New version information and screenshots

The next version of AppDefend will mark the beginning of its phase into a non alpha/beta state. The addition of virus mutex blocking, proper keylogging detection and module/dll blocking are some of the enhancements since the last beta.

For RegDefend it's an improvement on something which for the most part worked quite well. I have changed the way protections work somewhat in RegDefend, mirroring the AppDefend way of having specific actions and logging for each item - Set Value, Delete Value, Delete Key, Create Key, etc. A registry scan has also been added, which will help in finding malware related registry keys/values, and also help trim the registry.

Both products will feature the earliest graphical interaction with the user that is possible in part due to GhostGUI (a new GUI library) and moving most code into the kernel rather than user mode. There is also some new experimental security options which changes the Microsoft related kernel code to perform some new tricks, basically disabling installed rootkits (and a lot of security products) by taking away their ability to hook. There is some other stuff I won't talk about too much yet for now.

Some of the above a lot here will already be familiar with from my other posts. Below are some screenshots from the new GUI, which is still being heavily modified and doesn't quite have a 100% final look, but it is close. It is done utilizing the same GhostGUI library. Most of the new changes compared to the old GUI are in relation to making it more "explorer" like, editing descriptions, filenames, folders, in place. Making it more simple to look at and edit. And just so people don't ask, what you are seeing here is simply a theme, GhostGUI supports the classic windows look for all the people who love it, and that will be selectable as a built in theme.

http://www.ghostsecurity.com/images/gss_new01.jpg

http://www.ghostsecurity.com/images/gss_new02.jpg

http://www.ghostsecurity.com/images/gss_new03.jpg

And the question of when? Well editing wise, the GUI is already functional, it is simply a matter of tweaking things and adding some other small items. I will be releasing everything (new GUI, new driver, etc) on friday as a beta, with subsequent smaller updates after that until the final is ready.

 

Jason,

Thank you for the progress report, the new shell looks great. Like many others I am eagerly awaiting Friday.

 

Thanks Jason for the update. Hope it stays lightweight. Also, is there going to be default protection for RegDefend (something like Tony Klein's ghost file) so you are protected right out of the box?

 

I don't quite understand what a mutex is, so any explanation of it and how blocking it improves security is welcome.

 

Does this new version have a learning mode?

 

Don't bet on it.

@Jason, looking good. How about password protection, is it implemented, how does it work? (no pop-ups if locked, no gui or editing) Blocks what isn't explicitly allowed?

 

Thanks for the info/screenshots Jason. Will this work with Vista by chance?

 

Nope, but I will be taking a look at that soon after release.

 

The default RegDefend ruleset will be padded out yes, most likely utilizing most of the keys/values found/added by Ghost Security beta testers and users.

And yes it is still very lightweight, I have trimmed AD/RD stuff more than I thought possible in the kernel, and logging now is done with a fixed size internal buffer to minimize memory allocations. The actual GUI is using less resources now than the old one, even though it is a lot more complex with more "stuff" in it. Thanks to GhostGUI gui updates are even batched into single updates resulting in less cpu usage when many things are occurring at once.

To give one example - the new listview was able to sort 400,000 registry values (I dumped the whole registry into it) which totaled about 150MB of data in 5 seconds on my 3.2GHz core2. In a Microsoft type list as soon as you go over something like 20000 items, it's pretty much unusable, let alone sortable. Some may remember sorting logs in older versions of GSS and having it take 60 seconds to respond or something crazy with only a few thousand items in it.

 

Software usually creates a mutex to synchronize themselves, or to know that multiple instances of itself are running. For instance a virus may create a mutex named "lucas1985" , and then at startup it checks to see if that mutex exists or not, if the mutex does exist it thinks it is already running and will exit (usually).

So if you have a list of virus mutexs you can then alert whenever one of them are trying to be created, warning you of a known virus. It's not a perfect way to detect malware because usually the people who create them will change them quite often between versions or allow people to edit the mutex they create. However it's another prong you can use to protect the computer against known threats.

 

Glad to hear it. Thanks Jason for the response.

 

Thanks Jason,

Looking forward to try the beta!

Do I remember correctly that Ghostwall also will be (can be?) integrated in GSS?

 

is this new release working well out of the box on windows 2003 server, particularly on recent DELL laptops.

On those DELL desktops and Laptops I have recently in 1-2 years, I do not know why no releases of GSS working without BSOD repeats except for the 1.100beta release. Hope this new release is stable. Any Jason's input on this. I am going to pay for App/Reg Defend license of uses. Please respond.

Thanks.

 

Great answer, thanks

 

@ Jason: will we still be able to change to a theme that makes GSS look like v1.110 and have the alert in the same style ?

As nice as this new one looks, its to messy and noisey for me, its probably the double lines with the mixture of different fonts styles, text lengths etc....makes the lines/information go all over the place, the status panel on the image gss_new01.jpg is excellant, but the other two images are confusing and might as well be written in klingon

Sorry, forgot to add for some reason image 3 (gss_new03) looks less messy and better then image 2

Can you tone down the colors abit and make the 'Home' menu on image 1 a tad bigger , thanks, apart from that, you doing really great, I can't wait for the next build, sounds a fantastic build for sure

Hugs,
Fluffy

 

I have removed the little networking support I added in one of the alphas from AppDefend, mostly because of the upcoming issue of GhostWall and AppDefend in GSS. Since AD's simplistic approach to being a firewall wasn't really that helpful without network rules + other things.

But yes , GhostWall will make an appearance once the AppDefend/RegDefend versions have gone final.

 

The themes are completely configurable, and even the layout is able to be changed (within certain constraints).

I can understand your viewpoint about it looking a little "messy", but on the other hand this is showing you all the relevant information at a glance now. It's one of those things that after you've spent 5 minutes with it you realize it's a lot better than the way it was as it looks more complex than it actually is. Ideally though you won't need to spend much time in the editors anyhow, that's the direction I am trying to go.

There are still some UI improvements I need to make to the base GhostGUI code, tooltips, better keyboard navigation, and things like this, but it will come in a later version.

 

@ Jason: Thanks for you reply and information, much appreciated, I will look forward to giving it a spin, I think you are on to a winner no matter what you do, your work is always the best to all of us

Hugs,
Fluffy

 

Hi Jason,

Is it (= mutex scan) doing it like TDS-3 was doing many years ago (Memory Mutex Scan)?
(for those not familiar with the old TDS-3, see screenshot here:
https://www.wilderssecurity.com/showpost.php?p=19435&postcount=2 )

 

Good to hear news of another update. However the phrase "will mark the beginning of its phase into a non alpha/beta state" has a disturbingly indeterminate feel to it...

 

Yeh this is also indeterminent And the question of when? Well editing wise, the GUI is already functional, it is simply a matter of tweaking things and adding some other small items. I will be releasing everything (new GUI, new driver, etc) on friday as a beta, with subsequent smaller updates after that until the final is ready.


FRIDAY

 

Similar yeah, except TDS-3 worked from user mode and scanned all active handles as reported by the kernel. AppDefend doesn't actually let the system create the mutex, but it can report it as active to fool the malware.

 

The release has been pushed back a few days due to some RegDefend bugs which popped up and some features I realized said would be completed by next beta which weren't. Thankfully all the bugs found have been quashed (unless new ones are found... ), so it should be coming out within 24 hours as I finish up the features I promised - which will also help with the beta reporting. Apologies all around!

 

Hey Jason, the new GSS looks awesome, well done, been a long coming eh!

Keep in touch,

Rodrigo

 

It's very late here so I'm just going to release the beta here and create a new thread for it when I release the next version in the next few days. If you run into any problems, just boot into safe mode to fix them.

http://www.ghostsecurity.com/downloads/setup_gss1410.exe