AppGuard 1.4.7.0 is out

[demoneye]

hi

you can d/l it from here
http://download.cnet.com/AppGuard/3000-2239_4-10912598.html?part=dl-10046293&subj=dl&tag=button

what new
3.1 AppGuard Release 1.4 (March 2010)
The following sections summarize the new features incorporated in the 1.4 version of
AppGuard.
3.1.1 Drive-by Download Protection for Script Files
AppGuard now prevents script files (*.bat, *.cmd, *.com) from being launched from
user space.
3.1.2 Removable Media Launch Protection for Script Files
AppGuard now prevents script files (*.bat, *.cmd, *.com) from being launched from
USB removable memory devices.
3.1.3 Additional Guarded Applications
The following applications are now guarded by AppGuard:
a. Acrobat Reader (versions 7, 8 and 9).
b. Opera
c. Outlook Express
3.1.4 Defect Fixes
The following defects were fixed in this release:
1. When making multiple changes on the settings page that includes the
suspension timeout value, all changes are now saved.
2. User space drive-by download protection is now effective after a fast user
switch.
3. Suspension of Drive-by Download protection now suspends extended userspace
protection (i.e. launches from non-system volumes are now allowed
when drive-by download protection is suspended).
4. Intermittent problem where Exception folders were not recognized has been
fixed.

[Brocke]

thank you for the info.

wish there was auto updating.

[demoneye]

i found *.msi files can run under drive by download protection ...that NOT good :(
also they didn't fix the none uni-code dir that under ag protection , meaning NONE English fonts dir CANT be protected by AG :(
no password protection also :(
no shortcut key to disable/enable all protection (lile command "suspend all protection") :(
No import/export for selected protected dirs/drives define :(

[HAN]

Password protection to keep unauthorized users from tampering with settings??

[demoneye]

-{ Quote: "Password protection to keep unauthorized users from tampering with settings??" }-

correct

[jmonge]

no password protection???

[jmonge]

does it look same?can some buddy take a picture?

[AvinashR]

After installing over the previous version my system got 3 BSoD, one after one...:( I don't know whether it is compatible with Zemana Antilogger or what? I have Norton 360 and MBAM 1.44. Recently i added Zemana and i think Zemana is not compatible with it...

Anyone else faced this problem?

[jmonge]

to confirm your situation i too have same problem with both:) they hate each other;D

[AvinashR]

-{ Quote: "to confirm your situation i too have same problem with both:) they hate each other;D" }-

Okay so i am not alone in this case....I thought some virus got into my system which is causing this problem and immediately i scanned my system with Norton, Hitman Pro and MBAM. :P

[jmonge]

cool;D :thumb:

[SIR****TMG]

I to have the same problem using both.

[1000db]

Looks the same seems just to be a maintenance release.

[demoneye]

zemana + AG dont get along

u can check here for more info ;)

http://www.zemana.com/AntiloggerCompatibility.aspx

[AvinashR]

-{ Quote: "zemana + AG dont get along" }-

Thanks for the confirmation to all my dear brothers...

They have updated their Softpedia OEM setup from v 1.9.2.185 to 1.9.2.188.

But still their main homepage is showing something else....

[AvinashR]

-{ Quote: "zemana + AG dont get along

u can check here for more info ;)

http://www.zemana.com/AntiloggerCompatibility.aspx" }-

I guess earlier they have not mentioned about Blue Ridge Network...But now they have updated the same..

Thanks for the concrete proof.

[demoneye]

-{ Quote: "Thanks for the confirmation to all my dear brothers...

They have updated their Softpedia OEM setup from v 1.9.2.185 to 1.9.2.188.

But still their main homepage is showing something else...." }-

LOL that funny , i just also check it , seems zemana team doesn't knows what their left and right hand does :D

[AvinashR]

-{ Quote: "LOL that funny , i just also check it , seems zemana team doesn't knows what their left and right hand does :D" }-

I guess they have messed up with Softpedia OEM setup....like we all messed up with them:P

[Eirik]

Hi All,

I wanted the new software to be posted at CNET before posting announcement. Looks like Demon Eye beat me to it.

Yes, this release is rather incremental. We cut off a development sprint to fix some bugs that were generating considerably more trouble ticket volume than usual. Among the features in that sprint was to be password protected settings. That and others will be in release 1.5, which has not been scheduled yet.

Regarding Zemana, we've been aware of problems as reported by that vendor. However, we've not lab tested it ourselves.

We do post compatibility issues on the support page:

Known Conflicts with 3rd Party Software (http://www.blueridgenetworks.com/support/appguard.php) (bottom of page)

“Zone Alarm Pro”, “Zemana”, and conflicting reports of problems with “SuperAntiSpyware Pro”.


Please let us know of other conflicts you've observed.

Cheers,

Eirik

[AvinashR]

-{ Quote: "Hi All,

I wanted the new software to be posted at CNET before posting announcement. Looks like Demon Eye beat me to it.

Yes, this release is rather incremental. We cut off a development sprint to fix some bugs that were generating considerably more trouble ticket volume than usual. Among the features in that sprint was to be password protected settings. That and others will be in release 1.5, which has not been scheduled yet.

Regarding Zemana, we've been aware of problems as reported by that vendor. However, we've not lab tested it ourselves.

We do post compatibility issues on the support page:

Known Conflicts with 3rd Party Software (http://www.blueridgenetworks.com/support/appguard.php) (bottom of page)

“Zone Alarm Pro”, “Zemana”, and conflicting reports of problems with “SuperAntiSpyware Pro”.


Please let us know of other conflicts you've observed.

Cheers,

Eirik" }-

Hi Eirik,

Are you going to troubleshoot the compatibility issue of AppGuard with Zemana?

[Eirik]

-{ Quote: "Hi Eirik,

Are you going to troubleshoot the compatibility issue of AppGuard with Zemana?" }-

Unlikely. We generally don't hand-tweak (modify our binary to avoid a specifc conflict with a specific vendor's product) our software to side-step conflicts with other security software. Our Chief Software Architect is quite religious, if not fanatical, about adhering to the various guidelines from Microsoft that are intended to minimize conflicts. Windows Vista/7 has helped with their implementation of something called "altitudes", intended to minimize conflicts (not perfect but a big improvement over XP).

I wouldn't rule this out. We would probably do so for SuperAntiSpyware Pro or Zone Alarm Pro before we do so for Zemana. And if there were a problem with something with giant market share, we would attend to that before them. We wish to avoid what some have said brought down a handful of small security vendors: over-extending themselves in trying to achieve compatibility. I'm sure this disappoints folks.

That said, I think we should post a few tips for end-users that can help them overcome some conflicts, such as timing-related conflcits. We've had some success with customers in this regard. I'll discuss this with engineering and customer support.

Cheers,

Eirik

[demoneye]

so know we have to wait unknown time till all basic issues i post will be fix ? ???

[Cutting_Edgetech]

Has anyone had any issues running the new version with Online Armor?

[Greg S]

-{ Quote: "


Please let us know of other conflicts you've observed.

Cheers,

Eirik" }-
Has this issue been fixed (Win 7), right click tray icon and disable all protection. Go to USB drive to launch something with AppGuard still blocking it even though all protection has been disabled. Go back to tray icon enable all protection then disable all protection a second time. Go back to USB drive app will now launch. Go back to tray icon, enable all protection. Go back to USB drive and run whatever you want because AppGuard will allow it to do so even though protection as been re-enabled.

[demoneye]

erik

maybe this clear the fonts problem (none English ones). tested on AG 1.4.7 (also exist on 1.3.3) ,AG cant protect such dirs :(

[demoneye]

i notice a slow icon loading after system restart ...
anyone else feel this?

10x

[AvinashR]

-{ Quote: "i notice a slow icon loading after system restart ...
anyone else feel this?

10x" }-

Yes i also felt the same....After installing this updated setup, my Sandboxie do not start as fast as it was doing earlier after the system startup....

[demoneye]

i hope Erik see all of this bugs and stuff need to be fix asap ...AG hold a big potential , hope they wont blow it :)

[AvinashR]

-{ Quote: "i hope Erik see all of this bugs and stuff need to be fix asap ...AG hold a big potential , hope they wont blow it :)" }-

Hey are you using EAZ-FIX ? I saw that you are using some cure for it? I won't mind if you share a bit more....;D :P

IMHO, Sharing is Caring !! Isn't

[Kees1958]

Congrats with the homeland security nomination :thumb:

[Eirik]

-{ Quote: "Has this issue been fixed (Win 7), right click tray icon and disable all protection. Go to USB drive to launch something with AppGuard still blocking it even though all protection has been disabled. Go back to tray icon enable all protection then disable all protection a second time. Go back to USB drive app will now launch. Go back to tray icon, enable all protection. Go back to USB drive and run whatever you want because AppGuard will allow it to do so even though protection as been re-enabled." }-

Hi Greg,

I'm afraid I'm in between meetings...long day.

When I saw your post, I forwarded it to the engineering Director. With version 1.4, you should not encounter the problem you describe.

Cheers,

Eirik

[Eirik]

-{ Quote: "erik

maybe this clear the fonts problem (none English ones). tested on AG 1.4.7 (also exist on 1.3.3) ,AG cant protect such dirs :(" }-

Thanks for the screenshot. That looks an awful lot like what one of the engineers should me (hard copy) in a hallway conversation...in between meetings. Its nice to see they're replicating your observations.

Correcting this issue was too involved for version 1.4. With the trouble tickets were getting, we decided to focus on bug fixes and only new capabilities that were far enough along to include that wouldn't push out the release date for 1.4. We will address this. However, that may not include "non-printable" characters. I'm not precisely certain as to what that means (sorry).

Cheers,

Eirik

[Eirik]

-{ Quote: "Yes i also felt the same....After installing this updated setup, my Sandboxie do not start as fast as it was doing earlier after the system startup...." }-

I'll forward this to engineering. I imagine they would appreciate more details regarding your observations to better replicate the issue.

Thanks,

Eirik

[Eirik]

-{ Quote: "Congrats with the homeland security nomination :thumb:" }-

Thank you.

Eirik

PS The nomination became a win.

[Greg S]

-{ Quote: "Hi Greg,

I'm afraid I'm in between meetings...long day.

When I saw your post, I forwarded it to the engineering Director. With version 1.4, you should not encounter the problem you describe.

Cheers,

Eirik" }-
Thanks Eirik, Congrats on the Win!

[demoneye]

-{ Quote: "Hey are you using EAZ-FIX ? I saw that you are using some cure for it? I won't mind if you share a bit more....;D :P

IMHO, Sharing is Caring !! Isn't" }-

i dont understand what u mean by "cure for it" ???

[demoneye]

-{ Quote: "Thanks for the screenshot. That looks an awful lot like what one of the engineers should me (hard copy) in a hallway conversation...in between meetings. Its nice to see they're replicating your observations.

Correcting this issue was too involved for version 1.4. With the trouble tickets were getting, we decided to focus on bug fixes and only new capabilities that were far enough along to include that wouldn't push out the release date for 1.4. We will address this. However, that may not include "non-printable" characters. I'm not precisely certain as to what that means (sorry).

Cheers,

Eirik" }-

"I'm not precisely certain as to what that means (sorry)"
they are none English letters in my case Hebrew , but this issue will append in Spanish, chines , Arabic , french etc letters , AG cant protects Dir using other language than English :(

[Greg S]

-{ Quote: "i dont understand what u mean by "cure for it" ???" }-
demon, not to drift off topic too much but how is the latest EF 9.1 working out for you? I still have not installed it.

[demoneye]

-{ Quote: "demon, not to drift off topic too much but how is the latest EF 9.1 working out for you? I still have not installed it." }-
its all the same , i mean since version even 8.1 i notice no big changes in my case .

i dont think if version 8.1 works fine for you there is any advantages in version 9.X :)

[pegr]

-{ Quote: "i notice a slow icon loading after system restart ...
anyone else feel this?" }-The previous version 1.3.3 exhibited this behaviour on my system, and this is still the case with version 1.4.7.

[demoneye]

-{ Quote: "The previous version 1.3.3 exhibited this behaviour on my system, and this is still the case with version 1.4.7." }-

yes mate , i dont figure till now what "bugs" they been fixing when so many BASIC bugs and odd software behavior is all over this software ...>:(

[Greg S]

-{ Quote: "The previous version 1.3.3 exhibited this behaviour on my system, and this is still the case with version 1.4.7." }-
Which, where and what icon?

[demoneye]

-{ Quote: "Which, where and what icon?" }-

its tray icon , it took it the most time to load when windows finally loaded

[pegr]

-{ Quote: "yes mate , i dont figure till now what "bugs" they been fixing when so many BASIC bugs and odd software behavior is all over this software ...>:(" }-Eirik got the AppGuard engineers to take a look when I first reported the slow loading issue some time ago but they couldn't find the cause. If enough people report this as an issue, maybe Blue Ridge Networks will up the priority and take another look.

I know it's not something experienced by everyone because I've got a friend who I introduced to AppGuard and the slow loading issue doesn't occur on his system.

EDIT: I should add that it's not only at system startup. If I manually exit the GUI via the tray icon and reload it, the icon can take around 20 seconds to reappear in the system tray.

[demoneye]

-{ Quote: "
EDIT: I should add that it's not only at system startup. If I manually exit the GUI via the tray icon and reload it, the icon can take around 20 seconds to reappear in the system tray." }-

here is 10 seconds...kinda slowww;D

[pegr]

Just tested it again myself and it took 12 seconds this time to reload. I remember now that 20 seconds is the additional time for the tray icon to appear on system startup after Windows has finished loading. Either way, it's still slow though.

I do wonder whether the slow loading could be anything to do with the GUI having trouble establishing communication with the service, because I've also noticed that sometimes when changing settings via the GUI, I've had to reload the GUI before the settings have taken effect. :-\

[Brocke]

now is the service loading first then the system tray icon?

because the services can load way before the tray icon?

[Greg S]

My first run of the new version seemed to work as far as the enable/re-enable protection. I shut down, restarted and get this again. Screen capture provided by AppGuard supposedly blocking the private area of My Documents.

216321

216322

[jmonge]

no password protection???

[Brocke]

-{ Quote: "no password protection???" }-

guess not. id wish they would have a optional popup asking if you want to run the EXE so you dont have to disable AG.

Eirik can that be a optional thing?

[jmonge]

i guez we have to wait

[Brocke]

for some reason i cant run AppGuard.

i install it but it says my protection is off and if i right click the system tray icon i dont get the whole menu, and only shows the one tab.

i repair the install and restarted and still same thing.

running windows 7 32bit.

[Greg S]

-{ Quote: "for some reason i cant run AppGuard.

i install it but it says my protection is off and if i right click the system tray icon i dont get the whole menu, and only shows the one tab.

i repair the install and restarted and still same thing.

running windows 7 32bit." }-
Try exiting the GUI from the tray icon and then start it again from the desktop shortcut or start menu link.

[AvinashR]

-{ Quote: "Try exiting the GUI from the tray icon and then start it again from the desktop shortcut or start menu link." }-

Now can anybody explain why KIS 2010 is doing this ?

KIS is quarantining some files of AppGuard...But don't know why?

[Brocke]

i did exit the program. and then started it as run as administrator, then finely asked me for the key i entered it that didnt fix the issue i then exited the program again and start it again.

then again it asked me for my key.

this version needs fixed.

[AvinashR]

-{ Quote: "i did exit the program. and then started it as run as administrator, then finely asked me for the key i entered it that didnt fix the issue i then exited the program again and start it again.

then again it asked me for my key.

this version needs fixed." }-

Yeah, You's right..

In the previous version when i registered the key with Admin rights ..it stay registered with USERS Account, but this time i have to register separately for each user account in my system.

I don't know why it happened?

[demoneye]

seems AG goes down and down and none rely care in Blue Ridge Networks :(

[AvinashR]

-{ Quote: "seems AG goes down and down and none rely care in Blue Ridge Networks :(" }-

I guess they have not tested this product thoroughly, that's why we are facing these issues...Hope they will find out the solution asap

[pegr]

-{ Quote: "now is the service loading first then the system tray icon?

because the services can load way before the tray icon?" }-I think the service is loading before the GUI on Windows startup but I will check this tonight when I get home and report back if that's not the case.

[Eirik]

Hi All,

Last night, I asked engineering's head honcho to investigate. Thank you for bringing these observations to our attention. I expect we'll have follow-up questions. The screenshots and details providing context are quite helpful.

Cheers,

Eirik

[Eirik]

-{ Quote: "for some reason i cant run AppGuard.

i install it but it says my protection is off and if i right click the system tray icon i dont get the whole menu, and only shows the one tab.

i repair the install and restarted and still same thing.

running windows 7 32bit." }-

This appears to be due to the licensing functions. If one uninstalled version 1.3 prior to installing 1.4, the uninstall process would deactivate that instance of the license key. So, when one then installs 1.4, the licensing implementation requires a second restart. Engineering tells me we can eliminate this issue and shall when we implement our licensing vendor's new binaries in the next release.

This issue is not expected to appear when one runs the 1.4 install file without previously uninstalling the 1.3 installation.

Please let us know if you uninstalled 1.3 prior to running the 1.4 install file, and if so, let us know if the second restart fails to resolve the issue.

Cheers,

Eirik

[Eirik]

-{ Quote: "The previous version 1.3.3 exhibited this behaviour on my system, and this is still the case with version 1.4.7." }-

Are you observing this delay after a second restart? One test case in-house showed a delay on the initial install-restart because the anti-virus/spyware software on the host detected a driver change an performed some kind of a quick scan. No delays were observed on this host in successive restarts.

So, question to you all observing the delayed tray icon..., does this occur on a second or third restart as well?

Now, I don't believe this aligns with the observations of Greg S, however. Isn't that correct Greg?

The point of this post is that we're still gathering observations/symptoms so as to replicate and resolve this.

Thanks,

Eirik

[1000db]

I installed the update without uninstalling the previous version and it worked very well. The settings and license info transferred correctly. I like the idea of allowing a single exe to run/install without completely disabling protection. The way it stands is comparable to getting naked just to pee when all you should have to do is unzip. :what:

[Eirik]

-{ Quote: "I installed the update without uninstalling the previous version and it worked very well. The settings and license info transferred correctly. I like the idea of allowing a single exe to run/install without completely disabling protection. The way it stands is comparable to getting naked just to pee when all you should have to do is unzip. :what:" }-

I love that analogy.

We strongly recommend that AppGuard users run the 1.4 install file and let it replace the older version as part of the 1.4 installation.

Don't forget to wash your hands before shaking someone's hand. ;D

Cheers,

Eirik

[AvinashR]

-{ Quote: "This appears to be due to the licensing functions. If one uninstalled version 1.3 prior to installing 1.4, the uninstall process would deactivate that instance of the license key. So, when one then installs 1.4, the licensing implementation requires a second restart. Engineering tells me we can eliminate this issue and shall when we implement our licensing vendor's new binaries in the next release.

This issue is not expected to appear when one runs the 1.4 install file without previously uninstalling the 1.3 installation.

Please let us know if you uninstalled 1.3 prior to running the 1.4 install file, and if so, let us know if the second restart fails to resolve the issue.

Cheers,

Eirik" }-

Yeah i have uninstalled the previous and then re-installed the new exe file...And after that i have to activate license for each and every user account on my system...I have made 3 user account, this mean i have activated the license key three times...I hope this won't affect my license key...

[pegr]

-{ Quote: "Are you observing this delay after a second restart? One test case in-house showed a delay on the initial install-restart because the anti-virus/spyware software on the host detected a driver change an performed some kind of a quick scan. No delays were observed on this host in successive restarts.

So, question to you all observing the delayed tray icon..., does this occur on a second or third restart as well?" }-Yes, the tray icon consistently takes 12 seconds to appear in the tray on successive restarts. Also, disabling my real-time anti-malware makes absolutely no difference to the tray icon loading time. Using Process Explorer I was able to see that the AppGuardGUI.exe process starts almost immediately, but it takes a further 12 seconds for the tray icon to appear.

[Brocke]

-{ Quote: "This appears to be due to the licensing functions. If one uninstalled version 1.3 prior to installing 1.4, the uninstall process would deactivate that instance of the license key. So, when one then installs 1.4, the licensing implementation requires a second restart. Engineering tells me we can eliminate this issue and shall when we implement our licensing vendor's new binaries in the next release.

This issue is not expected to appear when one runs the 1.4 install file without previously uninstalling the 1.3 installation.

Please let us know if you uninstalled 1.3 prior to running the 1.4 install file, and if so, let us know if the second restart fails to resolve the issue.

Cheers,

Eirik" }-

i didnt have 1.3 installed. i did before a few months back but uninstalled it. then issue come up as i describe above

[Greg S]

-{ Quote: "

So, question to you all observing the delayed tray icon..., does this occur on a second or third restart as well?

Now, I don't believe this aligns with the observations of Greg S, however. Isn't that correct Greg?

Eirik" }-
My tray icon(AG) is always the last one to appear in the tray so the loading time may vary. I'm not concerned with the timing of the tray icon as long as it(AG) functions properly pertaining to the security aspect. It appears that it is working security wise even though in my issue, the AG settings dialog was borked. Evidence of that was the screenshot of browsing for said screenshot. I assume if it were not working, I wouldn't have gotten the popup alert. I also tested the USB launch with the Dialog settings borked and it also worked. Just for the record, the screenie image in last post was moved to the desktop from the documents folder before the screenshot was taken. That is where the browse function on this forum is defaulted to. Just for the heck of it, I added the Desktop folder(path) to privacy protected folder. I then hit browse on this forum which as mentioned, for me defaults to the Desktop, AG blocked it dead in it's tracks. What does all that mean to or for me, I haven't a clue. Now that I have the Disable/Re-Enable protection working my personal wish list on this would be,

1) Totally get rid of this IE has blocked access to the Documents folder thingy since it's useless in my opinion because it only works correct 50 percent of the time unless I'm doing something wrong on my end. Also when I say totally get rid of it, I especially mean that flashing icon every time it happens. I know that I can select to not show the popup alert but I will still get the flashing icon which is again useless. AG is warning about blocking something that it in fact did not block which is access to the Documents folder. If it truly did block access to the Documents folder then I would have gotten the full fledge block popup alert as I did when I added the Desktop folder to the protection. As in screenshot below. This is what I get when the Desktop is added to protection. In the screenshot below, I get this message when I try to click the Desktop link in Explorer left side pane. My other option could be, remove the Documents folder from being protected but why should I. AG needs to remove this blocked Documents folder access false alarm and the associated flashing tray icon.

2) I would love to have the option to disable certain protections either until re-boot or until I re-enable them myself. I'm mostly talking about the USB launch protection. I have SRP setup for block all including Admins, nothing gets past this including files with extensions that AG does not protect. So I really don't need the AG USB protection on all the time.

PS: I did not have version 1.3 installed prior to installing 1.4.

216361

[pegr]

-{ Quote: "My tray icon(AG) is always the last one to appear in the tray so the loading time may vary. I'm not concerned with the timing of the tray icon as long as it(AG) functions properly pertaining to the security aspect. It appears that it is working security wise even though in my issue, the AG settings dialog was borked." }-This is a valid point. From the tests I have performed, I too have found that AG security is functioning well before the tray icon appears. However, CPU utilisation remains very high on my system while the tray icon is loading, which impacts system performance until the tray icon appears.

[Eirik]

Hi All,

I've heard back from engineering on:

Delayed Appearance of AppGuard Icon

They have confirmed the delay. It is caused by the licensing binaries from our partner. They perform a check with each Windows launch, and cause more CPU use than AppGuard itself. This does not impair security. In the next release we will be improving the licensing code.

Cheers,

Eirik

[pegr]

Good news that the cause has been found. :thumb: :)

[jmonge]

thanks Eirik;)

[demoneye]

erik

what about a none unicode issue?? is it gona be fix asap also? its more critical than any bug so far when u CANT protect Dir that its name is not in English.

cheers

[Brocke]

does anyone running Windows 7 32bit have this block while running IE8?

-{ Quote: "Prevented process <Internet Explorer> from writing to <c:\windows\inf\setupapi.app.log>. " }-


when i run IE8 AG keeps blinking and alert of that.

[Greg S]

Eirik, I have added the Desktop folder to AG's Privacy. Reading a post here on Wilders there was a link to a semi security product. I clicked the link and of course it took me to the web site. AG's status tab shows this

216403

My question is, did AG truly block these events?. If they are blocked, then this privacy mode is pretty sweet and I would like to have a way to disable the flashing tray icon just for the privacy mode. According to the help file "AppGuard will sometimes prevent applications from writing to system directories with no adverse side effects (i.e. the application still operates as desired). AppGuard will report these events in the AppGuard GUI.". The same should go for blocked item in privacy mode especially if "the application still operates as desired" . OK, great, let it report this in the status tab and/or the event viewer. Enough already, no need to flash the tray icon too if something is prevented, especially if it's benign and "the application still operates as desired" . I still have my doubts as to whether something has been prevented/blocked/not accessed pertaining to this privacy mode.

About things in privacy mode being blocked, why is it that on some I get the dialog box that has this

216322

and on others I get this

216361

[buckslayr]

Does anybody have any thoughts about running appguard alongside of a-squared?

[buckslayr]

I want to tip my hat to appguard support team. I was having some license issues and they were extremely helpful getting things straightened out. Appguard is running great now.

[ellison64]

-{ Quote: "I want to tip my hat to appguard support team. I was having some license issues and they were extremely helpful getting things straightened out. Appguard is running great now." }-

Im trying to install appguard on my desktop for my daughter to use ,but getting unlock key is already active when i try online activation.It was installed a few months back but reinstalled vista on the desktop ,so its not on my laptop or desktop now.Should the software have been deactivated like shadowprotect before uninstalling it?.Ive contacted appguard but they are out of the office until monday.Anyone have any suggestions how to get my lice3nce to activate?.
tia
ellison

[1000db]

When you reboot the machine does AG ask for a key or to continue the trial?

[buckslayr]

I struggled for a couple of days with the same problem. Uninstall & reboot. Re-instsall. Don't restart when it asks you to. Click on appguard and then insert license. Should activate. Then reboot.

[ellison64]

Hmmm...
Ive reinstalled appgaurd as aministrator,put in licence and activated it and rebooted.The only problem now though ,is the program doesnt seem to be working correctly.When i open the gui ,theres only status and settings tab ,with everything set to off in red letters ,and theres nothing to lcik in either tab except ok.Appguard is in the system tray with a green tick but nothings working?.This is getting frustrating.Im using vista and avg Internet security.I also have shadow defender installed but everythings running in nor mal mode.
ellison

p.s i dont see any app guard process running in taskmanager either,although the tray icons there.

[buckslayr]

Make sure to delete all program folders when you uninstall. Try using revo.

[Eirik]

-{ Quote: "...Ive contacted appguard but they are out of the office until monday..." }-

Hi All,

The AppGuard Support team is actually in today. However, one of the members is out and set up his 'auto-respond' without exclusions. Ellison received one of these when he contacted us, which suggests everyone is out until Monday.

Cheers,

Eirik

[ellison64]

Well appguard support have just emailed me and are helping figure this out (looks like someone must still be at the office).The appguard service is showing that its running and set to automatic,however when i click the service entry i get a pop up that says "configuration manager .The specified value does not exist in the registry"
ellison

[ellison64]

-{ Quote: "Hi All,

The AppGuard Support team is actually in today. However, one of the members is out and set up his 'auto-respond' without exclusions. Ellison received one of these when he contacted us, which suggests everyone is out until Monday.

Cheers,

Eirik" }-

Thanks for the email support.Trying to get this running so i can go have a drink and get my daughter off my back..and let her use the pc :)
ellison

[ellison64]

Hello Eirik....
Please thank your team for helping me get appguard up and running.Ive followed instructions in support email ,( had to show hidden folders to delete) re-installed ,activated license and all is well.Now im off to have some wine,and my daughter can happily play on bebo.
thanks again
ellison

[Greg S]

Drive-by download protection does not honor an allowed addition to Drive-By Download Protection Extensions.

[pegr]

-{ Quote: "Drive-by download protection does not honor an allowed addition to Drive-By Download Protection Extensions." }-After making the changes try exiting the GUI and reloading it again and see if that helps. My experience of adding folders in order to customise the way AppGuard works is that the changes don't always take immediate effect without first restarting the GUI.

[Greg S]

-{ Quote: "After making the changes try exiting the GUI and reloading it again and see if that helps. My experience of adding folders in order to customise the way AppGuard works is that the changes don't always take immediate effect without first restarting the GUI." }-
Hmm, let me experiment with this.


OK, didn't experiment. I was going to but before doing that, I wanted to try one more time before the GUI restart thingy and now it works. What's up with that?

[Greg S]

Eirik, I'm back on this Private Folders situation again and I have a question. I have AG installed on E: partition and the default private folder for IE is e:\users\seven\documents. Here is what I get when I use the paper clip for attaching images in the forum.

217390

Notice in the screenshot that I only get the AG info dialog for the supposed blocked action. OK, if I navigate in the left hand sidebar to "Computer\Windows 7 Professional\Users\Seven\My Documents", I get this

217392

Notice in that screenshot, the dialog with "Access is denied." Which of the two screenshots is AG's intended behavior? Keep in mind that I've mentioned before that with the first screenshot, I have been able to access and post images on forums, contrary to what the first screenshot dialog states.

[pegr]

-{ Quote: "Hmm, let me experiment with this.


OK, didn't experiment. I was going to but before doing that, I wanted to try one more time before the GUI restart thingy and now it works. What's up with that?" }-I wonder whether there may sometimes be a delay in the communication between the two AppGuard processes: AppGuardGUI.exe and AppGuardAgent.exe. If true, this could explain why the behaviour is inconsistent, and also why exiting and restarting the GUI or rebooting the PC solves the problem.

[Greg S]

-{ Quote: "I wonder whether there may sometimes be a delay in the communication between the two AppGuard processes: AppGuardGUI.exe and AppGuardAgent.exe. If true, this could explain why the behaviour is inconsistent, and also why exiting and restarting the GUI or rebooting the PC solves the problem." }-
Could be. I'm about ready to throw in the towel on AG again. My biggest complaint is the reporting of so called blocked writings to such and such file which for me is not true. Here's a another one similar to the screenies in the last reply. Every time a song is played in WMP12, AG's tray icon starts flashing and the status panel tab chokes down with these entries.

217486

AG's been uninstalled here for quite some time and many songs have been played whilst AG's been uninstalled. Look at the file details last access time. Better yet, look at the modified time

217487

So, it appears that AG is again stating that it's blocking the writing of some file but in fact it's not.

[pegr]

-{ Quote: "So, it appears that AG is again stating that it's blocking the writing of some file but in fact it's not." }-Not sure what's going on there. Perhaps we need Eirik to comment on this. As a possible workaround, one thing you could try to quieten AppGuard down would be to create an exclusion for the folder.

[Eirik]

Hi All,

I'm working from a new laptop, not yet fully configured and all. But, at least I can do this...

So, Greg, an engineer replicated your observations. BTW, we assumed that your system drive is E:, let us know if not. This blocking event is the result of guarding Windows Media Player, and not due to privacy mode. I don't know enough to tell you what WMP is actually doing. Sometimes a programmer (i.e., WMP) uses the wrong API, or in the wrong way. We'll take a look at this in the next regression cycle. As far as I've heard from you and the engineer, WMP is working okay but those event blocks, particularly the blinking AppGuard icon, are annoying.

I can recommend two actions for now. First and preferred, disable notifications for WMP by unchecking the respective checkbox/column in the guard list. Second, not preferred, define an exception rule that allows guarded applications to write there.

I hope this helps.

Cheers,

Eirik

[Greg S]

-{ Quote: "
We'll take a look at this in the next regression cycle. As far as I've heard from you and the engineer, WMP is working okay but those event blocks, particularly the blinking AppGuard icon, are annoying.

I can recommend two actions for now. First and preferred, disable notifications for WMP by unchecking the respective checkbox/column in the guard list.

I hope this helps.

Cheers,

Eirik" }-
Thanks, E: is correct and yes WMP does work fine, it's the filling up of the status panel with the messages that is the most annoying but the flashing icon is a close second. The population of status messages occurs each time a song is played, not just for the initial launch and first song played in WMP.

[mike21]

-{ Quote: "erik

maybe this clear the fonts problem (none English ones). tested on AG 1.4.7 (also exist on 1.3.3) ,AG cant protect such dirs :(

" }-

Well another keygen for fd-isr. And you have in your sig fd-isr.

[Greg S]

-{ Quote: "Hi All,

I'm working from a new laptop, not yet fully configured and all. But, at least I can do this...

So, Greg, an engineer replicated your observations. BTW, we assumed that your system drive is E:, let us know if not. This blocking event is the result of guarding Windows Media Player, and not due to privacy mode. I don't know enough to tell you what WMP is actually doing. Sometimes a programmer (i.e., WMP) uses the wrong API, or in the wrong way. We'll take a look at this in the next regression cycle. As far as I've heard from you and the engineer, WMP is working okay but those event blocks, particularly the blinking AppGuard icon, are annoying.

I can recommend two actions for now. First and preferred, disable notifications for WMP by unchecking the respective checkbox/column in the guard list. Second, not preferred, define an exception rule that allows guarded applications to write there.

I hope this helps.

Cheers,

Eirik" }-

Eirik, WMP seems to be fixed by setting "Alarm" to "No". It still taxes the Event Viewer but at least it takes care of populating AG status tab and the blinking icon. In my post above http://www.wilderssecurity.com/showpost.php?p=1665956&postcount=90,
Which of the two screenshots is AG's intended behavior? Also, why is the global xml policy formatted so nicely but the users policy is run together all on one line? Where is the how to's on editing the policy? Can I remove all the Office, Chrome, Adobe etc. rules?

What is the purpose of this rule?
<C_BRN_TE_FOLDER>
<eFolder>6</eFolder>
<eAccessType>1</eAccessType>
<bUser>true</bUser>
<tcPath>desktop.ini</tcPath>
</C_BRN_TE_FOLDER>

[Kees1958]

Playing with appguard again ;D

Noticed that I get warnings when using privacy mode on rootdir access in following situation.

Rootdir is added to privacy mode
Subsir is added as an allowed directory


By the way is it possible to disable blinking icon?

[Brocke]

-{ Quote: "
By the way is it possible to disable blinking icon?" }-


I agree that would be a good addon feature. good suggestion nonless on adding that because id like to see it added.

[Eirik]

-{ Quote: "
Which of the two screenshots is AG's intended behavior? " }-

In both cases, AppGuard is behaving the same. It displays the “AppGuard has blocked….” message. The other message box is displayed by the application as a result of being denied access to the folder.






-{ Quote: "
Why is the global xml policy formatted so nicely but the users policy is run together all on one line? " }-

The global XML policy file is relatively static and was created directly by programmers whereas the dynamic or user policy is ever-changing and created by AppGuard. Our developers didn't invest much effort to endow AppGuard with better XML file formatting capabilities.


-{ Quote: " Where is the how to's on editing the policy?
" }-

Admin guide. I'll send via PM.





-{ Quote: "
Can I remove all the Office, Chrome, Adobe etc. rules?" }-

Yes, but you'd have to adjust the counters in the tags, as you'll see in the admin guide. BTW, I wouldn't expect any performance benefit from deleting these.



-{ Quote: "
What is the purpose of this rule? [...<tcPath>desktop.ini</tcPath>...]
" }-

When I.E. attempts to open the My Documents folder it always tries to read the desktop.ini file in the My Documents folder. This was causing many alarms in the AppGuard details tab and Windows event viewer. The rule is making an exception so that the desktop.ini file can be read by I.E.

Cheers,

Eirik

[Eirik]

-{ Quote: "Playing with appguard again ;D

Noticed that I get warnings when using privacy mode on rootdir access in following situation.

Rootdir is added to privacy mode
Subsir is added as an allowed directory


By the way is it possible to disable blinking icon?" }-

I can tell you that quite a few folk here at Blue Ridge want that tray icon to simmer down a bit [employ country-western accent with nasal twang].

One can disable notifications for a guarded application. This does so for all blocks pertaining to that application, however. We intended to do some enhancements in this area that I'm pretty sure AppGuard users will appreciate.

One can also click on the check box of an AppGuard generated prompt on privacy mode blocks. This however, does not eliminate everything, however.

We're users too, and we want that icon to speak only when it has something new and useful to say...figuratively speaking.

Cheers,

Eirik

[Eirik]

-{ Quote: "I agree that would be a good addon feature. good suggestion nonless on adding that because id like to see it added." }-

Absolutely!

[Greg S]

-{ Quote: "In both cases, AppGuard is behaving the same. It displays the “AppGuard has blocked….” message. The other message box is displayed by the application as a result of being denied access to the folder.
" }- Sorry but that doesn't make sense. In both cases, it's IE trying to do the accessing which means it should display both warnings unless one disables the warning of the first screenshot in that post.
On any forum, click the attachment paper clip icon, select one of the browse buttons, Explorer opens up with the first screenshot previously posted(single warning that can be disabled). In AG's default state, shouldn't the second screenshot be the norm? I do not get the second screenshot with both warnings until I select/expand Documents and click My Documents. I will also get the second screenshot if I add a folder to be Private. I think AG has a problem interpreting or distinguishing between Documents and My Documents. I know both are essentially the same but the mechanics of getting to them can be different.



-{ Quote: "
Yes, but you'd have to adjust the counters in the tags, as you'll see in the admin guide. BTW, I wouldn't expect any performance benefit from deleting these.



Cheers,

Eirik" }-
Thanks Eirik, I'm not looking for a performance gain but this leads to the real question, Does AG look for the existence of these apps once on install or on every boot?

Is this the number that has to be changed to correspond with the number of apps?
<usAppNum>10</usAppNum>

[bellgamin]

I want to give AG a trial using Shadow Defender.

Does AG require a restart during its installation?

[jmonge]

yes you have to restart man:)

[Kees1958]

-{ Quote: "I want to give AG a trial using Shadow Defender.

Does AG require a restart during its installation?" }-

For people who strip down services: Appguard requires Terminal Services to work (because it is the stand alone client of a applcation which can be managed centrally at companies).

Regards Kees

[Brocke]

so when are we going to see a update for AppGuard? maybe minor updates or major?

thanks

[Blackcat]

-{ Quote: "I can tell you that quite a few folk here at Blue Ridge want that tray icon to simmer down a bit .

We intended to do some enhancements in this area that I'm pretty sure AppGuard users will appreciate.

We're users too, and we want that icon to speak only when it has something new and useful to say...figuratively speaking.Eirik" }-
IMHO, either ditch, or greatly reduce both the flashing tray icon and the obscure window messages as " X is is not a valid Win 32 application". Average Home users will run a mile away from this sort of intrusive messaging.

I installed the new version about a week ago and after placing various programs in the Guard list and unchecking the alarm box it seemed to quieten down. But after a couple of hours the tray icon flashed up again with the new Office 2010 beta which I could not stop even after placing the exe. in the Guard list.

AppGuard has the advantage of being a very light application, but compared to other "sandboxes" it is still too "Chatty", particularly for average Joe.

[Eirik]

-{ Quote: "Sorry but that doesn't make sense. In both cases, it's IE trying to do the accessing which means it should display both warnings unless one disables the warning of the first screenshot in that post.
On any forum, click the attachment paper clip icon, select one of the browse buttons, Explorer opens up with the first screenshot previously posted(single warning that can be disabled). In AG's default state, shouldn't the second screenshot be the norm? I do not get the second screenshot with both warnings until I select/expand Documents and click My Documents. I will also get the second screenshot if I add a folder to be Private. I think AG has a problem interpreting or distinguishing between Documents and My Documents. I know both are essentially the same but the mechanics of getting to them can be different.




Thanks Eirik, I'm not looking for a performance gain but this leads to the real question, Does AG look for the existence of these apps once on install or on every boot?

Is this the number that has to be changed to correspond with the number of apps?
<usAppNum>10</usAppNum>" }-


Hi Greg,

I received an answer to your questions from one of the engineers.

Answer 1:

My apologies, I didn’t read the original post closely enough to notice that in the first case you are accessing the Libraries\Documents Library. AppGuard is not having trouble distinguishing between Documents and “My Documents” and is behaving the same in both cases (i.e. blocking access to C:\users\seven\documents which is mapped to “My Documents” folder). It should be noted that the Libraries\Documents “container” is not actually a folder but a Library (http://windowsteamblog.com/windows/b/developers/archive/2009/04/06/understanding-windows-7-libraries.aspx). Libraries are a new concept in Windows 7 and by default I believe that the “My Documents” folder is a part of the Documents Library.

In the first case when opening up the Documents Library, I.E. reads the contents of the library in order to display it. Because the “My Documents” folder is part of the Library, in the process of opening up the Documents Library, I.E. is attempting access to the “My Documents” folder as well. AppGuard is blocking this access to the “My Documents” (hence the AppGuard error message). In this case I.E. is not displaying an error message (perhaps I.E. does not consider this to be error-worthy since you are not trying to access the “My Documents” folder directly). In the second case when AppGuard blocks access to the “My Documents” folder, I.E. is responding with an error message (perhaps because in this case you are accessing the folder directly). Another explanation as to why I.E. is behaving inconsistently is that two different functions (accessing a Library vs. accessing a Folder) may be involved and not sharing the same code (and perhaps even two different programmers wrote the code). Since I’m not an I.E. developer I can only speculate as to why I.E. is behaving inconsistently, but I can assure you that in your second case, AppGuard is NOT displaying the “Location is not available – Access is Denied” message. Nor is AppGuard confusing the Documents Library with the “My Documents” folder. In both cases, it is simply blocking access to C:\users\seven\documents.

To prove this to yourself (or to prove me wrong), reconfigure your Documents Library (right click on the Library and select “Properties”) to not include your “My Documents” directory and then attempt to open up the Documents Library from I.E. In this case, AppGuard will not display a message (because it will not have blocked access to C:\users\seven\documents).

Answer 2:

AppGuard will look for the existence of protected applications in the following cases:

Any time the user modifies the policy.
Log off/Log on (which implies reboot as well).

[Eirik]

-{ Quote: "so when are we going to see a update for AppGuard? maybe minor updates or major?

thanks" }-

We decided to combine the next 32-bit AppGuard release with the first 64-bit AppGuard release, which is why we haven't released anything for awhile. Its looking like we'll do the next release in July. The feature set is still fluid. We may classify the first 64-bit AppGuard release as a beta.

Cheers,

Eirik

[Eirik]

-{ Quote: "IMHO, either ditch, or greatly reduce both the flashing tray icon and the obscure window messages as " X is is not a valid Win 32 application". Average Home users will run a mile away from this sort of intrusive messaging.

I installed the new version about a week ago and after placing various programs in the Guard list and unchecking the alarm box it seemed to quieten down. But after a couple of hours the tray icon flashed up again with the new Office 2010 beta which I could not stop even after placing the exe. in the Guard list.

AppGuard has the advantage of being a very light application, but compared to other "sandboxes" it is still too "Chatty", particularly for average Joe." }-

Everyone on the AppGuard team at Blue Ridge wants the next AppGuard to be less 'chatty'. We will include some tweaks in the next release to help that.

Unfortunately, we probably won't do anything in the next release that eliminates the cryptic messages such as 'not a valid Win 32 application' because those aren't actually generated by AppGuard but by either the operating system or a guarded application, depending on the scenario. There are methods possible that we could employ that effectively close such prompts almost as quickly as they open, which can then be replaced by a more practical AppGuard generated prompt. This requires some rather heavy lifting to accomplish in a meaningful way.

Cheers,

Eirik

[Eirik]

Question regarding "Privacy Mode", we're thinking about re-defining the default setting. Note, "privacy mode" prevents applications guarded with "privacy mode" from accessing designated folders, unless the user temporarily suspends this protection.

What do you prefer the default setting be for "Privacy Mode"?

A) leave it as is: all of "My Documents"
B) change it to a new folder created at installation called "Private Folders"
C) change it to unspecified/blank
D) something else (your idea)

Please provide two answers labeled accordingly, one for yourself (i.e., an advanced user) and one for your friends/family (i.e., not advanced).

There are other questions I'd like to ask. Stay tuned.

Thanks,

Eirik

[pegr]

-{ Quote: "We decided to combine the next 32-bit AppGuard release with the first 64-bit AppGuard release, which is why we haven't released anything for awhile. Its looking like we'll do the next release in July. The feature set is still fluid. We may classify the first 64-bit AppGuard release as a beta." }-Hi Eirik,

Will Kernel Patch Protection (PatchGuard) adversely impact 64-bit AppGuard in any way, and will the 64-bit version provide the same level of security as the 32-bit version?

Thanks.

[Eirik]

-{ Quote: "Hi Eirik,

Will Kernel Patch Protection (PatchGuard) adversely impact 64-bit AppGuard in any way, and will the 64-bit version provide the same level of security as the 32-bit version?

Thanks." }-

Same protection.

[Kees1958]

-{ Quote: "Question regarding "Privacy Mode", we're thinking about re-defining the default setting. Note, "privacy mode" prevents applications guarded with "privacy mode" from accessing designated folders, unless the user temporarily suspends this protection.

What do you prefer the default setting be for "Privacy Mode"?

A) leave it as is: all of "My Documents"
B) change it to a new folder created at installation called "Private Folders"
C) change it to unspecified/blank
D) something else (your idea)

Please provide two answers labeled accordingly, one for yourself (i.e., an advanced user) and one for your friends/family (i.e., not advanced).

There are other questions I'd like to ask. Stay tuned.

Thanks,

Eirik" }-


Most competitors create a private folder, so when you want to go with the flow. There are only a few aps (e.g. Chrome) which can be restricted for private folders as my documents. So I would opt for creating a new folder and explaining explictely in somesort of instal wizard.

AppGuard recognise Chromium as Chrome, I have put chromium in C:\Program Files, so I manually changed folder type to 4. This is a bitch to recognise on application name alone, just to inform you Eirik.

Regards Kees

[pegr]

-{ Quote: "Same protection." }-Thanks Eirik.

That's good news. :thumb:

Regards

[Greg S]

-{ Quote: "Hi Greg,
but I can assure you that in your second case, AppGuard is NOT displaying the “Location is not available – Access is Denied” message. " }- Ah Ha, so the second one is not coming from AG. I'm blown away by this,lol. I never get that message until after AG has been installed and do as mentioned. But get this, I just now performed the same scenario as previously mentioned and can not reproduce it now that AG has been re-installed for about a week. It must be something on this end that causes it to happen for about a week or so, don't know now. I'm hard headed, I still say this has something to do with AG. Here's a previous screen shot from a previous install of AG. This is what I got after adding Desktop to the private folder. It's the same dialog.

216361

-{ Quote: "
Answer 2:

AppGuard will look for the existence of protected applications in the following cases:

Log off/Log on (which implies reboot as well). " }-
Send me the link for policy editing. I want to get rid of those that I do not use. I don't need AG populating the Event Viewer with such useless info. Notice I said "I don't need", that's not to say that it is not useful for others, it's just me not like it

[Eirik]

-{ Quote: "Hi Eirik,

Will Kernel Patch Protection (PatchGuard) adversely impact 64-bit AppGuard in any way...?

..." }-

I just realized that I had not answered this question. The answer is "no". Kernel Patch Protection does not adversely effect... The Kernel Patch Protection team at Microsoft was very helpful on this matter.

Cheers,

Eirik

[ruinebabine]

-{ Quote: "The Kernel Patch Protection team at Microsoft was very helpful on this matter." }-Waow, Eirik, you should have done for a pretty good karma, then, from what I heard from some other security developers! :)

[trjam]

-{ Quote: "Waow, Eirik, you should have done for a pretty good karma, then, from what I heard from some other security developers! :)" }-


Oh, he works for a company (http://www.blueridgenetworks.com/company/about-us.php) that more then likely has some friends close by in Washington, who have some friends in Redmond.;)

Great news Eirik.:thumb:

[bellgamin]

-{ Quote: "I just realized that I had not answered this question. The answer is "no". Kernel Patch Protection does not adversely effect... The Kernel Patch Protection team at Microsoft was very helpful on this matter." }-Hmmm... AG is using ring 3 then, right?

[pegr]

-{ Quote: "I just realized that I had not answered this question. The answer is "no". Kernel Patch Protection does not adversely effect... The Kernel Patch Protection team at Microsoft was very helpful on this matter." }-Thanks again for the further clarification, Eirik.

I assumed that was what you were implying when you said that the protection would be exactly the same. :)

Regards

[pegr]

-{ Quote: "Hmmm... AG is using ring 3 then, right?" }-From my limited understanding of how AG works, I have always assumed it is implemented via some kind of filter driver rather than hooking, which is why it claims to protect against around 90% of threats, rather than 100%.

I'm not a technical expert when it comes to these things but my understanding is that to build a policy HIPS with 100% protection would require hooking for things like inter-process monitoring, etc, which as you rightly point out would mean Ring 3 on 64-bit.

These are only assumptions on my part, so I think we need Eirik to provide further clarification that 64-bit AG is not using Ring 3 user-mode hooks.

[1000db]

-{ Quote: "From my limited understanding of how AG works, I have always assumed it is implemented via some kind of filter driver rather than hooking, which is why it claims to protect against around 90% of threats, rather than 100%." }-

AG doesn't protect against memory injection, man-in-the-browser, or cross-site scripting attacks etc. I think that is why AG only claims 90% protection. Such threats are outside the scope of AG apparently.

[pegr]

Yes, that's my understanding too.

[AvinashR]

-{ Quote: "AG doesn't protect against memory injection, man-in-the-browser, or cross-site scripting attacks etc. I think that is why AG only claims 90% protection. Such threats are outside the scope of AG apparently." }-

Its really good to see this. No Bogus commitment !!

:thumb: :D

[Eirik]

-{ Quote: "Hmmm... AG is using ring 3 then, right?" }-

No, AG is not using ring 3. Good question though!

I'm afraid I don't have any more detailed information.

Cheers,

Eirik

[Eirik]

-{ Quote: "AG doesn't protect against memory injection, man-in-the-browser, or cross-site scripting attacks etc. I think that is why AG only claims 90% protection. Such threats are outside the scope of AG apparently." }-


man-in-the-browser (correct, AG does not)

cross-site scripting attacks (correct, AG does not)

The above are due to our "Prime Directive" (hello Star Trek folk), forbidding interference in the internal affairs of the software applications our products "guard".

inter-process monitoring (If I infer Pegr's implication correctly, AG probably does not. There may be an exception but I cannot recall the terms. "I picked a bad day to quit sniffing modeling glue!")

memory injection (perhaps a future feature, albeit, in our minimalist/clean-cut manner.)

Cheers,

Eirik

[Greg S]

Any news on the next Update?

[Eirik]

-{ Quote: "Any news on the next Update?" }-

We're working out details, news coming next week on our short-term plans/releases.

Cheers,

Eirik

[Greg S]

-{ Quote: "We're working out details, news coming next week on our short-term plans/releases.

Cheers,

Eirik" }-
OK thanks, ...

[Greg S]

After the latest Win 7 updates, AppGuard no longer functions properly.

219215

219214

[Eirik]

-{ Quote: "After the latest Win 7 updates, AppGuard no longer functions properly.

219215

219214" }-

Hi Greg,

My initial suspicion regards the licensing code. Some situations like this are resolved by restarting the PC. And, if that fails, the restart sometimes 'outs' the licensing code because the user may be prompted to re-enter the activation code or is told their trial period is over. Would you please restart and share the results with us (appguard@blueridgenetworks.com)?

BTW, barring a last minute 'bug', we'll begin a 64 big Win 7 beta the first week of July. The final release of the next AppGuard, 64 bit included, is scheduled for the end of July. There are one or two features I'm awaiting go/no-go status information. When that is resolved, I'll post something on new features.

Cheers,

Eirik

[Greg S]

-{ Quote: "Hi Greg,

My initial suspicion regards the licensing code. Some situations like this are resolved by restarting the PC. And, if that fails, the restart sometimes 'outs' the licensing code because the user may be prompted to re-enter the activation code or is told their trial period is over. Would you please restart and share the results with us (appguard@blueridgenetworks.com)?

BTW, barring a last minute 'bug', we'll begin a 64 big Win 7 beta the first week of July. The final release of the next AppGuard, 64 bit included, is scheduled for the end of July. There are one or two features I'm awaiting go/no-go status information. When that is resolved, I'll post something on new features.

Cheers,

Eirik" }-
Info has been sent

[Greg S]

My situation has been solved thanks to Eirik and the fine staff at Blue Ridge!

[Habakuck]

-{ Quote: "Hi Greg,

My initial suspicion regards the licensing code. Some situations like this are resolved by restarting the PC. And, if that fails, the restart sometimes 'outs' the licensing code because the user may be prompted to re-enter the activation code or is told their trial period is over. Would you please restart and share the results with us (appguard@blueridgenetworks.com)?

BTW, barring a last minute 'bug', we'll begin a 64 big Win 7 beta the first week of July. The final release of the next AppGuard, 64 bit included, is scheduled for the end of July. There are one or two features I'm awaiting go/no-go status information. When that is resolved, I'll post something on new features.

Cheers,

Eirik" }-
That is wonderfull! 8)

You will keep us up to date if the beta is released? =)

I am waiting for this moment sice last year.... ;)

PS: One Question: Is AppGuard compatible with Norton IS 2011? (Download Insight, SONAR and so on) Or will i get trouble using them both?

[Greg S]

I've come to the conclusion that AG's Privacy Mode is just not worth it. I still have my doubts as to it's real effectiveness but when put on the scales, the nuisance factor outweighs the supposed security that it offers for me. I'm not trying to be harsh, I'm just stating how it is for me and my setup. Here's only one of many scenarios. I installed Windows Live Mail on Windows 7. In trying it out all works well except for the Stationery feature of WLM. I've spent four days trying to figure out why the Stationery feature did not work. Here's why it wouldn't work, WLM is set by default on the initial selection of More Stationery to automatically open the My Stationery in a Users Documents. I didn't know this of course and natuarlly assumed since the WLM directory in Program Files has the Stationery folder containing WLM stationery that it was going there first and not to My Stationery in Users Docs. When the AG popup alert was appearing, I'm thinking this is another in my opinion useless AG privacy mode warning like I get when right clicking on a file and selecting properties. Not the case this time, I was locked out but didn't know it at the time,lol. I finally decided to Suspend All Protections(four days later), click the WLM More Staionery option and of course I could access the stationery in My Stationery User Docs. After it opened to the default My Stationery, I browsed to the WLM Stationery folder in Program Files, selected a stationery from there. The last used location was/is remembered, in this case Program Files so Privacy Mode can be re-enabled for WLM but now I'm still gonna get the AG privacy warning popup since the search for stationery starts in User Docs and moves on to Program Files which was the last used location. So, is Privacy Mode feature worth it? For more than many, I'm sure that it is but for me a single user who stores pretty much nothing in the Documents area, No. But I have to ask the question, If I turn off Privacy Mode for all the apps that I have it enabled on and taking into account what I just said about not storing anything in Documents, does AppGuard still provide ample protection? I'm sure that it does but someone re-assure me,lol.

[Eirik]

-{ Quote: "I've come to the conclusion that AG's Privacy Mode is just not worth it." }-

with AppGuard 2.0, we change the default setting for privacy mode where the private folders are no longer defined as all of My Documents, containing both valuable and worthless content. Instead, AppGuard will create a single folder at installation, leaving it to the user to place valuable content and folders within it. Users may still customize privacy mode as they wish.

On privacy mode, I've always struggled with how it's application to all of My Documents contradicted our security principle regarding prioritization. AppGuard places only highly exposed, at-risk applications under guard, not all executables. All kinds of junk exists within My Documents.

Security is often accompanied by inconvenience, which is a form of cost. So, to protect worthless junk comes (from sophisticated attacks so concerned for stealth that they avoid tripping an alarm that might sound by NOT attempting to implant persistent malware by altering a protected resource) at some cost. So if the cost of inconvenience in practice is so low, why not? But, if otherwise, it's more prudent to only protect content of value.

So, we're making the chane.

Cheers

Eirik

[pegr]

-{ Quote: "I've come to the conclusion that AG's Privacy Mode is just not worth it." }-I posted on this a long time ago, suggesting that AppGuard would benefit from more granularity in its approach to policy restriction, similar to the way Sandboxie works. See post #577 in the following thread: http://www.wilderssecurity.com/showthread.php?p=1551855&highlight=appguard#post1551855

As a workround, I only have Privacy Mode enabled for web browsers. It's not a perfect solution but it does cover one of the main risk areas; and I would think that most people don't need their web browser to have access to private data.

[Greg S]

-{ Quote: "with AppGuard 2.0, we change the default setting for privacy mode where the private folders are no longer defined as all of My Documents, containing both valuable and worthless content. Instead, AppGuard will create a single folder at installation, leaving it to the user to place valuable content and folders within it. Users may still customize privacy mode as they wish.

On privacy mode, I've always struggled with how it's application to all of My Documents contradicted our security principle regarding prioritization. AppGuard places only highly exposed, at-risk applications under guard, not all executables. All kinds of junk exists within My Documents.

Security is often accompanied by inconvenience, which is a form of cost. So, to protect worthless junk comes (from sophisticated attacks so concerned for stealth that they avoid tripping an alarm that might sound by NOT attempting to implant persistent malware by altering a protected resource) at some cost. So if the cost of inconvenience in practice is so low, why not? But, if otherwise, it's more prudent to only protect content of value.

So, we're making the chane.

Cheers

Eirik" }-
Again, very well put Eirik! I'm always reluctant to post my personal opinions because it can look like I'm trying to dis-credit a particular feature, which is not the case. I like the Privacy mode and like being able to add other folders for protection. It's very powerful to say the least. For me, it's just the mechanics of it with the User Docs folder that drives me batty.

[Greg S]

-{ Quote: "
As a workround, I only have Privacy Mode enabled for web browsers. It's not a perfect solution but it does cover one of the main risk areas; and I would think that most people don't need their web browser to have access to private data." }-
I agree. I still have all Privacy modes checked, except for Windows Media Player. I posted about it here before. Launch WMP and AG gets choked down populating the Status Tab.

[jmonge]

and if you add explorer.exe to the protection list it will protect you from accidental delete stuff in your system,even if a virus wants to make corruption it will be access denied;)

[Greg S]

-{ Quote: "and if you add explorer.exe to the protection list it will protect you from accidental delete stuff in your system,even if a virus wants to make corruption it will be access denied;)" }-
Never tried that one. I did try the other I think 3 that were mentioned, rundll32 was one can't remember the other two. Worked fine, but again I go back to the nuisance factor of the warning/tray flash. Not worth it. Not to mention, the OS makes extensive use of the 3 possible additions to do whatever it does in the background. It would be fine for right now which was evident but what about down the road when those 3 have been blocked for so long and the OS hasn't been able to it's sneaky behind the scenes shuffling. Couldn't it possibly break something in the OS?

[jmonge]

not at all;) i had it like that for months but only windows updates was block :) but i didnt care to much for that:)

[BoerenkoolMetWorst]

Anyone knows if AppGuard is compatible with Mamutu?