Certainly, a good antiviral will help protect your computer (as will common sense), but some 15,000 new viruses are occurring everyday so antivirals are in a little to be envied “catch up” position. But, while no new versions of common sense are available, sometimes it just isn’t your fault if you catch a ‘drive by’.
There are additional levels of protection such as virtualization of browsing and to allow running apps in a protected environment…like Sandboxie which also exists in some Chrome, and are available to virtualize the OS.
Another level of antimalware exists which mitigate certain types of attacks like EMET and Malwarebytes Anti-Exploit.
There are also “Anti-EXE” programs, and VoodooShield is one such (others: https://duckduckgo.com/?q=anti-exe+programs).
VoodooShield (free for personal use) is the one reported on here, after appearing on Neowin and gHacks. It allows only “whitelisted” programs and blocks any others not “whitelisted”.
Problem one: When installing, it asks permission to turn off your UAC and states that if you choose ‘don’t’, that might interfere with functionality. While the UAC isn’t the greatest of protections, it still is worthwhile having, if only as a “let me think about this again” pause before installing. VoodooShield then takes a snapshot and defaults to all current software being whitelisted.
Problem two: So, you have to have scanned your system (I recommend herdProtect online) for malware and dealt with all of it before proceeding and installing.
Then you turn on the software and it will protect your status quo and not allow anything new to run. If something new does attempt to run, you are notified and can choose to allow it or not.
When right clicking the systray icon (or widget) you get three modes:
- Training: VoodooShield is off in that mode and does not protect the computer. It does learn about programs that you run on it though and will remember that choice.
- Smart Mode: VoodooShield is still off but will protect your computer against programs run from the user space (under /user/username automatically).
- Always On: The program is on and blocks any program from running that is not whitelisted or in the Windows folder or installed software.
VoodooShield also scans any .exe that is blocked by Virustotal and will display info about threats in that program.
More problems: The free edition doesn’t allow changes in the program’s advanced options. Not good, since you can’t manage directories you want whitelisted, nor manage the whitelist in any way…so you can’t even check if a program is whitelisted or not, or whether it’s not running because of a problem in the program. Also, If you accidentally run malware during the training mode, it will be ‘whitelisted’.
Worse: It automatically whitelists everything in the Windows folder. This alone should make you think 20 times about installing it in the free form, anyway. Who says everything in your Windows folder or which got into your windows folder in the past, is just fine?
Also, I don’t know whether uninstalling it will return your UAC to the prior level, or whether that will change the programs not whitelisted before.
All in all? I don’t recommend the free edition.
If you insist on installing it, please backup your full disk before doing so. Do some research about the software. Think again another 2 or so times.
Source:
http://www.ghacks.net/2014/10/18/voodooshield-protects-your-pc-by-only-allowing-whitelisted-programs-to-run/?_m=3n%2e0038%2e1400%2ehj0ao01hy5%2e1g6i
http://www.neowin.net/news/voodooshield-211-is-now-available-as-freeware