The unofficial Shadow Defender Support Thread.

You're welcome, Tom.

Best wishes
pegr

 

Fwiw, I haven't found a noticeable performance difference between using disk or RAM for SD's write cache. As I see it, the main benefit of using RAM is that it is volatile so the cache's contents are wiped permanently after each restart (for those who are concerned about such matters). Then again, having lots of memory is always a good thing.

All of the above is excellent advice!

TS

 

Happy as always to continue to report back in this Thread that Shadow Defender is performing as insanely flawless as it always has on my machine. Not even a darn hiccup. This one almost certainly has to go down in the annals of Windows history as the most enduring and effective LV ever conceived and developed! Have a great weekend everyone!

 

Agree with that Easter. SD is certainly in the same vein as FDISR as regards being a superbly written piece of software. Astonishingly reliable, and fuss free.

 

It's nice to see you back Easter Yes, I have been using the latest version heavily on my pc XP sp3 32bit and it's great. Yes, what a piece of software.

 

I'm jumping on this bandwagon to add my praise of SD 1.4.0.519, but imho we should all thank Wendi for first suggesting track0 virtualization and The Shadow for requesting Tony to also virtualize non-lettered boot volumes at the same time.

 

I am using Kaspersky and would like to try the new version of Shadow Defender
Anyone using Kaspersky along? Having any problem? Except for Kaspersky folders any thing else needs to be excluded?

 

ginzon,

There's no reason to exclude Kaspersky files/folders - just let Kaspersky download/install updates in and out of shadow mode.

TS

 

Oh no I understand that SD doesn't protect against keyloggers that are installed. So if I have a keylogger, my passwords are not safe. I am only referring to traces left after reboot. And my pagefile is in the default, wherever that is on C drive for Windows 7 so I guess my data is safe. Thanks for your reply! Caspian

 

Ahh...! You mean download the same updates again n again n again?

 

I think what The Shadow meant is that it is less of a problem than configuring exclusions if you just allow the anti-virus to 'do it's thing' in or out of Shadow Mode and when you are not in Shadow Mode (if it's on automatic definitions update) the anti-virus will catch up on itself anyway. So you benefit from the update within Shadow Mode even if in Shadow Mode for days and then when you revert to normal mode, it not a big thing for the anti-virus to update itself and if you've gone into Shadow Mode without a virus, you'll come out of Shadow Mode without a virus, so no danger.

I personally prefer to just update my anti-virus manually when out of Shadow Mode.

 

Depending on the anti-virus, excluding folders may not be enough for auto-updating to work. It didn't work with ESET when I last tried it, and with avast!, the situation was even worse. Excluding the avast! folders caused avast! to stop updating (automatically and manually) until avast! was uninstalled and reinstalled. I suspect the reason may have been associated registry updates that were lost on the reboot, causing the AV to become confused because the integrity between the file system and the registry had been broken.

I've never tried it with Kaspersky so excluding folders might work, but the more reliable method that is guaranteed to work is to not make any exclusions for the AV and let it update itself again on the reboot. Unless the Internet is a dialup connection, or is broadband but with limited bandwith, this shouldn't be an issue. As a general guideline, file and folder exclusions are best reserved for user data, not program data, because of the potential for registry related issues.

 

...Exactly (thanks for clarifying my prior reply Patrick).

TS

 

Hello guys, I chose SD because it has the option to record any change in the Ram memory.
This is perfect for me because it provides greater security, in fact shutting down or restarting Pc, the Ram
memory is cleared and everything disappears and so the hdd is not touched!

But how can I be sure that any change to the system is really recorded in Ram memory and not in hdd??

Another thing please: Which version of SD is more stable and works better on a Win7-64bit SP1 system?

Thanks for your help.

 

The "Space Used by SD" entry against each shadowed volume shows the amount of free space on the volume that SD is using for the disk sector write cache. If the write cache is being written to RAM, the amount of free space being used on shadowed volumes should be showing as zero. At least that's my understanding.

The latest version, 1.4.0.519, is the best version to use, unless it is causing a specific issue on your system.

 

For the most part I agree with the above with one exception - usually I will see about 25MB for 'Space Used by SD' even when an ample amount of RAM has been allocated for SD's write cache. I believe this small amount of disk space is for other SD overhead, but I presume only Tony knows that.

TS

 

Thanks for clarifying that.

Presumably, the 'Space Used by SD', albeit a low figure rather than zero, would still provide a way of verifying that the RAM cache really was in use though, which was what Zapco_force wanted to know.

 

Yes, that's the only 'clue' of which I'm aware.

---------------
@Zapco force, I am also running Win7 SP1 x64 and (fwiw) I'm allocating 1.5GB RAM, from a total of 8GB, for SD's 'Write Cache'. By checking 'Space Used by SD' (as pegr suggests) that amount of RAM seems to be ample for everything I typically do in any given day.

TS

 

Thx for the replies..

Well I use a dial up, so its a little bit of an issue here.. Anyways lets see what can be worked out..

 

As you're using dialup, try excluding the Kaspersky folders and see if it works. Excluding folders works with some AVs and not others, so you've got nothing to lose by trying it.

For best chance of success, add all Kaspersky folders (in Program Files and Program Data) to the SD exclusion list. Providing Kaspersky isn't recording definition update version information in the registry, it should work.

 

Thank you very much for explanations.
You are right, setting the "RAM used as write cache" option, the "Space used by SD" entry is equal to 0 (zero)!!
However to be precise, I noticed that at beginning of the "Shadow mode" session the space used by SD is equal to some Mb (20-27)
and after a while it reduces to zero. This is probably the typical way to work of SD.
However I always use the "RAM used as write cache" option because I feel more secure!....and generally I set no less than 4-5Gb of Ram!

I have another question for you:
If during the shadow mode the Pc freezes or crashes, all changes to the system are also eliminated or there is a risk that
remains something....Someone did it happen?

 

That seems excessive - I sure hope you are not 'starving' Windows of RAM.

Whatever happens to a volume in shadow mode is discarded when the system is rebooted; that includes a freeze or crash (and any resulting corruption in the shadowed volume).

TS

 

Yes, Shadow, Tony told me that himself. When Shadow Defender was in it's infancy people attacked their own systems to test it whilst in Shadow Mode trying to do damage (removing system files and dlls etc) and systems survived after re-boot.

 

Well I read a thread at Kaspersky forum, they do store info in registry.. So it won't help me as I am using XP and there is no registry exclusion in XP..

 

Why there is no registry exclusion list for XP