VoodooShield

[ichito]

Mam wrażenie, że coś dziwnego dzieje się z rozwojem VS...nie żeby nic się w temacie działo...wprost przeciwnie - dzieje się mnóstwo i chyba zaczynam nie ogarniać tego zjawiska. Kolejne wydanie VS oznaczone 3.57 usuwa tryb pracy "lock down" i funkcję auto-ochrony

Here is a version with the lock down mode / self protection completely removed. I really need to focus on the enterprise web console, and at some point we can finish up this feature if we want... most of the hard work is finished, and it is close. That will also give us more time to consider all of the different options.

[Aby zobaczyć linki, zarejestruj się tutaj]

[Aby zobaczyć linki, zarejestruj się tutaj]

Dan, odpowiadając na ptanie jednego z użytkowników tłumaczy to następująco

imuade said:

[Aby zobaczyć linki, zarejestruj się tutaj]

So, if you have removed the self-protection, what's the difference between this 3.57beta and the official 3.53 ?

The items in this posts (except self protection) are included in 3.57

[Aby zobaczyć linki, zarejestruj się tutaj]

-Boot time protection… VS will start in Always ON mode, then toggle to your previous mode after 10 seconds. If we need to make this longer, please let me know.

-Gui starts much quicker and with the service

-Switch User / Multiple users issues should be fixed

-And also the new digital signature feature, and the small blacklist bug is fixed.

A wspomniany powyżej link to kolejne wyjaśnienie, ale odnośnie wersji 3.54

3.54 Changelog

Boot time protection… VS will start in Always ON mode, then toggle to your previous mode after 10 seconds. If we need to make this longer, please let me know.

Gui starts much quicker and with the service

Switch User / Multiple users issues should be fixed

Self-Protection

About the self-protection…

I looked into several different methods for self-protection, and found that they all had at least one issue or another, and all could be bypassed, so I tried to do something else instead… here is what I did.

In the highly unlikely event that malware tries to specifically target VS to kill or bypass it, the VoodooShieldService will kick in and completely lockdown the system, and block all new process creation until the computer is restarted… the user is notified of this as well. Basically, if malware is trying to disable your security software, there is no reason to take a chance to see if it is able to do so… so why not just lock the whole system down until reboot, just to be sure? That is… let’s say that your self-protection fails, and you have to restart your security software… well, that might give the malware a chance to do its thing.
Keep in mind, VS will protect itself 99.99% of the time by blocking processes and scripts before they are ever allowed to start. It is only very special targeted attacks, like the one Adam created, where an already allowed processes that is running as a network service asked VS to exit.

If VS continues to grow as it is, then I would guess in a year or two, malware authors might start to target VS. But once they realize that the second they start messing with VS, it simply locks the entire system down until it is rebooted, so hopefully this in and of itself will be a deterent.

[Aby zobaczyć linki, zarejestruj się tutaj]

Zawiłe nieco rozumowanie dla mnie...program, który daje się wyłączyć szkodnikowi zwyczajnie jest wyłączony i nie działa...jeśli natomiast szkodnik daje radę obejść któryś z jego mechanizmów na jakimś etapie swojego działania, to nie ma żadnej pewności, że ten sam mechanizm albo inny oferowany przez program nie wykryje szkodnika i go zablokuje/unieszkodliwi.
Coby jednak nie powiedzieć, to program ma swoich fanów i stałych testerów/komentatorów, którzy mocno udzielają się w dyskusji...między ostatnim tu cytatem o wersji 3.54 a wydaniem wersji 3.57 jest prawie 30 stron dyskusji i i ponad 630 postów !!