Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
942 stars 123 forks source link

Hardening Script Conflict #85

Closed co-devs closed 3 years ago

co-devs commented 3 years ago

Note that if you run the hardening script along with Raccine (full option tested), then line 160 (https://github.com/Neo23x0/Raccine/blob/main/scripts/windows-hardening.bat#L160) will not allow the user to manually update rules (error output below). Changing the value to "Warn" resolves this (at the expense of some protection).

Logs

See the end of this message for details on invoking just-in-time (JIT) debugging instead of this dialog box. \************** Exception Text ************** System.ComponentModel.Win32Exception (0x80004005): The operation was canceled by the user at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo) at System.Diagnostics.Process.Start(ProcessStartInfo startInfo) at System.Windows.Forms.ToolStripItem.RaiseEvent(Object key, EventArgs e) at System.Windows.Forms.ToolStripMenuItem.OnClick(EventArgs e) at System.Windows.Forms.ToolStripItem.HandleClick(EventArgs e) at System.Windows.Forms.ToolStripItem.HandleMouseUp(MouseEventArgs e) at System.Windows.Forms.ToolStrip.OnMouseUp(MouseEventArgs mea) at System.Windows.Forms.ToolStripDropDown.OnMouseUp(MouseEventArgs mea) at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks) at System.Windows.Forms.Control.WndProc(Message& m) at System.Windows.Forms.ToolStrip.WndProc(Message& m) at System.Windows.Forms.ToolStripDropDown.WndProc(Message& m) at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam) ************** Loaded Assemblies ************** mscorlib Assembly Version: 4.0.0.0 Win32 Version: 4.8.4250.0 built by: NET48REL1LAST_C CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v4.0.30319/mscorlib.dll \---------------------------------------- RaccineSettings Assembly Version: 1.0.0.0 Win32 Version: 1.0.0.0 CodeBase: file:///C:/Program%20Files/Raccine/RaccineSettings.exe \---------------------------------------- System.Windows.Forms Assembly Version: 4.0.0.0 Win32 Version: 4.8.4250.0 built by: NET48REL1LAST_C CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll \---------------------------------------- System Assembly Version: 4.0.0.0 Win32 Version: 4.8.4200.0 built by: NET48REL1LAST_C CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll \---------------------------------------- System.Drawing Assembly Version: 4.0.0.0 Win32 Version: 4.8.4084.0 built by: NET48REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll \---------------------------------------- System.Configuration Assembly Version: 4.0.0.0 Win32 Version: 4.8.4190.0 built by: NET48REL1LAST_B CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll \---------------------------------------- System.Core Assembly Version: 4.0.0.0 Win32 Version: 4.8.4220.0 built by: NET48REL1LAST_C CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll \---------------------------------------- System.Xml Assembly Version: 4.0.0.0 Win32 Version: 4.8.4084.0 built by: NET48REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll \---------------------------------------- System.Management Assembly Version: 4.0.0.0 Win32 Version: 4.8.4084.0 built by: NET48REL1 CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Management.dll \---------------------------------------- \************** JIT Debugging ************** To enable just-in-time (JIT) debugging, the .config file for this application or computer (machine.config) must have the jitDebugging value set in the system.windows.forms section. The application must also be compiled with debugging enabled. For example: \ \ \ When JIT debugging is enabled, any unhandled exception will be sent to the JIT debugger registered on the computer rather than be handled by this dialog box.

Neo23x0 commented 3 years ago

Thanks for reporting this issue

https://github.com/Neo23x0/Raccine/commit/c71478e43619f29ff2254640c6227430285064fa

Neo23x0 commented 3 years ago

https://github.com/Neo23x0/Raccine/releases/tag/1.2.1b