AppDefend v1.300 Alpha Release

[Jason_R0]

http://www.ghostsecurity.com/downloads/setupadrd1300b1.exe

-{ Quote: "Changes since last version
-Added new threaded window manager to handle theme, backend and window changes [needed for GSS alert interaction + logo + ghosts] automatically and in a cleaner way.
-Added the ghosts and logo back. Some small changes to ghosts.
-Added AppDefend mutex protection, the mutex's to monitor are stored in gss_mutex.txt stored in system32. Simply add mutex's there and reboot and AppDefend will use them
-Some changes relating to windows2000 compatibility in the driver
-Some fixes to extended AppDefend flag support which was only partially done before because no extended flags were needed, with mutex protection they were." }-



-{ Quote: "*IMPORTANT NOTES*
-Uninstall your current Ghost Security Suite (make backups of the config files if you want to reuse them) before installing the alpha
-If you run into *ANY* trouble, simply boot into safe mode and uninstall (or remove ghostsec.sys in c:\windows\system32\drivers)
-The driver WILL NOT run in safe mode, without the driver active you will have NO system problems related to GSS/AD
-There is no new gss.exe (front end), so it will still say it is v1.200 alpha in that, you can edit AppDefend rules, but RegDefend cannot be accessed through gss.exe yet
-This has been most extensively tested on Windows XP SP1 and SP2
-On Windows 2000 there is a known bug where during a createprocess it thinks the starting app is actually the parent app
" }-

A few weeks late, but here is the next alpha of AppDefend (and RegDefend).

Compared to the last alpha a lot has changed under the hood, all of the core work is now done at the kernel level - which required the shifting of most of the old core into kernel mode. This is much more secure and gives greater control over how things like rule files are handled (if they are missing, corrupted, etc) and there is no mess in telling the driver what to do when it comes to certain events unlike before. In effect it is more efficient as there is no need for any process to be involved, whereas before 3 or 4 communications would need to be made for any actual event. The "downside" to this, if you could call it that, is the time it took to get it right and stable. Hopefully this alpha is a lot more stable than v1.200, it has been for myself and the private beta testers anyhow.

RegDefend (the upcoming v3) has also been added since the last GSS alpha, and it now automatically handles everything from the kernel level just like AppDefend. At the moment I have only added about 8 rules manually, relating to common registry startup areas and service/driver areas, but it will be enough to test out RegDefend and report back on it's stability. Due to no new gss.exe (with the new GUI code) you cannot edit the rules due to the internal changes in how RegDefend works, but you will when the new gss.exe is ready (upcoming alpha).

I am going to be releasing more updates on a regular schedule until the final is done so people can see the progress more clearly.

old v1.300 versions
http://www.ghostsecurity.com/downloads/setupadrd1300.exe

[MsFluffyMuffin]

Hmmmm.......I'm going to give this puppy a go, it sounds sweet to me, I'm sure its got a lot of improvements over the previous builds, one thing put me off the other alphas was the lack of RegDefend, I will give this a go on my laptop too.

@ Jason: It made my day to hear this "I am going to be releasing more updates on a regular schedule until the final is done so people can see the progress more clearly." , it can only help to improve things, we can test new features/functions and of course stability of the code more often, there for we all benefit, thats good to hear to, so thanks ;D

Fluffy

[MsFluffyMuffin]

Well, I just downloaded it and gave it a test drive, came across a few problems already :-

1). RegDefend is totally disabled and cannot be enabled, plus theres no rules, the rules section is blank, just complains about choosing a profile, since there are none I cant choose any.

2). The alerts need to be z-ordered, at boot sometimes the alerts are frozen and cant be clicked on for a short while, after a short while the current alert is replaced with a new one so you never get to allow or block the previous one.

3). Either during boot or shutdown some alerts are never remembered, for example for me BoClean will always generate an alert everytime I shutdown, even through I tell AppDefend to always to allow.

4). Comodo Firewall 2.4 cannot initialize for some reason, so it becomes non functional.


Okay, thats all I can remember for now, apart from those issues very impressive Jason, you seem to be getting there and making the next version awesome, I like the boot time protect, should give malware a real headache.....hehe

Fluffy

[Mongol]

Is this new Alpha release incorporating Tonys ruleset for Regdefend...??? ;D

[BlueZannetti]

-{ Quote: "Well, I just downloaded it and gave it a test drive, came across a few problems already :-" }-I took a quick spin on this alpha version as well, as the alpha designation suggests, exercise caution in using it.

I installed it on two partition variants, one with a "typical" security setup (it happened to be Dr Web/AVG Antispyware/Returnil) and a second which had no security software installed.

I noted some of the problems noted above (alerts seemingly losing focus, some lack of remembering). It also appears that there is a significant conflict with one or more of (Dr Web/AVG Antispyware/Returnil).

On the clean partition (Dr Web/AVG AS/Returnil/GSS uninstalled then GSS only reinstalled) a problem developed which quickly morphed into a continuous restart cycle a minute or two into a login session.

Problems were resolved with straightforward safe mode uninstalls.

System is a vanilla Dell 4500 Win XP SP2 with 1 GB of RAM. In my hands, on my system, stability is not quite where it should be.

Blue

[MsFluffyMuffin]

@ Mongol: At the moment Jason has only added about 8 rules, and RegDefend can not be used to edit rules as GSS is still using the old GUI code, this build is only to test the new core of GSS, hopefully the new GUI code will be added soon so we can test it out too ;D

So far great work Jason, the only thing that I would like to see changed is the position of the buttons on the alerts, maybe if they were at the bottom of the alert it would be easier/quicker to deal with an alert, just a thought, through I admit to liking the old style (beta v1.110) :)

Fluffy

[BlueZannetti]

One specific problem that I've seen, even though I was under the impression that RD was fully disabled, is the appearance of RD prompts during logon. An example shot is below. Generally, this wouldn't be a problem. Unfortunately, that alert window won't process input or respond in any way. Right now I'm ~ 15 minutes into a session and it's still sitting on top of everything in the middle of the screen, blocking any further processing of GSS prompts or any popup that it fully covers.

Blue

[Pedro]

XP SP2, Toshiba M70-320, Only GSS and Avast! for security: system froze after entering login password. Reboot, same thing. Tried with and without Ghostshell.
Last alpha version allowed boot without issues (with Ghostshell), and i could see the ghosts during boot process, not this time (are they shy now).

If more input is needed, please tell me, i don't know what is needed.

[Mongol]

-{ Quote: "@ Mongol: At the moment Jason has only added about 8 rules, and RegDefend can not be used to edit rules as GSS is still using the old GUI code, this build is only to test the new core of GSS, hopefully the new GUI code will be added soon so we can test it out too ;D

So far great work Jason, the only thing that I would like to see changed is the position of the buttons on the alerts, maybe if they were at the bottom of the alert it would be easier/quicker to deal with an alert, just a thought, through I admit to liking the old style (beta v1.110) :)

Fluffy" }-

Glad I held off on installing. I rarely mess with beta stuff but the possibility of something new here really wet my whistle...:o ;D

[MsFluffyMuffin]

@ Mongol: Theres no harm in trying out Alpha's or Beta's so long as you have a way to back up your system before installing and reverse any changes if something goes wrong, I only use my long years of experience with windows to fix any problems, but if I was worried I would use some kind of drive imaging software to take a snapshot before installing an Alpha or Beta, truth is never over extend your self, stay within your knowledge, alot of people get excited and install a Beta or Alpha build and cant reverse things when it goes wrong, at the moment if I was you I would wait for a stable Beta to come out and then give GSS a test drive, good luck and have fun when or if you do :)

Fluffy

[Mongol]

-{ Quote: "@ Mongol: Theres no harm in trying out Alpha's or Beta's so long as you have a way to back up your system before installing and reverse any changes if something goes wrong, I only use my long years of experience with windows to fix any problems, but if I was worried I would use some kind of drive imaging software to take a snapshot before installing an Alpha or Beta, truth is never over extend your self, stay within your knowledge, alot of people get excited and install a Beta or Alpha build and cant reverse things when it goes wrong, at the moment if I was you I would wait for a stable Beta to come out and then give GSS a test drive, good luck and have fun when or if you do :)

Fluffy" }-

Thats what I plan to do, wait for word from Jason about a new Alpha/Beta release ironing out some of these early wrinkles. For now the 1.20 release is rolling along just fine here...8)

[MsFluffyMuffin]

Are you using the stand alone RegDefend v2.000 with the AppDefend v1.200 ? I did think about doing this myself, but I guess I'm so used to using GSS that I prefer to use AppDefend and RegDefend in one whole suite, its nice having the two side by side in GSS rather then two separate programs and GUI's , not that it matters now, I mean Jason will soon have the new Alpha and hopefully not long to go the Beta stable and good to go :)

Fluffy

[Mongol]

I'm using the suite. You are right, its nice having the two together in one package...:thumb: 8)

[farmerlee]

v1.300 up and running fine here. There was a little delay with some of the alerts on first boot but after that its been running great. I'm a little sad that the ghosts have been taken away, i liked the ghosts floating around on screen. Perhaps you could put an option in to enable/disable it?

[MsFluffyMuffin]

@ farmerlee: Just wondering, did you delete the old GSS folder before installing ? , I think I forgot and wonder if the left overs caused any problems I saw :-\ , maybe I will try a fresh download and install :)

I didn't see any ghosts on my screen either, weird, is it a bug or has Jason disabled or removed them from this build ?


Fluffy

[cbuddha42]

Hey, is there a 64-bit version available?

[farmerlee]

-{ Quote: "@ farmerlee: Just wondering, did you delete the old GSS folder before installing ? , I think I forgot and wonder if the left overs caused any problems I saw :-\ , maybe I will try a fresh download and install :)

I didn't see any ghosts on my screen either, weird, is it a bug or has Jason disabled or removed them from this build ?


Fluffy" }-
I just uninstalled v1.2, restarted my system then installed v1.3.

I'm still waiting on a reply from jason in regards to the floating ghosts, hopefully he can clarify the situation.

[MsFluffyMuffin]

@ farmerlee: Thanks, I will look forward to hearing the reply, I'm sure theres a good reason why, and Jason will at a later date bring the ghosts back :thumb:

I have tried a fresh install, during boot up I had no alerts (strange ???) , then when the desktop started loading I got some alerts, mostly RegDefend ones, like with BlueZannetti, I had one stuck permanently on my screen and it wouldnt go away, I tried clicking but it wouldnt accept any clicks, in the end I had to reboot, but the system wouldnt shutdown, I did the old hold the power button in trick, no problem, it shutdown, also I had problems with my Comodo firewall, it refused to initialize, just asked me to re-install it, my feeling is the GUI code is causing these issues, hopefully when Jason adds the new GUI code it will solve them :)

Fluffy

[Jason_R0]

-{ Quote: "Hey, is there a 64-bit version available?" }-

No, but it should be fairly simple to do a 64bit build (as long as you remove the "useless" kernel update Microsoft added to stop GSS). I will do a test later tonight, and if it works without much work required I'll release it.

[Jason_R0]

-{ Quote: "@ farmerlee: Just wondering, did you delete the old GSS folder before installing ? , I think I forgot and wonder if the left overs caused any problems I saw :-\ , maybe I will try a fresh download and install :)

I didn't see any ghosts on my screen either, weird, is it a bug or has Jason disabled or removed them from this build ?


Fluffy" }-

I've removed them at the moment, but they will be back soon.

I forgot to mention there are 3 files you should look at removing yourself, at this stage at least (uninstaller will ask eventually). They are in your system32 folder, and start with "gss_" . They are the rules and other files, if you uninstall and keep those files there AppDefend will think they are still valid and you won't get any more alerts until you change the rules.

[Jason_R0]

-{ Quote: "Well, I just downloaded it and gave it a test drive, came across a few problems already :-

2). The alerts need to be z-ordered, at boot sometimes the alerts are frozen and cant be clicked on for a short while, after a short while the current alert is replaced with a new one so you never get to allow or block the previous one." }-

It actually depends on the situation, sometimes the system is doing something which makes it disable input for various reasons, especially during boot you can get some alerts you will never be able to respond to, but you will be able to "see" them. Winlogon seems to do this with network access at boot on XP machines.

-{ Quote: "3). Either during boot or shutdown some alerts are never remembered, for example for me BoClean will always generate an alert everytime I shutdown, even through I tell AppDefend to always to allow." }-

At the moment RegDefend alerts won't be remembered, but if it is indeed AppDefend then it is something curious. Could you tell me what specific BOClean things aren't remembered?

-{ Quote: "4). Comodo Firewall 2.4 cannot initialize for some reason, so it becomes non functional. " }-

Yes that is a problem people have been noting with the last alphas too, it still needs more work to figure out what it is doing that is breaking when GSS is installed.

[yankinNcrankin]

I have v1.30 installed and a couple of reboots back I was able to see gss in my task manager and edit the apps section for a few tweaking and now it doesnt show up at all. The cool part is the protection is still on and it remembered all of my settings prior to set up. All I need to do is use the gss start exe to launch the gui. However now in the apps section there are no apps to be viewed anymore but gss still remembered my previous settings. What is cool about this program now is that none of the RK scanners can detect gss as running as a service its like it don't exist except for its hooks into the kernel of course which can be seen.
Was able to aquire access to the apps table and this time it shows all of my apps that I set up previously, did this by starting a new program which got flagged by gss then launched the gui and now all my apps shows up in the apps table which I can now edit settings to them if I choose. I like the memory usage only 2,100k.

[SystemJunkie]

There is still v.1.200 at the top of the form, I guess the change to v.1.300 has been forgotten.

I also experience the Disabled state of Reg Defend. I receive the same RegDefend screen like Blue Zanetti. Finally all critical GSS files working fine.

[MsFluffyMuffin]

@ Jason: Thank you for the info on the ghosts, RD and everything else too, I cant wait until they are back and RD is completely working, I have deleted the gss_ files and this has helped lots, I think it was just junk from previous installations causing some problems.

All I see now from BoClean (boc424.exe) is a RD alert during shutdown, I guess this is to be expected at the moment, I will keep you posted to anything else.

As for Comodo firewall, I'm unsure to whats going on, the last install of GSS alpha v1.300 after a few reboots the Network Monitor initialized, but thats all, the Application Monitor, Component Monitor and the Application Behaviour Analysis were all un-initialized, strange, I'm unsure as to why the Network Monitor started working during boot up, or the other way around, why the others wouldnt initialize :-\

I have noticed the same as yankinNcrankin, if you either add a new application by browsing for it or just clicking the add button then the Applications list gets populated, before browsing or adding its totally blank, I have seen some other blank entries and duplicated System info, I mean in the Info section on the System tab, my Comodo cpf.exe has lots of winhlp32.exe listed, and PaintShop pro 9 is totally blank, while the others have normal entries, just seems rather weird to me :-\

Fluffy

[Mark Klomp]

But I'm not sure about it being kernel level. I mean the downside is now it has become a vital (system-) process of the computer, and when it crashes, your computer gives a BSOD, right? Or am I wrong?

Guys I installed the v1.3, but it's totally disabled as you said, and I don't even get any alerts, so i don't know how you are doing this, to get alerts. No rules have been installed, so how the hell can you get alerts? I tried to install my backupped alerts of my previous v1.10 beta version, but I can't install them. first copied them to program files (didn't worked), then to system32 folder, and renamed them to the names GSS is searching for. But it couldn't load them successfully, although ofcourse it said they found the files.

there needs to be done really much yet for it to be final I can see.

[SystemJunkie]

-{ Quote: "I cant wait until they are back" }-

Yep, the ghosts are important :-)
Beside I also liked the Pop-up Forms from version 1.2 a, maybe you can add an option that user can choose which forms he wants to use either 1.2 a or 1.3 a.

[f3x]

Hi SysJunky.

The only reason between change of look is that Jason now use 100% ms free code for the alert now. The whole code to display controls have changed.
The alerts are now made from the same "meat" as GhostShell. So yes they are skinable. However I also agree that those alerts need some work and i'm pretty sure that once RD is completely back it'll become one of the priority.

It'll be great if we could start a thread posting alerts window of diffferent security program and just comment what we like or don't and that way build a nice interface.

[yankinNcrankin]

-{ Quote: "But I'm not sure about it being kernel level. I mean the downside is now it has become a vital (system-) process of the computer, and when it crashes, your computer gives a BSOD, right? Or am I wrong?

Guys I installed the v1.3, but it's totally disabled as you said, and I don't even get any alerts, so i don't know how you are doing this, to get alerts. No rules have been installed, so how the hell can you get alerts? I tried to install my backupped alerts of my previous v1.10 beta version, but I can't install them. first copied them to program files (didn't worked), then to system32 folder, and renamed them to the names GSS is searching for. But it couldn't load them successfully, although ofcourse it said they found the files.

there needs to be done really much yet for it to be final I can see." }-
Upon install I was able to answer initial prompts after a couple of reboots I would get the system tray icon and opening program from there resulted in no apps showing up[ in the apps section. Closing the program the system tray icon disappears and gss.exe would be gone completely from the task manager, however system protection still active even though the service don't show up in task manager or various RK scanners. Kind of wondering how this program could really be disabled if it doesnt even show up as running at all but yet protection is still active, I think its pretty cool either way. My work around to the apps not showing in the apps section for editing rules was to launch a totally new program which gss would automatically prompt for action, after this I would launch gss.exe and go to the apps section and volla all my programs and apps that were prompted earlier for rules were showing.
As soon as I close out the program system tray icon disappears again and no service(s) for gss being displayed in task manager but protection still active, very cool.

[farmerlee]

-{ Quote: "Yep, the ghosts are important :-)
Beside I also liked the Pop-up Forms from version 1.2 a, maybe you can add an option that user can choose which forms he wants to use either 1.2 a or 1.3 a." }-
I actually prefer the pop up forms from v1.1. I'm hoping jason can add an option to be able to choose between them.

[Jason_R0]

-{ Quote: "Upon install I was able to answer initial prompts after a couple of reboots I would get the system tray icon and opening program from there resulted in no apps showing up[ in the apps section. Closing the program the system tray icon disappears and gss.exe would be gone completely from the task manager, however system protection still active even though the service don't show up in task manager or various RK scanners. Kind of wondering how this program could really be disabled if it doesnt even show up as running at all but yet protection is still active, I think its pretty cool either way. My work around to the apps not showing in the apps section for editing rules was to launch a totally new program which gss would automatically prompt for action, after this I would launch gss.exe and go to the apps section and volla all my programs and apps that were prompted earlier for rules were showing.
As soon as I close out the program system tray icon disappears again and no service(s) for gss being displayed in task manager but protection still active, very cool." }-

GSS.exe is no longer needed for any protection to be enabled, and when the update of it occurs (over to the new GUI code) it will basically just be a way to edit rules, view logs, and things of that nature.

The way protection works now means only the driver needs to be active, as it handles the interaction with the user, rather than needing to be a service like other products (and how I used to do it). This is why the new GUI code had to be developed to allow such a tight integration into the system, whilst being secure.

[Jason_R0]

-{ Quote: "I actually prefer the pop up forms from v1.1. I'm hoping jason can add an option to be able to choose between them." }-

Did you prefer the way the information was displayed or the actual look of it? The "look" (colors, layout, etc) can be changed by the end user (since skinning is supported, it doesn't check for user scripts yet), but I will be including 2 built in alert styles which can be chosen. The one I am using at the moment will be one of them simply because a few people seem to like the old simple windows look, though it probably won't be the default look.

The actual showing of the information (in list form) cannot be changed back to the old style. The biggest reason for this is space considerations, and long items. However there are some visual improvements coming to the list display, so it won't look as bland as it does at the moment where the real info is shown.

The old alert failed to display all the relevant information in some cases due to extremely long process names,commandlines,registry values/keys, etc. Since GSS v1.2, I upgraded the internals so it could handle the longest items possible and since v1.300 it can now visually show the longest items possible. Something other products are unable to do (yet).

[farmerlee]

-{ Quote: "Did you prefer the way the information was displayed or the actual look of it? The "look" (colors, layout, etc) can be changed by the end user (since skinning is supported, it doesn't check for user scripts yet), but I will be including 2 built in alert styles which can be chosen. The one I am using at the moment will be one of them simply because a few people seem to like the old simple windows look, though it probably won't be the default look.

The actual showing of the information (in list form) cannot be changed back to the old style. The biggest reason for this is space considerations, and long items. However there are some visual improvements coming to the list display, so it won't look as bland as it does at the moment where the real info is shown.

The old alert failed to display all the relevant information in some cases due to extremely long process names,commandlines,registry values/keys, etc. Since GSS v1.2, I upgraded the internals so it could handle the longest items possible and since v1.300 it can now visually show the longest items possible. Something other products are unable to do (yet)." }-
I just liked the ease of selecting the actions in v1.1. Call me lazy but it was just the simple, single click of the mouse and the simple windows look which i preferred.

[MsFluffyMuffin]

I really can't agree more with farmerlee, it's so easy and quick to select actions with v1.1 , I wish this style or method could be kept, through its equally important to have clear and un-obstructed information.

When I tried ProSecurity and Online Armor both were messy for me, through out of the two I didn't like Online Armor, the multi-coloured alerts made it hard to see the information, let alone read it, unfortunately I suffer with dyslexia and dyspraxia , so having a clear alert box with clear text is essential, the one thing I have always thought you (Jason) have done really great at compared to your competitor's is the clarity of your GUI's , hopefully you can keep up this great work, I appreciate it lots and lots :thumb:

Fluffy

[SystemJunkie]

-{ Quote: "100% ms free code for the alert now. The whole code to display controls have changed.
The alerts are now made from the same "meat" as GhostShell. So yes they are skinable. However I also agree that those alerts need some work and i'm pretty sure that once RD is completely back it'll become one of the priority." }-
Ghostshell style is cool.

-{ Quote: "but I will be including 2 built in alert styles which can be chosen. The one I am using at the moment will be one of them simply because a few people seem to like the old simple windows look, though it probably won't be the default look." }-
Very good idea to give the option choosing between different alert styles.

[Jason_R0]

I think I will open up the possibility to use buttons or a list for the actual "what to do" part of the alert (which is the bottom section). The information list can't be changed, but the bottom one is simple enough to allow both, though obviously not at the same time. So expect the 4 buttons back for the next release... ;)

[f3x]

Not having to double click to chose an action is a great idea.

However the action list have alot of potential for controling how to deal with the program, so it could be nice to witch between basic and advanced actions.

The way information is displayed is fine.
Is it possible to add images in that text box ?
An icon of the running application is alwais apreciated.
I also liked how old appdefend have different icons for the actions the application is trying to make. Save some reading.

[Jason_R0]

http://www.ghostsecurity.com/images/alpha_adnewprot.jpg

An image from the next release, some new protection has been added. :)

[Jason_R0]

Just one more showing the ghosts back on the new GUI code, I slightly updated them a bit to blend better and gave them a smile instead of the "no face" as it was before. I think it reflects their joy being on some non Microsoft GUI code. ;)

[MsFluffyMuffin]

Wow......really got to love those ghosts Jason ;D ;D ;D , I know I do ;D

They really make the screen look friendly'er and the system safe from malware, I'm sure their presence alone will scare away all the nasty bugs....hehe....good work as always, I can't wait to try the next version out, thanks :thumb:

Fluffy

[cbuddha42]

Don't mean to hound you about it, but how did the 64 bit compile go?

[Jason_R0]

-{ Quote: "Don't mean to hound you about it, but how did the 64 bit compile go?" }-

Not too good, it will take a few hours to get that build up to scratch due to the amount of changes that have occurred. And I will need to find what Microsoft have changed for some of the newer things I have added to the kernel as they no longer exist going from the errors in the 64bit build I saw. It shouldn't be too bad though, and I'll look into this after the next 32bit release. The network side of the x64 build interests me because I don't think there are any real 64bit app firewalls (are you aware of any?).

[cbuddha42]

No, all the firewalls I know of that run on 64bit are still actually 32bit applications. Some 32bit firewalls won't even run on xp 64 without an ungodly number of errors. I'm not certain about what security holes this opens up, and it seems less of an issue than say Anti-Virus software being 32bit, but I'm sure the extra 32 bits does open new network holes and running a 32bit firewall is obviously a sub-optimal solution.

[Paranoid2000]

-{ Quote: "No, all the firewalls I know of that run on 64bit are still actually 32bit applications....I'm sure the extra 32 bits does open new network holes and running a 32bit firewall is obviously a sub-optimal solution." }-As long as the driver (the part that does the actual work) is 64-bit, it should make little difference if the GUI and other non-critical parts still use 32-bit code.

For firewalls though, Vista complicates things further since it has a completely new network subsystem (which among other things requires firewalls to offer IPv6 support).

[f3x]

Is it me or I remember something about a MutexDefend in the ressources of the first appdefend releases ?

Now that alerts make me wonder ...
How can you associate a Mutex with a worm ?
Is this the start of a signature based protection in GSS ?
Or it's only a general thecnique that is associated with that partcular worm ?

[MsFluffyMuffin]

@ f3x: Your not wrong, I also remember MutexDefend as well, I'm sure Jason did mention it in some thread or other here, I forgot when.....oh wait I found it, here is the thread, I ask Jason about MD in post #6 , and Jason explains it in post #7 ;D ;D ;D

http://www.wilderssecurity.com/showthread.php?t=103938&highlight=mutexdefend

I hope this helps f3x :thumb:

Fluffy

[f3x]

Thank you !

Searching for the word Mutex in GS Forum only resulted in post made by me about it so it was only a self-coherent reality .. which leave me thinking a bit.

Now i just learned that the search function if for whole word only ... great


Not everyday we see a girl playing with resource editor, security software and image modeling, glad i know ya (ok now this is coming of topic)

[MsFluffyMuffin]

Wow.....thanks for the compliment f3x ;D , I guess a part of it is I'm a control freak in a way, I peek and poke around, so naturally when I install something on my system, I learn all I can about it, so a resource editor is a good friend indeed to me, through sometimes I cant help modding a resource or two.....hehe, hmmm I wonder what happened to that ghostwall banner I made, I think I have lost it :'(

I wonder if Jason would mind me modding AD & RD banners...hehe....I have thought about it, I have a nice idea for one, through my dyspraxia makes it hard for me to get ideas out of my head on to paper or a screen :( , maybe I will give it a whirl ;D

Hugs to f3x (and Jason)

Fluffy

PS. Maybe we all should create some nice art work for Jason, I mean banners and wallpaper kinda thing, just a thought ;D

[Jason_R0]

-{ Quote: "Is it me or I remember something about a MutexDefend in the ressources of the first appdefend releases ?

Now that alerts make me wonder ...
How can you associate a Mutex with a worm ?
Is this the start of a signature based protection in GSS ?
Or it's only a general thecnique that is associated with that partcular worm ?" }-

Yes it was going to be a separate type product at the beginning, but it kind of fits into AppDefend nicely in a way. It isn't heuristic based yet, so it's only helpful for spotting known viruses, worms, etc. At the moment anyone can edit the file which has the list of known bad mutex's which you can grab off the internet or from known viruses, etc.

[topmoxie]

Is this safe to install or should we wait?

[Eldar]

-{ Quote: "Is this safe to install or should we wait?" }-Didn't experience problems with it, but as always it's best to take your precautions prior to installing this alpha/beta. :)
Better safe then sorry. ;)

[SystemJunkie]

-{ Quote: "Wow......really got to love those ghosts Jason " }-

Yes they are really a significant part of GSS.

If possible please give user a opportunity for next alpha/beta to disable regdefend.

[buffet]

Mine is Dell E510, running winxp2 and win2k3 ent.
Anyway, gss1.300alpha still has reboot-cycle problem anyway.
- at first with a fresh winxp2 new-install came with no security software and hardware drivers installed, it seems rebooting okie. After tried íntalling comodo firewall lastest ver, failed right after at first firewall startup, a reboot and gss1.300 went on problem.
- at first with a fresh win2k3 íntall, gss1.300 went into problem after reboot.

Uninstall is a must. Pity for my box.

Any advice.

[SystemJunkie]

-{ Quote: "After tried installing comodo firewall latest version, failed right after at first firewall startup, a reboot and gss1.300 went on problem." }-
I noticed lots of BSODs, latest Comodo beta and latest GSS alpha cause big problems lead to heavy system crashes.

c21 stop error. Really heavy bsods the previous versions seemed to be more stable or not that deep anchored into kernel.

Sys: Amd X2 4800, Win XP Pro SP2.

[Pedro]

I understand your hunger for trying programs :) , it affects most of us too, but i think i should say anyway: latest Comodo and GSS are to be considered incompatible for life.
Unless Comodo in the final version gives you the choice to use only the firewall.

Choose one or the other imo, specially when in beta/alpha stage. I don't think the developers will care for these incompatibilities, their priority is where it should be, finishing the program!

[SystemJunkie]

-{ Quote: "I understand your hunger for trying programs , it affects most of us too, but i think i should say anyway: latest Comodo and GSS are to be considered incompatible for life.
Unless Comodo in the final version gives you the choice to use only the firewall.

Choose one or the other imo, specially when in beta/alpha stage. I don't think the developers will care for these incompatibilities, their priority is where it should be, finishing the program!" }-

It´s the first time I hear this now, long time both tools worked fine together.
Probably they won´t care but if they want to rise their download stats they will care about.

[Pedro]

Not Comodo 2.4 mind you. Now Comodo is a HIPS too.
Are you one of those that run 2 HIPS and rant about problems? I don't think you are, and i think you get my point.
-{ Quote: "Probably they won´t care but if they want to rise their download stats they will care about." }-
They are Alpha/Beta programs..
You have issues from not booting, to not working properly by itself, missing important features, etc. Then you have a compatibility problem with some program. Where's the priority?

[Jason_R0]

I have updated my first post with the first "update" for v1.300

[MsFluffyMuffin]

Thanks Jason, it works really great, did I mention thanks for putting the ghosts back :thumb: , they are a really wonderful part of GSS, I guess I also mean they add a really nice and wonderful feeling to having and using GSS ;D

I'm still getting a partial initialization of Comodo firewall 2.4.18.184 , I'm not sure why a part of it works, while the rest refuse to work, through I have a slight clue, I dont know if this helps any Jason, but I have noticed sometimes that comodo tries to launch itself twice, once at boot up, then after the desktop is loaded suddenly I have the firewall trying to load itself up with a second copy, I hope this makes sense :-\ , the second firewall fails to load, then its systray icon and its processes disappear, so I only have the first one from boot loaded and in the systray, kind of confused to why the second launch, maybe AD is blocking/delaying some the first launch of the firewall and its processes or drivers during boot, then they get unstuck and launch a little bit later, I'm un-sure how to figure this out, maybe bootvis :-\

Hugs,
Fluffy

[Mark Klomp]

Just installed the NEW 1.3. Well, it looks great, after restarting the popups came with the ghosts which looked very neat, and also the fact you can drag and drop the ghosts individually. But I have to mention a few problems I experienced. Upon startup I had to make a decision for a popup, and suddenly it disappeared, and it fired another popup. So I weren't able to make a decision for one popup. Then at startup Microsoft Windows acted really weird and said that Windows was restored of a serious error, and let me send several error reports while fireing up a few IE windows which loaded sites of MS error solving and said the errors where maybe caused by some drivers (intel application accelerator, sonic recordnow), asking I had to update them. Then I have to say that my taskbar is made smaller, the standard size as when you first installed XP.

How can I restore of this situation?
Jason_R0 can you tell me what has happened, and if it's bad or not?
Better wait for a final version from now on.

Ps: how can I import my old rules in this new one? I had backed up the ''ADSecure.gsa'' and ''rdstandard.gsr'' because these files include the rules, right? Well, before those were supposed to be in the program files folder (because previous version was user-mode) and now the rules belong in the system32 folder (because of kernel-mode) with the names ''gss_ad.rul'' and ''gss_rd.rul''.
Now, the problem is, I can't replace those files with the old rules I had backed up. Firstly because when you do it's in use, and secondly if you could replace, GSS can't read the files if you rename them from ''ADSecure.gsa'' and ''rdstandard.gsr'' to ''gss_ad.rul'' and ''gss_rd.rul''. Anybody that can tell me how to import the rules correctly?

[Brother Esau]

@Jason......I have installed you're Alpha 3.0 but....Reg Deffend is completely disabled in GUI with out the option to enable it even when adding my registration info which it shows as one commercial licence but still no go even after reboot! But when I open programs like CPUZ and CoreTemp APP DEFFEND & REG DEFFEND asks permission??? So obviously its working but I am unable to access any of the features or enable it for that matter, any suggestions anyone?
I like the new layout and the GUI during Windows Boot to Desktop is very cool and I do see the floating ghosts but still no Reg Deffend!>:(

[boonie]

See Post #1 (Important Notes):
"-There is no new gss.exe (front end), so it will still say it is v1.200 alpha in that, you can edit AppDefend rules, but RegDefend cannot be accessed through gss.exe yet"

[SystemJunkie]

-{ Quote: "eg Deffend is completely disabled in GUI with out the option to enable it even when adding my registration info which it shows as one commercial licence but still no go even after reboot! But when I open programs like CPUZ and CoreTemp APP DEFFEND & REG DEFFEND asks permission So obviously its working but I am unable to access any of the features or enable it for that matter, any suggestions anyone?
I like the new layout and the GUI during Windows Boot to Desktop is very cool and I do see the floating ghosts but still no Reg Deffend!" }-

-{ Quote: "RegDefend cannot be accessed through gss.exe yet"" }-

Too bad, I also miss the Firewall features, no recent alerts if system wants to phone out. Hm... that was better in v.1.2 a.

[Jason_R0]

-{ Quote: "Ps: how can I import my old rules in this new one? I had backed up the ''ADSecure.gsa'' and ''rdstandard.gsr'' because these files include the rules, right? Well, before those were supposed to be in the program files folder (because previous version was user-mode) and now the rules belong in the system32 folder (because of kernel-mode) with the names ''gss_ad.rul'' and ''gss_rd.rul''.
Now, the problem is, I can't replace those files with the old rules I had backed up. Firstly because when you do it's in use, and secondly if you could replace, GSS can't read the files if you rename them from ''ADSecure.gsa'' and ''rdstandard.gsr'' to ''gss_ad.rul'' and ''gss_rd.rul''. Anybody that can tell me how to import the rules correctly?" }-

You should never rely on the rule files being the same format for these alpha versions as they are changed from time to time. Copying old rules to the same filenames will just mean AppDefend/RegDefend ignore the ones you copied if the format isn't the one it wants.

[buffet]

My Dell E510 box still has problem of reboot-loop with any try with versions after 1.100Beta anyway! Hope Jason fix it soon so we can try releases and plan to buy licenses.
Thanks.

ps: please take a some time for CryptoSuite which does not have font-style selections anyway and does not completely handle unicode (chat and nick) - some words are properly displayed, others are not; I mean with language with accents.

Thanks.

[SystemJunkie]

The latest versions show more disadvantages then advantages.
I miss the option to disable regdefend, regdefend does not save rules,
I miss the recent alert list.. this is more regdefend then appdefend.

[MsFluffyMuffin]

Yes I agree with what you are saying, through I'm sure these "disadvantages" are just a temporary side effect until Jason can hook up the new GUI code, I hope this can be soon so we can all start having some fun toying with it ;D

I really hope that at some point Jason could allow us to switch back to the old style of alerts, I miss the four button Allow/Block way of doing things, I find myself getting a bit muddled with selecting the right option to allow or block. I'm not trying to complain or anything, but the new Allow/Block two button method kind-a-sucks, hopefully no one will take that the wrong way, I just have got used to the old way and the new way is hard for me to cope with :(

Is there a way to change the colour of the GUI, I mean skin it with our own colours etc... , just wondering ;D

On a side note, what the hell has Jason done to my system, it shuts down like a rocket since installing the latest GSS....hehe......great, I'm not complaining honest ;D

Hugs,
Fluffy

[MsFluffyMuffin]

@ Jason: Just a quick question about future improvements to AD or GSS, will you be adding some kind of folder/file protection, I mean something along the lines of DriveSentry or similar ? ..I think this would be a real asset and help GSS to catch up feature wise to its main competitors like ProSecurity :)

Hugs,
Fluffy

[f3x]

Hi fluffy.
It's an understandable feature request.

However i really don't like the idea of write protection.
I do a lot of download and the last thing i'd want is to calculate a md5 hash each bite of file that are written. So hooking a kernel function is not really interesting for me. File protection are good for pooling. Like at each 2 second, verify that the protected file haven't changed and if it have changed and user don't want it.. restore backup. Now one of the selling point of GSS is no CPU waist in continuous pooling :S

However if there's an elegant way to do it .. why not.

--------------

Meanwhile .. i'd like very much to advance features on event recognition.
For example try to intercept mouse event window messages and be able to make rules like:

"allow explorer to execute a program only if the execution started with a mouse click on window X (desktop)"

or add precision to the alert like

"This event was triggered by a user interaction, if you trust the program it should be safe. Click [here] to highlight the window(button) that triggered the event"

"This event is part of the automatic execution of the program, it is very likely that the autorisation will be ask each time you start the program unless you choose to alwais allow/deny"

-----

that is the kind of thing that make very nice R&D work and feature no one have yet ;) And .. well you already have some sort of window message protection. So it may be only a matter of going up in the stack and see if you find yourself.

[MsFluffyMuffin]

Well f3x, my idea was more along the lines of preventing malware writing to particular folders/files, say for example protecting the Windows, System 32 or startup folders from being written to, only certain processes would be allowed to, through this idea could be expanded on, like say only allowing Firefox to write to its profile folder and of course a folder for downloading files to, that way any malware would be sand boxed in and couldn't inject a file into a sensitive folder like System32 or a startup folder, I hope this makes sense ;)

How about a DriveDefend Jason.....hehe....so funny it could work ;D

I like your idea f3x, sounds like it could work in increasing overall security, I think even through there's not many malware simulating mouse clicks, a way to help prevent them from succeeding would be most welcome, I remember Ad-Aware had a problem like this, where it was hijacked by a simulated mouse click, maybe by only allowing a certain click from a certain process or object could have prevented this....I think ;D

Hugs,
Fluffy

[f3x]

Hi fluffy it does make sens.

I just realize that window already had such a write file protection for user right (admin,guess,etc) and that it could be a nice entry point for Jason to protect file and folder.

Except it'll be based on executable rather than running user account.
This being said, fluffy you could probably just run the application with a special user account "untrusted" and acheive the same effect with some tweaking.

[MsFluffyMuffin]

Thanks f3x, well I just thought that it would be easier to use and to import/export then with policies, I guess I was just thinking of the noobs out there.

We have RegDefend for the registry, we don't need it really, we could just set policies, I do have policies set to block or limit changes, but RegDefend is so much easier to use and deal with, not that I'm being lazy....haha.....I just feel that something similar for the drive side of things would give us the same ease in which RegDefend has given us all this time ;D

Have you had any more thoughts on your "event recognition" idea ? ...I'm sure Jason would be really interested in this for a future AppDefend, personally I like your idea f3x and I welcome a bigger debate and brainstorming on this idea :thumb:

Hugs,
Fluffy

[MsFluffyMuffin]

Hmmm....after some testing I still can't figure out why Comodo firewall 2.4 and 3.0 wont initialize when GSS 1.300 Alpha is installed, Ghostwall 1.150 works perfectly, I guess I will keep going, maybe I will figure it out at some point :-\

Oh, another thing, why does my system boot up and shutdown faster with GSS 1.300 Alpha ? ...but GSS 1.110 its much slower, I don't know, such craziness my head hurts ;D

Hugs,
Fluffy

PS. I have been loving Ghostwall lately, I have missed its simplicity and ease of use, thanks Jason for another wonderful creation :-*

[topmoxie]

Have you had any major problems with it, Ive been considering installing it

[MsFluffyMuffin]

@ topmoxie: GSS 1.300 Alpha works stable and very well for me, the only real problem's so far are RegDefend is not fully working right now, you will get alerts but it won't remember your allow/block clicks.

The other problem I can see is currently some software don't work properly with GSS 1.300 Alpha, for me its stuff like Comodo firewall, through things like BoClean and NOD32 will work perfectly, I guess its your choice, as for Ghostwall, it just works no matter what GSS version :thumb:

I'm trying the latest Comodo 3.0 , it works great so far with GSS 1.110 , but the 1.300 Alpha broke it for some reason, I still haven't been able to work out the reason why 1.300 Alpha breaks it, I'm off to find some way to log the boot process in more detail :wacko:

Hugs,
Fluffy

[Jason_R0]

I'm going to be releasing two builds with the next release to try and iron out issues with other firewall apps like Comodo. I'm working on the next version of GSS.exe with the new GUI code at the moment so it's going to be a few more days at least before that next build as there are over 800 changes which need to be worked on.

RegDefend rule saving should also be in there.

[Jason_R0]

-{ Quote: "I'm trying the latest Comodo 3.0 , it works great so far with GSS 1.110 , but the 1.300 Alpha broke it for some reason, I still haven't been able to work out the reason why 1.300 Alpha breaks it, I'm off to find some way to log the boot process in more detail :wacko: " }-

That's because the 1.110 version used a rather hacky outbound network approach (which worked on 32bit and 64bit OS's which is why I chose that method). I decided to implement a proper TDI firewall driver after that which is what is in 1.200 onwards. I suspect there are TDI driver conflicts, most likely my fault which will need to be worked on.

[MsFluffyMuffin]

Wow......really can't wait to test those new builds Jason, great work as always :thumb: , hmmm.....800 changes, ouch, I think we are all working you to hard ;D , I really hope you don't wear yourself out :o

I hope that with the new GUI code that at some point the interface could be talked about, I for one would like to be able to change colours to more suitable ones for myself, plus it would be nice to be able to change the alerts to use the old style (four button's) , but I'm sure there's many who also like the new style better, I guess we all could do with having some kind of choice ;D

Thanks for explaining your "hacky outbound network approach" Jason.....hehe....I'm sure no developer is free or innocent from using hack's once in a while, I'm sure you know whats wrong and will fix things up in time.

I guess it was no biggy really, I was just trying to figure out why the newer GSS versions and Comodo firewall weren't happy together, strange thing was that going back to Ghostwall was a happy and fruitful experience, I kinda enjoyed it really, just set-and-forget ;D

Hugs,
Fluffy

[SystemJunkie]

-{ Quote: "GSS 1.300 Alpha works stable and very well for me, the only real problem's so far are RegDefend is not fully working right now, you will get alerts but it won't remember your allow/block clicks." }-
This is one of the biggest problems of this alpha.

-{ Quote: "that next build as there are over 800 changes which need to be worked on.
RegDefend rule saving should also be in there." }-
I´m looking forward to this version.

[buffet]

These 1.200-1.300 alpha releases do not work on DELL boxes any (not be able to install without infinitively BSOD cycling. It installs pretty well on Laptop Thinkpad T61, except for RegDefend (always-on) causing some troubles for no learning-mode and lock windows reboot after some software installations that put the whole windows box into trouble!
Besides, after installed AppDefend Suite alpha versions, even it was uninstalled : ZoneAlarm Pro 7x, Comodo PF 2.x can not install anyway with problem BSOD at reboot-after-fresh-install.
Comodo failed at end of install progress with error msg: "can not create shortcut...." - then, everytime comodo install starts, error msg "an old version installed that need to be uninstall first..." and boom.

Jason would let users to have optional to disable completely RegDefend when users need to install some softwares; otherwises, Jason needs to put in a secure learning mode ?

Any ideas! all GSS users are looking forward to next stable and most secure releases of GSS.

[Jason_R0]

-{ Quote: "These 1.200-1.300 alpha releases do not work on DELL boxes any (not be able to install without infinitively BSOD cycling. It installs pretty well on Laptop Thinkpad T61, except for RegDefend (always-on) causing some troubles for no learning-mode and lock windows reboot after some software installations that put the whole windows box into trouble!
Besides, after installed AppDefend Suite alpha versions, even it was uninstalled : ZoneAlarm Pro 7x, Comodo PF 2.x can not install anyway with problem BSOD at reboot-after-fresh-install.
Comodo failed at end of install progress with error msg: "can not create shortcut...." - then, everytime comodo install starts, error msg "an old version installed that need to be uninstall first..." and boom.

Jason would let users to have optional to disable completely RegDefend when users need to install some softwares; otherwises, Jason needs to put in a secure learning mode ?

Any ideas! all GSS users are looking forward to next stable and most secure releases of GSS." }-

Are you saying even when GSS was uninstalled you couldn't properly install Comodo PF? The reboot problem would have to do with some other hooking/firewall software I would assume, maybe something that a lot of DELL boxes come with? :)

There will probably be a right click from system tray option to disable RD/AD, and maybe even a "disable for 1 minute" option too would be handy for installs.

[buffet]

-{ Quote: "Are you saying even when GSS was uninstalled you couldn't properly install Comodo PF? The reboot problem would have to do with some other hooking/firewall software I would assume, maybe something that a lot of DELL boxes come with? :)

There will probably be a right click from system tray option to disable RD/AD, and maybe even a "disable for 1 minute" option too would be handy for installs." }-

You seems correct. How to fix ?

I have redone again with fresh re-install of windows 2003 on the laptop ThinkPad T61 (6465CTO model), and saw that at the state of no software installed yet, but already video driver installed (Intel GM965 Accellerator X3100 video chipset):

A fresh install of ZoneAlarmPro 7.0.xxx (the lastest just downloaded from ZA site) came with a BSOD cycles at the first reboot of ZAP install progress request.
Must logged into Safe mode to remove ZAP
Tried install Comodo FW 2.4.248 (the lastest version from comodo site) came with the same failure message install; then, no more this firewall can start to install (with error msg "an old version exists, please remove...." Wow!)


For DELL boxes we have (E510 and others), the later versions of GSS1.100beta can install without BSOD cycles until removed GSS in safemode.

[smith2006]

-{ Quote: "
Added the ghosts and logo back. Some small changes to ghosts.

" }-

The wording in the logo "This Computer Protected By Ghost Security" sounds a bit funny. ::)

It will be better using either "This Computer Is Protected By Ghost Security" or "Protected By Ghost Security".

[Jason_R0]

-{ Quote: "The wording in the logo "This Computer Protected By Ghost Security" sounds a bit funny. ::)

It will be better using either "This Computer Is Protected By Ghost Security" or "Protected By Ghost Security"." }-

The image hasn't been changed yet since the first alpha, spelling and grammar errors seem to last forever. :)

[topmoxie]

It would be helpfull if you put up the date when you place a new version of the program on the forum

[Jason_R0]

New version here in case you guys missed it.

http://www.wilderssecurity.com/showthread.php?t=189957

And topmoxie, the date usually will be shown in the post, or at least the edit time. I'll try and make a new thread for each build to ensure the post date is correct from here on out.