Changeset 52906 in vbox

Timestamp:

Sep 30, 2014 7:14:27 PM (10 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

96337

Message:

SUP: detect ZoneAlarm installs.

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (3 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -243 +243 @@
 /** McAfee.  */
 #define SUPHARDNT_ADVERSARY_MCAFEE                  RT_BIT_32(4)
-/** Kaspersky.  */
+/** Kaspersky or OEMs of it.  */
 #define SUPHARDNT_ADVERSARY_KASPERSKY               RT_BIT_32(5)
 /** Malwarebytes Anti-Malware (MBAM). */
@@ -255 +255 @@
 /** Comodo. */
 #define SUPHARDNT_ADVERSARY_COMODO                  RT_BIT_32(10)
+/** Check Point's Zone Alarm (may include Kaspersky).  */
+#define SUPHARDNT_ADVERSARY_ZONE_ALARM              RT_BIT_32(11)
 /** Unknown adversary detected while waiting on child. */
 #define SUPHARDNT_ADVERSARY_UNKNOWN                 RT_BIT_32(31)
@@ -4972 +4974 @@
         { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\cmdkbd64.dll" },
         { SUPHARDNT_ADVERSARY_COMODO, L"\\SystemRoot\\System32\\cmdcsr.dll" },
+
+        { SUPHARDNT_ADVERSARY_ZONE_ALARM, L"\\SystemRoot\\System32\\drivers\\vsdatant.sys" },
+        { SUPHARDNT_ADVERSARY_ZONE_ALARM, L"\\SystemRoot\\System32\\AntiTheftCredentialProvider.dll" },
     };