Changeset 60767 in vbox for trunk/src/VBox/HostDrivers/Support

Timestamp:

Apr 29, 2016 2:59:55 PM (9 years ago)

Author:

vboxsync

Message:

SUPHardNt: Log info about another security product.

File:

• trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp (modified) (3 diffs)

trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

@@ -372 +372 @@
 /** BeyondTrust / PowerBroker / something (googling, no available sample copy). */
 #define SUPHARDNT_ADVERSARY_BEYONDTRUST             RT_BIT_32(15)
+/** Avecto / Defendpoint / Privilege Guard (details from support guy, hoping to get sample copy). */
+#define SUPHARDNT_ADVERSARY_AVECTO                  RT_BIT_32(16)
 /** Unknown adversary detected while waiting on child. */
 #define SUPHARDNT_ADVERSARY_UNKNOWN                 RT_BIT_32(31)
@@ -5227 +5229 @@
 
         { SUPHARDNT_ADVERSARY_BEYONDTRUST,          "privman" }, /* Not verified. */
+
+        { SUPHARDNT_ADVERSARY_AVECTO,               "pgdriver" }, /* Not verified. */
     };
 
@@ -5348 +5352 @@
         { SUPHARDNT_ADVERSARY_BEYONDTRUST, L"\\SystemRoot\\System32\\privman64.dll" },
         { SUPHARDNT_ADVERSARY_BEYONDTRUST, L"\\SystemRoot\\System32\\privman32.dll" },
+
+        { SUPHARDNT_ADVERSARY_AVECTO, L"\\SystemRoot\\System32\\drivers\\PGDriver.sys" },
     };