NoVirusThanks OSArmor: An Additional Layer of Defense

...and one more for good measure.

 

Thanks for the info, will check it out.

 

I'm using OSA with Harmony Endpoint. Very powerful combo. In OSA i enabled all "suspicious" protections and basic lolbin stuff, Harmony Endpoint takes cares the rest.
Tested this combo against various bazaar samples about a week. I do not download or run anything from "user space folders". I just save pictures, videos etc to custom folders.
I was kinda impressed, when running some .exe samples, OSA reacted really fast "suspicious process detected". Before mighty Harmony Endpoint even reacts. I was like...wow.

Just one feature in OSA is that it really needs some more tampering protections(self protection mechanism). It's easy terminate OSA processes. When testing some malwares, they "kill" all the runnin processes which are not protected(chrome,outlook etc).

 

After enabling medium protection, I am getting a repeated block. I don't know what is making this run.
Here is a Microsoft doc about the cmdlet:
https://learn.microsoft.com/en-us/p...t/disable-computerrestore?view=powershell-5.1

Code:

Date/Time: 4/17/2024 10:09:39 AM
Process: [16032]C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Process Size: 413.5 KB (423,424 bytes)
Process MD5 Hash: 61732DBA77466B624C014B67A1E1348E
Parent: [4904]C:\Windows\SysWOW64\cmd.exe
Parent Process Size: 239.5 KB (245,248 bytes)
Rule: PreventCmdFromExecutingPowerShell
Rule Name: Prevent cmd.exe from executing powershell.exe
Command Line: powershell.exe  "Disable-ComputerRestore -Drive \"C:\""
Signer: <NULL>
Parent Signer: <NULL>
User/Domain: SYSTEM/NT AUTHORITY
System File: True
Parent System File: True
Integrity Level: System
Parent Integrity Level: System
Passive Logging: False

 

Is "Enable OSArmor self-defense (process termination)" enabled?

 

I cannot update my payment method over on FastSpring. Any ideas what I'm doing wrong. FastSpring tells me...talk to my credit card. My credit card tells me...talk to FastSpring.
My Appsvoid sub expires in May. My OSArmor sub expires in December.

Spoiler: unexpected error

 

Maybe reach out to @novirusthanks.