Changeset 60521 in vbox for trunk

Timestamp:

Apr 15, 2016 12:52:48 PM (9 years ago)

Author:

vboxsync

Message:

SUPHardNt: detect cyprotectdrv(32|64).sys

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (3 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -368 +368 @@
 /** Digital guardian.  */
 #define SUPHARDNT_ADVERSARY_DIGITAL_GUARDIAN        RT_BIT_32(13)
+/** Cylance protect or something (from googling, no available sample copy ).  */
+#define SUPHARDNT_CYLANCE                           RT_BIT_32(14)
 /** Unknown adversary detected while waiting on child. */
 #define SUPHARDNT_ADVERSARY_UNKNOWN                 RT_BIT_32(31)
@@ -5215 +5217 @@
 
         /*{ SUPHARDNT_ADVERSARY_COMODO, "cmdguard" }, file system */
-        { SUPHARDNT_ADVERSARY_COMODO, "inspect" },
-        { SUPHARDNT_ADVERSARY_COMODO, "cmdHlp" },
-
-        { SUPHARDNT_ADVERSARY_DIGITAL_GUARDIAN, "dgmaster" }, /* Not verified. */
+        { SUPHARDNT_ADVERSARY_COMODO,               "inspect" },
+        { SUPHARDNT_ADVERSARY_COMODO,               "cmdHlp" },
+
+        { SUPHARDNT_ADVERSARY_DIGITAL_GUARDIAN,     "dgmaster" }, /* Not verified. */
+
+        { SUPHARDNT_CYLANCE,                        "cyprotectdrv" }, /* Not verified. */
     };
 
@@ -5333 +5337 @@
 
         { SUPHARDNT_ADVERSARY_DIGITAL_GUARDIAN, L"\\SystemRoot\\System32\\drivers\\dgmaster.sys" },
+
+        { SUPHARDNT_CYLANCE, L"\\SystemRoot\\System32\\drivers\\cyprotectdrv32.sys" },
+        { SUPHARDNT_CYLANCE, L"\\SystemRoot\\System32\\drivers\\cyprotectdrv64.sys" },
     };