou

    taleblou Registered Member

    Joined:
    Jan 9, 2010
    Posts:
    1,166
    Well I am going to run this setting in a vm against very fresh zero-days malwares that usually pass avs with very few detections and see if they are blocked.
     
  16. taleblou

    taleblou Registered Member

    Joined:
    Jan 9, 2010
    Posts:
    1,166
    I just tried it and after reboot I get "BLACK SCREEN" (windows will not load). This is win 7 ultimate 64bit in VM.

    I think adding the "C" drive to protected folder is a BAD IDEA. Atleast on a 64bit win 7. Doing this will cause windows failure to boot-up and give a blackscreen.

    I will try to re-test but without adding the "C" drives but will do the rest of the tweak to see if windows load and how it does.
     
  17. taleblou

    taleblou Registered Member

    Joined:
    Jan 9, 2010
    Posts:
    1,166
    well even with adding executables, the vm got infected by the zero-day malwares.

    So it seems that adding executables does not increase the protection. Addition of "c' drive for protection causes windows to boot to blackscreen.
     
  18. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    ^^^^ decided to play around with it and funny thing is i get the same result here .....
     
  19. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    It doesn't protect writing to folders, it protects OVERWRITING protected files. Meaning file infectors like Sality or Virut shouldn't be able to modify (infect) files. Test with file infectors.

    As for the black screen, i noticed it too but it was random, it worked most of the time but then out of the blue it won't anymore. I also had a random Musicbee failure after using it for a while. It seems like Data shield is still a bit buggy because things like this shouldn't happen even if you add entire drive to protection.
     
  20. Mops21

    Mops21 Registered Member

    Joined:
    Oct 5, 2010
    Posts:
    1,499
    Location:
    Germany
  21. JRViejo

    JRViejo Global Moderator

    Joined:
    Jul 9, 2008
    Posts:
    20,913
    Location:
    U.S.A.
    Merged Threads.
     
  22. Vilmalith

    Vilmalith Registered Member

    Joined:
    Nov 28, 2007
    Posts:
    63
    I tried these settings and could no longer login to the machines I tried this on after a reboot. Fresh, totally updated installs of Windows 7 Pro 64bit and fresh installs of Panda Cloud 2.2.1. Configured as is shown here, rebooted... Windows login screen never shows up, mouse pointer does and blind entering passwords didn't seem to do anything.
     
  23. plywood99

    plywood99 Registered Member

    Joined:
    Apr 23, 2013
    Posts:
    4
    Location:
    usa
    I've done numerous restarts since adding C: drive and have had no problems at all. I use Musicbee also and it performs as it always has.

    Everything is running flawlessly.
    Windows 8 Enterprise 64bit.
     
  24. Impet

    Impet Registered Member

    Joined:
    May 5, 2013
    Posts:
    894
    Great, I will try it! :thumb:
     
  25. TheKid7

    TheKid7 Registered Member

    Joined:
    Jul 22, 2006
    Posts:
    3,469
    Thank you for the tweak information.
     
Loading...
Thread Status:
Not open for further replies.