AppDefend v1.300 Alpha Release

Yep, the ghosts are important
Beside I also liked the Pop-up Forms from version 1.2 a, maybe you can add an option that user can choose which forms he wants to use either 1.2 a or 1.3 a.

 

Hi SysJunky.

The only reason between change of look is that Jason now use 100% ms free code for the alert now. The whole code to display controls have changed.
The alerts are now made from the same "meat" as GhostShell. So yes they are skinable. However I also agree that those alerts need some work and i'm pretty sure that once RD is completely back it'll become one of the priority.

It'll be great if we could start a thread posting alerts window of diffferent security program and just comment what we like or don't and that way build a nice interface.

 

Upon install I was able to answer initial prompts after a couple of reboots I would get the system tray icon and opening program from there resulted in no apps showing up[ in the apps section. Closing the program the system tray icon disappears and gss.exe would be gone completely from the task manager, however system protection still active even though the service don't show up in task manager or various RK scanners. Kind of wondering how this program could really be disabled if it doesnt even show up as running at all but yet protection is still active, I think its pretty cool either way. My work around to the apps not showing in the apps section for editing rules was to launch a totally new program which gss would automatically prompt for action, after this I would launch gss.exe and go to the apps section and volla all my programs and apps that were prompted earlier for rules were showing.
As soon as I close out the program system tray icon disappears again and no service(s) for gss being displayed in task manager but protection still active, very cool.

 

I actually prefer the pop up forms from v1.1. I'm hoping jason can add an option to be able to choose between them.

 

GSS.exe is no longer needed for any protection to be enabled, and when the update of it occurs (over to the new GUI code) it will basically just be a way to edit rules, view logs, and things of that nature.

The way protection works now means only the driver needs to be active, as it handles the interaction with the user, rather than needing to be a service like other products (and how I used to do it). This is why the new GUI code had to be developed to allow such a tight integration into the system, whilst being secure.

 

Did you prefer the way the information was displayed or the actual look of it? The "look" (colors, layout, etc) can be changed by the end user (since skinning is supported, it doesn't check for user scripts yet), but I will be including 2 built in alert styles which can be chosen. The one I am using at the moment will be one of them simply because a few people seem to like the old simple windows look, though it probably won't be the default look.

The actual showing of the information (in list form) cannot be changed back to the old style. The biggest reason for this is space considerations, and long items. However there are some visual improvements coming to the list display, so it won't look as bland as it does at the moment where the real info is shown.

The old alert failed to display all the relevant information in some cases due to extremely long process names,commandlines,registry values/keys, etc. Since GSS v1.2, I upgraded the internals so it could handle the longest items possible and since v1.300 it can now visually show the longest items possible. Something other products are unable to do (yet).

 

I just liked the ease of selecting the actions in v1.1. Call me lazy but it was just the simple, single click of the mouse and the simple windows look which i preferred.

 

I really can't agree more with farmerlee, it's so easy and quick to select actions with v1.1 , I wish this style or method could be kept, through its equally important to have clear and un-obstructed information.

When I tried ProSecurity and Online Armor both were messy for me, through out of the two I didn't like Online Armor, the multi-coloured alerts made it hard to see the information, let alone read it, unfortunately I suffer with dyslexia and dyspraxia , so having a clear alert box with clear text is essential, the one thing I have always thought you (Jason) have done really great at compared to your competitor's is the clarity of your GUI's , hopefully you can keep up this great work, I appreciate it lots and lots

Fluffy

 

Ghostshell style is cool.

Very good idea to give the option choosing between different alert styles.

 

I think I will open up the possibility to use buttons or a list for the actual "what to do" part of the alert (which is the bottom section). The information list can't be changed, but the bottom one is simple enough to allow both, though obviously not at the same time. So expect the 4 buttons back for the next release...

 

Not having to double click to chose an action is a great idea.

However the action list have alot of potential for controling how to deal with the program, so it could be nice to witch between basic and advanced actions.

The way information is displayed is fine.
Is it possible to add images in that text box ?
An icon of the running application is alwais apreciated.
I also liked how old appdefend have different icons for the actions the application is trying to make. Save some reading.

 

http://www.ghostsecurity.com/images/alpha_adnewprot.jpg

An image from the next release, some new protection has been added.

 

Just one more showing the ghosts back on the new GUI code, I slightly updated them a bit to blend better and gave them a smile instead of the "no face" as it was before. I think it reflects their joy being on some non Microsoft GUI code.

 

Wow......really got to love those ghosts Jason , I know I do

They really make the screen look friendly'er and the system safe from malware, I'm sure their presence alone will scare away all the nasty bugs....hehe....good work as always, I can't wait to try the next version out, thanks

Fluffy

 

Don't mean to hound you about it, but how did the 64 bit compile go?

 

Not too good, it will take a few hours to get that build up to scratch due to the amount of changes that have occurred. And I will need to find what Microsoft have changed for some of the newer things I have added to the kernel as they no longer exist going from the errors in the 64bit build I saw. It shouldn't be too bad though, and I'll look into this after the next 32bit release. The network side of the x64 build interests me because I don't think there are any real 64bit app firewalls (are you aware of any?).

 

No, all the firewalls I know of that run on 64bit are still actually 32bit applications. Some 32bit firewalls won't even run on xp 64 without an ungodly number of errors. I'm not certain about what security holes this opens up, and it seems less of an issue than say Anti-Virus software being 32bit, but I'm sure the extra 32 bits does open new network holes and running a 32bit firewall is obviously a sub-optimal solution.

 

As long as the driver (the part that does the actual work) is 64-bit, it should make little difference if the GUI and other non-critical parts still use 32-bit code.

For firewalls though, Vista complicates things further since it has a completely new network subsystem (which among other things requires firewalls to offer IPv6 support).

 

Is it me or I remember something about a MutexDefend in the ressources of the first appdefend releases ?

Now that alerts make me wonder ...
How can you associate a Mutex with a worm ?
Is this the start of a signature based protection in GSS ?
Or it's only a general thecnique that is associated with that partcular worm ?

 

@ f3x: Your not wrong, I also remember MutexDefend as well, I'm sure Jason did mention it in some thread or other here, I forgot when.....oh wait I found it, here is the thread, I ask Jason about MD in post #6 , and Jason explains it in post #7

https://www.wilderssecurity.com/showthread.php?t=103938&highlight=mutexdefend

I hope this helps f3x

Fluffy

 

Thank you !

Searching for the word Mutex in GS Forum only resulted in post made by me about it so it was only a self-coherent reality .. which leave me thinking a bit.

Now i just learned that the search function if for whole word only ... great


Not everyday we see a girl playing with resource editor, security software and image modeling, glad i know ya (ok now this is coming of topic)

 

Wow.....thanks for the compliment f3x , I guess a part of it is I'm a control freak in a way, I peek and poke around, so naturally when I install something on my system, I learn all I can about it, so a resource editor is a good friend indeed to me, through sometimes I cant help modding a resource or two.....hehe, hmmm I wonder what happened to that ghostwall banner I made, I think I have lost it

I wonder if Jason would mind me modding AD & RD banners...hehe....I have thought about it, I have a nice idea for one, through my dyspraxia makes it hard for me to get ideas out of my head on to paper or a screen , maybe I will give it a whirl

Hugs to f3x (and Jason)

Fluffy

PS. Maybe we all should create some nice art work for Jason, I mean banners and wallpaper kinda thing, just a thought

 

Yes it was going to be a separate type product at the beginning, but it kind of fits into AppDefend nicely in a way. It isn't heuristic based yet, so it's only helpful for spotting known viruses, worms, etc. At the moment anyone can edit the file which has the list of known bad mutex's which you can grab off the internet or from known viruses, etc.

 

Is this safe to install or should we wait?

 

Didn't experience problems with it, but as always it's best to take your precautions prior to installing this alpha/beta.
Better safe then sorry.