AppGuard 3.x 32/64 Bit

I checked the Microsoft East Asian Language Input with "Locked Down" Protection Level enabled. I was not able too switch from English Input to Korean Input. When I changed back to "Full" Protection Level I am able to switch from English Input to Korean Input.

 

I'm glad you figured it out. You can remove the Sandboxie applications from the MemoryGuard exception list. By virtue of being a power application they are also MG exceptions.

 

LOL,Thanks barb I have a lot to look forward to then.

 

Removed sandboxierpcss.exe, sandboxiedcomlaunch.exe and sandboxiecrypto.exe from MemoryGuard.

Added SbieCtrl.exe to PowerApps

This is what happened.

 

I see the AppGuard alerts, but did it cause any operational errors with Firefox?

 

None. I'm using Firefox now and it's running smooth. No bugs, glitches, errors and the like
Will report back if I find any.

 

I have discovered what appears to be a couple of bugs with Privacy Mode when the protection level is set to Locked Down.

One of the features of the Locked Down protection level is that Privacy Mode applies to all guarded applications in the guarded applications list, irrespective of whether the Privacy Mode flags are individually set to Yes or No in the guarded applications list. The Locked Down protection level overrides the user configuration.

The first bug is that the right-click option from the system tray icon to suspend Privacy Mode for a guarded application only works if the Privacy Mode flag is set to Yes in the guarded applications list; if the Privacy Mode flag is set to No, the option to suspend Privacy Mode for a guarded application in the list doesn't work.

The second bug is that after Privacy Mode has successfully been suspended for a guarded application that had the Privacy Mode flag set to Yes, Privacy Mode operation subsequently reverts to "As configured" for all applications in the guarded applications list - applying the individual Privacy Mode flag settings - which is inconsistent behaviour.

Apart from the above mentioned bugs, forcing Privacy Mode to apply to all guarded applications, irrespective of the Privacy Mode flag settings, can lead to undesirable outcomes. I'll give an example to illustrate the point.

I have the whole of the My Documents folder set as a Private Folder. The only application that I am really concerned about from the privacy aspect is the browser, which has the Privacy Mode flag set to Yes. All the other guarded applications have the Privacy Mode flag set to No.

At the High protection level this enables the music folder, which is a subfolder within My Documents, to be accessed by iTunes (a guarded application with Privacy Mode set to No) but not by the browser (a guarded application with Privacy Mode set to Yes). This was the desired outcome and the reason for the configuration.

At the Locked Down protection level iTunes won't launch because it can't find the music library. Either the music folder has to be removed as a Private Folder, making it accessible to the browser; or iTunes has to be removed from the guarded applications list. Neither option results in the desired outcome.

Bugs aside, I wish that Privacy Mode always worked "As configured" at the Locked Down protection level. IMO Privacy Mode should operate in accordance with user configuration, independently from the protection level.

 

Thanks for the feedback, PEGR. We'll take your suggestions into consideration for the next release.

 

Shame there isnt a free version.

 

a question here
i am running Avira premium and OA premium
If i install AG can i just turn off avira real time and use AG and OA real time?

 

Thanks Barb.

 

Hi Barb_C,

Any update as to the status of this?

 

I want to run accessories>command prompt > scannow.

...but AG is blocking it. What is the correct way to get around this? Invoke "install protection level" or adjust via 'customize'?

 

@Aalf
* Right click the tray icon and select "Allow User-space Launches" > "Guarded"
* Once launched, right click and "Disable User-space launch"

HTH

 

Here's the log. I disabled, opened Comprompt, wrote command and hit enterto start scan - then I went to AG & did as per above.

10/20/12 18:45:39 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\temp\sfcsqm_14417920.sqm>.
10/20/12 18:45:39 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\setuperr.log>.
10/20/12 18:45:39 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\setupact.log>.
10/20/12 18:45:39 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\temp\coinlog.log>.
10/20/12 18:45:38 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\system32\driverstore\infcache.2>.
10/20/12 18:45:38 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\system32\driverstore\infcache.1>.
10/20/12 18:45:38 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\system32\driverstore\infcache.0>.
10/20/12 18:45:38 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\system32\driverstore\drvindex.dat>.
10/20/12 18:45:38 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\system32\driverstore\infstrng.dat>.
10/20/12 18:45:38 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\system32\driverstore\infstor.dat>.
10/20/12 18:45:38 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\system32\driverstore\infpub.dat>.
10/20/12 18:45:38 Prevented process <System Integrity Check and Repair> from writing to <c:\windows\inf\setupapi.app.log>.
10/20/12 18:34:23 User-space Protection is enabled.
10/20/12 18:32:39 User-space Protection was suspended.

Considering the log, was the scan genuine or false??

 

What operating system are you using? On windows 7 x64, nothing is blocked when I follow my previous directions.

 

Win 7 x64. As per my siggy. Maybe User-space protection suspension for a launch is only good for 10 minutes?? (see time on log?)

 

Yes, it respects the global setting 'Suspension timeout value' which by default is 10 mins but can be changed if you need it to be longer (or shorter) by simply typing in the figure you want on the AppGuard GUI and clicking apply.

 

User space suspension doesn't apply in this case as the protection was manually re-enabled after SFC was launched.
Around 11 minutes would be the time for SFC to run on a machine of similar specs to mine.

Unfortunately I'm unable to reproduce any blocking messages in locked down mode.

You could always have a look at the CBS.log located in Windir\logs\CBS. You'll need to copy the log to user space to view it, or use an elevated instance of Notepad and then navigate to the log.

Did the command prompt window notify you of any problems with file integrity after SFC finished running?

 

Maybe I'm just too simple, but why not turn the protection level to OFF? You know that this is a safe application as you are the one initiating it, so there is no risk.

That being said, I have found that even the OFF setting still effects the machine. On my W7 x64 SP1 machine, I can not rerun the Windows Experience Index with AG installed, even when set to OFF.

 

In the past, this was/is due to the MBR guard protection. Disable it, reboot and you should be able to run WEI

 

Does the same apply to guarded apps?

 

Can anyone advise how to configure AG to work together with EMET?

 

Nothing to configure, it just works ;-)

 

Is this something to ignore or is action required?