OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Monday, December 3 2007 09:18.13 CST

Modified: Monday, December 3 2007 14:55.28 CST

Printer Friendly ...

OSAM: Autorun Manager v1.0.0.4088 first public beta

Author: OnlineSolutions

# Views: 1928

One month ago we released a first public beta-version of OSAM (free tool). We are interested in the opinion of end-users and security community about the program. Here is an overview and download page. (You'll need to download Microsoft system libraries if you have no them or have a different versions).

"OSAM" (Online Solutions Autorun Manager) is a powerful and reliable tool for controlling the 'cleanliness' of components and applications that are automatically loaded or started under certain conditions without user's consent.

"OSAM" provides an easy one-click way of obtaining detailed information about the components that are run automatically at the system start and can potentially affect its operation.

Basically, all types of malicious software that have been around for the last 7-10 years use various mechanisms of sticking to an infected system. With this product, you will be able to monitor and control these activities and, which is more important, eradicate the threat on your own.

Rootkits are one of the biggest threats for end user systems. This malicious software integrates into the system on a very low level and completely hides its presence. The user is often totally unaware that the computer is being controlled by hackers. But that's not a problem: whether it's a hidden start of a rootkit driver or other hidden keys, "OSAM" will detect any of these autorun variants.

Modern malicious software, such as adware, spyware and spambots cannot be completely removed by existing anti-virus solutions. However, such treatment attempts often leave the user without working network connections or damage other system components. The user becomes helpless and alone with the problem. The "OSAM" manager will easily solve this problem!

The virus blocks access to a registry key or file? You can't remove them using any possible means? The "OSAM" manager will tackle this problem, too.

If the user is experiencing problems, he can use several program functions to seek experts' assistance (for instance, on our forum) - save a detailed system report (all autoruns) or save a full snapshot of the startup data (in the same form as on the user's system).

Functional capabilities:

- support of virtually all known methods of automatic loading using the system registry or
special folders;
- automatic detection of the peculiarities of settings on specific user systems;
- validation of digital file signatures;
- color marking of file statuses for better comprehension;
- filtering by statuses of detected objects;
- search by masks using any parameter in any display mode;
- output of additional information for any object type;
- output of detailed file information, validation of file existence and accessibility;
- temporary disablement of registry objects or files without creating additional keys or
subfolders;
- generation of two types of report files (text and HTML*) with all autoload information.

Unique capabilities:

- protection against rootkits by detecting hidden registry keys and records using the method of direct registry data analysis (without using OS functions);
- comprehensive support of LSP (Layered Service Providers) filters deletion and recovery with rearrangement of the providers chain;
- support of namespace providers (NSP) with rearrangement of the providers chain*.

Advantages:

- a completely free application!
- grouping by file objects enables you to quickly find all links to a specific automatically
loaded file;
- regular updates of the methodological database after the analysis of in-the-wild malicious
software;
- full Unicode support (any national characters, filenames and registry data);
- support of visual themes (skins) for users who do care how their favorite software looks.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit