AppGuard 3.x 32/64 Bit

Discussion in 'other anti-malware software' started by shadek, Mar 12, 2011.

Thread Status:
Not open for further replies.
  1. Arcanez

    Arcanez Registered Member

    Joined:
    Oct 5, 2011
    Posts:
    417
    Location:
    Event Horizon
    I added C:\Sandboxie to User Space so that Appguard has control over sandboxed objects. I don't know if it's really necessary to add it to User Space but I guess it's just an old Habit.

    I don't think you have to adjust any Settings to make both applications work together.

    BTW: In the User space tab there is still the old description form Version 3.x including it's security Levels like "High" which doesn't exist in Version 4.0

    Quote: "To Block such attacks, Appguard either auto-guards executables (Medium/High)....."

    Also the "Show Desktop Icon" in the User space tab is from the Windows xp era. Maybe you want to replace it with one that fits the new modern style of Appguard 4.0 better. :)
     
  2. SLE

    SLE Registered Member

    Joined:
    Jun 30, 2011
    Posts:
    361
    First short feedback from v4 beta.

    system: Win8x64

    (1) Installation
    ...tried install on top of 3.5. No problems, all settings were adopted.
    ...tried also clean install. No problems. (Why still a MBR guard folder is created in install dir?)

    (2) Sandboxie
    ...works without the previously needed memguard exceptions - no extra settings needed.
    (Moved my test-sandbox folders to systemspace, so that appguard let's me start and try apps installed inside this sandbox. But that's a special case and not necessary for average user)

    (3) Other functional issues

    ...found none so far.

    (4) GUI bugs
    ...I leave some out, which are mentioned in earlier posts.

    tray:
    Sometimes old tray-icon appears (while suspension of protection). In release notes the new icon is shown
    http://abload.de/img/ag135j4o.jpg

    overview page:
    - Some unneeded space in description of locked down level.
    - Allign activity button to center.
    http://abload.de/img/ag24xk0q.jpg

    customize - alerts tab:
    - allignment of "clear all" button (should be in line with other buttons)
    - allignment of "help" button/link. (As mentioned in another post, that differs from tab to tab which is confusing. I suggest a fixed and the same position in every tab and window - bottom left or bottom right)
    http://abload.de/img/ag3cukgr.jpg


    customize - user space tab:
    - still old description of v.3.5 (with levels that don't exist any longer)
    - old xp-style icons that don't fits well to the more modern rest of the graphics
    http://abload.de/img/ag46xjoi.jpg

    customize - advanced tab:
    - suspension timeout. I miss the option to en/disable it like in v 3.5.

    (5) Usuablility issues:

    - Don't like the fact that no other appguard window can be opened if activity report is open. It would be helpfull if that would be possible, cause than you can read block messages and create exceptions/rules etc. in configuration windows at the same time.

    - I like to emphasize that I support most of Kees' suggestions from a usuablity point of view.

    In special: rename "advanced" button to "customize", rename "power apps" to "excluded apps". Both makes IMHO much sense and better descripes the function.
     
    Last edited: Oct 6, 2013
  3. Arcanez

    Arcanez Registered Member

    Joined:
    Oct 5, 2011
    Posts:
    417
    Location:
    Event Horizon
    you can hardly see anything on the Pictures because they are way too small.
     
  4. SLE

    SLE Registered Member

    Joined:
    Jun 30, 2011
    Posts:
    361
    Thx! :thumb: Corrected the links.
     
  5. Barb_C

    Barb_C Developer

    Joined:
    Jan 7, 2011
    Posts:
    1,234
    Location:
    Virginia
    It's not just you. There's a bug.
     
  6. Barb_C

    Barb_C Developer

    Joined:
    Jan 7, 2011
    Posts:
    1,234
    Location:
    Virginia
    The beta license is for 1 PC.
     
  7. Barb_C

    Barb_C Developer

    Joined:
    Jan 7, 2011
    Posts:
    1,234
    Location:
    Virginia
    What is the OS you're seeing this on? It looks fine on my PC.
     
  8. Barb_C

    Barb_C Developer

    Joined:
    Jan 7, 2011
    Posts:
    1,234
    Location:
    Virginia
    I'm confident that they will.
     
  9. Barb_C

    Barb_C Developer

    Joined:
    Jan 7, 2011
    Posts:
    1,234
    Location:
    Virginia
    Yes. I'm sorry that I hadn't mentioned it as a known "issue". The help is the last item to be updated - after the GUI is finalized.
     
  10. smith2006

    smith2006 Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    808
    I am using Windows 7 SP1
     
    Last edited: Oct 6, 2013
  11. smith2006

    smith2006 Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    808
    Another bug?

    Tray Icon changes to old style icon when right click, select items under "Allow USB Launches", "Allow User-space Launches" , "Guarded Execution" & "Privacy Mode"
     

    Attached Files:

    Last edited: Oct 6, 2013
  12. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Additional Update

    I went back did a complete uninstall of 3.5.6, so I could do a fresh install and see 4.0 as a new user would. Generally no problems.

    (running on Win 7 X64 in lockdown mode)

    I am still seeing the licensing box pop up on each reboot, although just clicking the Exit, lets things continue, and Appguard does appear to be working.


    1) Sandboxie: Setting the folder c:\sandbox as a user folder is essential. Wouldn't work otherwise.

    Barb why not just set the folder in the list by default. If Sandboxie isn't there it shouldn't matter, and that way a new user won't have to fool with it.

    2) I am seeing quite a few read/write blocks. Many are probably not critical, but with Adobe Acrobat(not the reader) one is fatal. If Acrobat can't access Program Files(X86)/common files/adobe it generates a fatal error to reinstall and shuts down. Before read/write exceptions seemed to work, but this time I had to make that specific folder a user folder.

    Overall working well.

    Pete
     
  13. roady

    roady Registered Member

    Joined:
    Mar 27, 2005
    Posts:
    262


    Somewhere in this thread,Barb posted that she will try to get a special discount for early adopters,for those who already bought AppGuard in 2011,I believe.......I'm pretty shure she will honour that statement... :)
     
  14. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Another GUI type bug. I was in lockdown mode and the tray icon was proper with the little black lock. I had the installer on the desktop and was trying to pick it up with a copy, but accidently triggered it's execution.

    Appguard blocked it as it should, but the tray Icon changed to the green check mark for Medium level. Right clicking on the icon showed appguard to be in lockdown mode, but the icon didn't

    Starting firefox triggered a memory read error and the tray icon switched back to the lockdown icon.

    Pete
     
  15. Arcanez

    Arcanez Registered Member

    Joined:
    Oct 5, 2011
    Posts:
    417
    Location:
    Event Horizon
    Already on the to do list I guess
     
  16. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
  17. Seven64

    Seven64 Guest

    Is this a bug or normal?
    It seems AG is blocking itself. o_O
     

    Attached Files:

  18. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    I also am finding in Lockdown, the lack of configuration ability may be a liability. I just had to downgrade from lockdown to medium just to change the time period of my screen saver. That may be a bit much.

    Pete
     
  19. FleischmannTV

    FleischmannTV Registered Member

    Joined:
    Apr 7, 2013
    Posts:
    1,093
    Location:
    Germany
    I have experienced that Sysinternals Process Explorer causes memory guard events even though it is listed as an power application. Those events did not occur in 3.x. Procexp64.exe seems to be a child application of procexp.exe and should inherit power app status. Adding it seperately to power apps did not work as well. Process Hacker on the other hand works just fine.

    processexp.PNG
     
  20. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Barb

    I have a couple of mbr related questions. (all this done in an XP virtual machine)

    First, I did a complete uninstall of 3.56 including removing all the folders in the various area on the system) Did I remove MBRguard??

    assuming I did remove MBRguard, I am a bit puzzled by the results I saw testing with a piece of software called CleanMbr.exe CleanMBR actually asks if you want to proceed and if you did you get an error it failed to clean, but when you reboot, the mbr is indeed clean and system is unbootable. I had this software on the desktop

    Using the 4.0 beta, I first put Appguard in install mode. No surprise cleanmbr was successful in bringing down the system.

    Then I put Appguard in Medium mode.Then I right clicked and used the allow user space option, first guarded, and then unguarded. In both instances cleanmbr crashed and thus failed it's mission.
    I repeated the same test, and the 2nd time the guarded try caused a crash, but the unguarded attempt succeeded, and indeed cleanmbr succeeded in bring down the system.

    Then I repeated again, but this time Appguard was in lockdown mode. When I ran it guarded, cleanmbr crashed and the system was okay. This time I looked in the activity report and indeed there was a blocking event. Appguard had blocked a sys file execution. Lastly I tried it unguarded, and here was the surprise. The system was protected, and not taken down, but this time there was nothing in the activity report. Any explanation??

    Pete

    PS all other security software was disabled.
     
    Last edited: Oct 6, 2013
  21. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hello Barb_C,

    With previous versions prior to 4, I liked being able to double click on the tray icon and the GUI opened to the event logs (now called activity report in version 4). The event log is probably the item I check the most. Now with the event logs/activity report in its own separate GUI, it is not nearly as convenient to access as before. I know you will probably not want the double clicking of the tray icon to open the activity report, but perhaps a right click option to open the activity report directly (currently you have to open the main GUI then open activity reports). Just an idea since, at least in my case, I open activity reports quite a bit more often than the main GUI and it would simplify things and be easier to access.
     
  22. acr1965

    acr1965 Registered Member

    Joined:
    Oct 12, 2006
    Posts:
    4,995
    Still running version 3 and had a question. I've decided to use the medium level of protection. In medium, are there any specific vulnerabilities I should be made aware of if I am not installing anything? Just surfing the internet, reading pdf's and watching videos.

    Also, are there any known conflicting antivirus programs should I decide to install one later to run alongside Appguard?
     
  23. Brandonn2010

    Brandonn2010 Registered Member

    Joined:
    Jan 10, 2011
    Posts:
    1,854
    It is a little hard to tell what AppGuard is set to with the tray icon. Not too bad for me, but I could see people with worse eyesight having problems. Maybe instead of having a little icon on the tray icon to tell what it is, it should just be the AppGuard logo, but the orb is black for Locked Down, green for Medium, and yellow/orange for Install. The main AG logo could still be blue.
     

    Attached Files:

    • ag.png
      ag.png
      File size:
      72.1 KB
      Views:
      208
  24. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    5,694
    Location:
    USA
    I would use the blue for locked down. Gray reminds me of a color to indicate an application is disabled.
     
  25. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hello Barb_C,

    No issues at all. I have not needed any memory guard exceptions.
    So far I have not needed to set any apps as power applications.
    I have not had any needing to update so far but will post back if I have any issues.
    Windows 8 Pro x64

    I think you have the makings of a winner here that should appeal more to the average user now. For me at least, back when I first started using AG, it took me quite a bit to learn it. You have definitely taken a lot out of the learning curve. This new version would have been so much easier to learn for me and I think it should help increase your user base. I know that I will be more comfortable recommending it to colleagues.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.