AppGuard 4.x 32/64 Bit - Releases

An export / import feature has been requested, but settings are stored in C:\Users\xxxx\AppData\Roaming\blue ridge networks\appguard\appguardpolicy.xml and currently one has to copy this file.

 

There's actually (2) xmls:

One for all users stored in ProgramData and one for the current user stored in AppData\Roaming.

 

Perfect, thank you

 

There's a virus called ALisp/Bursted which infects AutoCAD files, more info here:
http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Virus:ALisp/Bursted

How can I config AppGuard to deal with it?

 

lsp files are run by AutoLISP which I would suppose means they contain executable code.

That being said, those files - based upon the Microsoft launch from User Space - so they do so Guarded. However, there is so little infos provided by MS about the infection and what the malicious *.lsp actually does on the system.

You can even add AutoCAD to Guarded Apps, but that might cause something to not work properly - it depends on whether or not it tries to access protected System Space and registry resources.

I'm almost certain that prevention of loading of *.lsp files is not anywhere on any security soft vendor's radar...

I think it is rare infection and therefore highly unlikely.

I will ask BRN though anyways...

 

Thanks for your help mate.

 

@Mister X

• Add AutoCAD to Guarded Apps; there should be no breakage as long as AutoCAD does not try to access protected resources
  
• BRN has on their TO DO list to look into making *.lsp files Guarded when executed by AutoCAD installed in System Space (so the user does not explicitly have to add AutoCAD to Guarded Apps list)

 

Fine. Thanks a lot.

 

@hjlbx May I ask what you are referring to with AppGuard Enterprise in your sig? Is that 4.4.6.1, 5.x or another version?

 

It is Enterprise version 5.0.5.0.

 

wonder if Tech Fortress users Customize.....

 

AOL clients. I doubt very many do.

 

AOL clients may run default n' Protected. Be interesting to see BRN Customize for Enterprise/Business.

 

I am running AGE = AppGuard Enterprise. There is a default policy that can be tweaked the same as AppGuard Professional (4.X), Personal (5.X) and TechFortress.

Actually all the policies are quite similar. In AGE all User Space applications are launched with Privacy (ON) - that's one of the main differences.

 

But with AG they are running in Privacy Mode too

• Protected: Allows all digitally signed applications in user space to run. These applications will be Guarded, MemoryGuarded and run in Privacy Mode

 

In AGE there is very slight difference in policies.

AGE = AG with online management console; everything has to be configured, tweaks, pushed and enabled in the online management console instead of locally.

That's the most meaningful real difference for the user...

 

@hjlbx why did you shift to enterprise version?

 

I was asked by BRN to bug hunt for next AGE build\version release.

So, in short, I was given a toy and now I'm breaking it.

 

LOL , ok i see. i hope they pay you

 

I've been away from AppGuard for two years (to be fair I've been away from this forum more or less too)
I have three questions which are not clear to me;

1) Is AppGuard 4.x 100% working with Windows 10 Anniversary Update?
1) Is my license for AppGuard 4 valid for AppGuard 5?
2) And is AppGuard 5 working 100% with Windows 10 Anniversary Update now?

Regards,

shadek

 

1. Yes. I'm running AG now on Win 10 AU.
2. No. If you have AG 4 license, might as well just use that. No need to "upgrade" to AG 5, as they are just basically the same under the hood.
3. I don't know.

 

Thank you!

The reason for question 1 is that @Windows_Security posted here that version 4 will be rendered useless in Windows 10 after AU. I'm getting a bit confused as to if AppGuard 4 really works 100% on Windows 10. It might run and seemingly to work, but does it work properly under the hood?

 

If I understood it correctly, I think they were concerned with next year's implementation of MS about signing. And if I read it correctly, AppGuard should work now, but not when MS implements new signing requirement, which is different from the signing requirement of the Anniversary Update.

Nevertheless, AppGuard is installed and running fine on my laptop. No problems arose. But, under the hood, I don't know.


Edit: Gotcha!
https://www.wilderssecurity.com/threads/appguard-4-x-32-64-bit.355206/page-230#post-2604630

 

Yes. AG Professional - which is version 4.X - works on Windows 10 AU.

BRN is aware of the digital certificate and its expiration on Feb 17, 2016; there is a plan in place to update the cert.

You can download the most recent installer for version 4.4.6.1. If your key does not activate it, then send an activation request to support@appgaurd.com.

 

Wow! Nice! Hopefully we'll get alerted with an update of AppGuard before the new policy is applied to Windows 10. Thanks for finding this!