VoodooShield 5.50

If you were not experiencing issues with 5.51, then you can install over the top.  Otherwise, I would uninstall VS, reboot the computer and install 5.52.

I also included an automatic cleanup of the following folders, which runs right before each snapshot scan.  I personally think it is a great feature to add to VS anyway, but if there is a reason we should not automatically clean up the temp files, please let me know.  BTW, it automatically skips any files that are in use.

C:\Windows\Temp

C:\Users\User\AppData\Local\Temp

Also, I read a suggestion somewhere that was really cool… if you are still having issues with the WLC, please try the standalone version of WLC and let me know how it does.  The code is essentially the same at this point, but it is a smart troubleshooting step either way.  You can download it here:

https://www.whitelistcloud.com/Download/InstallWhitelistCloud.exe

BTW, there should not be a conflict between the standalone version of WLC and VS, so it should be safe to run them along side each other.  Although there is obviously not a reason to do so now, with WLC being fully integrated into VS.  I have to admit, I miss the tiny WLC standalone app though 😉.

Please let me know how it goes, thank you guys!

https://voodooshield.com/Download/InstallVoodooShield552beta.exe

SHA-256: dba4fd21024a2bc2686f5ed4e70f1242b5fd24bf66c5ad0987b4cd4ed56abc48

gorblimey:

Dan: … we will also have to figure out what to do about temp folders. As we all know, malware loves to hide in these folders, and the problem is so do legitimate apps, and a lot of these legitimate apps do not have a Safe file reputation.

Unfortunately there is no simple answer for temp folders, especially %appdata\local\temp%.  We won’t go into the reasons here, there are too many of them, all bad.  The most useful idea I have seen is to alter the permissions on all %user\temp% so nothing can execute from them and only ever use the Admin account to do Admin-type stuff.  My own ruleset uses the “Block Silently”, but given that so many people have …legitimate (?) softs that operate from %user\temp%, it would be better to force decision-making with a non-silent “Block” action.

It is important to also include c:\Program Data\ in the ruleset, as nothing should ever execute from this location.  Again, lazy devs.

I reiterate my policy of feedback to the publishers involved, criticising their poor security practices, also letting them know I have deleted their products from my box in favour of better-behaved programs.

Talking about restricting oneself to your LUA, I use and recommend SuRun, an adaptation of the *nix Sudo.  This securely elevates privileges in the LUA context rather than the Admin context.  It means I only need the Admin account for system-wide operations.

I hear you on this one, you should see the medical and tax software that are on our client machines, they break every security rule in the book and do not even bother signing their binaries.  And these are not small software companies, some of them are multi billion dollar companies and they completely ignore sound security practices.  And then everyone wonders why hospitals are smashed with ransomware.  Cybersecurity should be a community effort and everyone needs to do their part.  Until this happens, there will always be breaches.

Krusty: I think the WLC firewall rules only block access to non-whitelisted files.  WLC doesn’t create ‘Allow’ rules.

 

Just wondering… Could it be a slow connection between me and the WLC servers causing the WLC scan to take so long?

Well, the main SQL server is a super fast Microsoft Azure cloud database, and 90% + of the results will come directly from this server.  Unless you are rocking a dialup connection in Australia, I imagine this is probably not an issue.  We can actually replicate the SQL server to several different locations around the world, which will speed things up even more.  What kind of speeds do you guys get down under? ;).

I am guessing that there is / was a bug in the code somewhere that is hopefully fixed now… especially since it was taking longer than 10 minutes.  I think WLC was somehow stalling when it was trying to analyze files that it is not capable of analyzing, like .dat files.  This should be fixed now, but if not, please let me know and also send me your 2 logs, and we will get it fixed in a jiffy ;).

Sorry if I skipped a few posts… its been a long few weeks and I am dying to get away from the computer for a while ;).

Thank you guys, have a great weekend!