AppGuard 3.x 32/64 Bit

Win7x64
I reported a similar issue when using the 64 bit versions of WMP, IE and Waterfox where audio is blocked. A Windows message pops up saying '... cannot play the file because there is a problem with your sound device...'

Unguarding the program or setting Appguard to 'Off' allows the program to function as expected. The 32 bit versions are unaffected.

Has this bug been reproduced by the developers and will a fix be available in the coming release?

thanks

 

Is this issue present in all protection levels of AppGuard? May have asked before but in the next release, is it possible to have the option to turn MBR guard off with initial install? MBR guard for me is a potential to a not so safe uninstall of Comodo Time Machine or update of the baseline. Also it prevents WEI from completing which is not a big deal to me. Windows System Image will not work either but I haven't come to a final decision as to whether it's CTM, AppGuard or a combo of both being installed. I haven't finished testing all scenarios yet.

 

@Barb_C,
In the next release is there any new features,options,enhancements,etc....besides bug fixes?
Bug fixes are good, just wondering if there will be anything new to look for.

 

Hi LoneWolf:

I'm quoting Barb's post [# 723 of this thread] outlining the bug fixes and improvements we should expect to see for the next release of AppGuard:

https://www.wilderssecurity.com/showpost.php?p=2014836&postcount=773




Kindly regards,



Carlos

 

Thank you Carlos.

 

Who are we sending bug reports to now. I can no longer use AG on XP Pro x 32 with the latest build of Online Armor Firewall. I get a BSOD before even making it to the desktop. It happens even before I make it to the login screen. BlueScreen View points to brnfilelock.sys as being the cause. To whom, and to what address?

 

Hi,

Barb_C has suggested to send any bugs reports, BSODs reports or else to BlueRidge developers' e-mail address:

It is: AppGuard@BlueRidgeNetworks.com




Thanks,




Carlos

 

Thanks Zyrtec! I think that is the same address I was sending them to before during the last beta phase.

 

Also, I highly suggest that Blue Ridge Networks gives an option for the user to define exceptions for other programs on their machine that may cause conflict with AG at the end of the installation. At the present time exceptions can only be defined after rebooting the machine. Its just too late then if you have conflicting security applications installed on your machine. I've always had to install AG, and then Online Armor. If I do it the other way around then I always would get a BSOD. The reason being I would have to leave AG disabled until I could set exceptions for Online Armor. Online Armor on the other hand allows the user to set exceptions as soon as the installation is complete. So you don't have to wait until you reboot the machine.

 

AG also currently has a conflict with Webroot Secure Anywhere. It blocks it from updating, and disables the program altogether each time WSA makes an attempt to update. Its very easy to reproduce since I have the same exact problem on all 5 workstations I have WSA installed on. I noticed also in AG logs that AG blocks WSA from writing to the registry. I've tried every exception available in AG, but none of them have worked. Maybe some sort of registry exception option is needed. Even if AG was not blocking WSA from writing to the registry it would still block WSA from updating due to it blocking WSA from writing to the .exe in C:/ programs webroot. Setting exceptions don't seem to help this. I have Webroot also defined as a trusted publisher with the following settings: Guarded: no, Privacy: no, Memory: no, install: allow.

 

This may be specific to your system configuration because I don't have this problem. That doesn't make it any less annoying for you though. WSA updates itself automatically on my system with the AppGuard protection level set to High without a problem. There is no intrinsic reason why AppGuard should block WSA from writing to the C: drive in order to update itself as WSA is not a guarded application.

I have my own conflict between WSA and AppGuard whereby my system hangs at the shutdown screen when restarting if both are installed. If either application is installed without the other, the problem doesn't occur. Again this appears to be specific to my system configuration because there have only been one or two reports of this problem by other users (also on Windows XP) of both applications.

I think a lot of these kind of conflicts fall under the YMMV category, which can make it quite difficult for software developers to debug, given the large number of hardware/software system configurations that they have to try to be compatible with. I'm sure that BRN will do their best to solve our respective issues though.

Are all 5 of your workstations running Windows 7 because I'm on Windows XP, so maybe that's the difference?

 

Pegr, I have Windows 7 X64 Ultimate on 3 workstations, and Windows XP Pro X32 on 2 workstations. If i'm understanding you correctly then I have the same issue that you have where the system hangs at shutdown on XP Pro X32. I have had this problem since WSA was in beta stage. When I choose the shut windows down WSA fails to terminate so windows is unable to continue to shut down. I have to manually terminate WSA before windows can finish shutting down. I'm not sure AG is causing this, but its peculiar that you have the same problem since we both are using AG & WSA together on windows XP. I thought maybe it was just a problem with WSA itself. It may warrant further investigation.

 

That's a great idea. We won't be able to get that into the upcoming release, but perhaps the next one.

 

AppGuard@BlueRidgeNetworks.com

 

The Windows shutdown issue I'm referring to is where WSA and AppGuard appear to terminate but then Windows hangs when the "Windows is shutting down" screen appears and the power on/off button has to be used to restart the machine. There are definitely some compatibility issues running WSA and AppGuard together on Windows XP.

Regarding WSA not updating automatically: Given that two of your workstations have Windows XP, I wonder if there may also be some other factor involved as WSA does update automatically on my Windows XP system with AppGuard protection set to High. As you say, it may warrant further investigation.

 

The option to define exceptions could actually be during the installation process at any time up until the end of the installation as long as it is before the user reboots the machine. It just can't be after AG protection enables itself.

 

We're very close to releasing the Beta. Please email AppGuard@BlueRidgeNetworks.com with an "official" request to be a beta tester and I will respond with the download link as soon as it is live (perhaps later tonight, but most likely tomorrow morning). THANKS!

 

Thanks to everyone that responded about the beta!

Cutting_Edge had some great questions about power apps. I'm going to update the release notes, but in the meantime, I thought that I would post the questions/answers here as well:

1. If I add an application to Powerapps then do I still need to add it to the memory guard exception list if I want to allow that application to read, and write to the memory? You do not need to add power applications to the memory guard exception list (but I don’t think it will hurt – power apps will take precedence).

2. Does adding an application to Powerapps grant that application full memory, and registry access? Any OS restrictions on Power Applications will still apply (AppGuard does not instill the application with special powers except relative to AppGuard policy). Power Apps are not Guarded so AppGuard will not block registry access (but the OS still might). Normally applications that are launched by a Guarded application inherit the AppGuard policy from the parent process so if its parent (or grandparent, etc.) is Guarded then it will also be Guarded. A Power App does not inherit its parent’s AppGuard policy so they are never Guarded no matter how they are invoked.

3. What is the difference in adding an application to the trusted publishers list with the following settings: Guarded: No, Privacy: No, Memory: No Install: Yes VS adding the application to the Powerapps tab? I'm speaking in the amount of privileges the two different features grants an application in the above example with the above trusted publishers settings I just defined. First of all, the trusted publisher policy is applied to user-space applications only, while Powerapps can reside anywhere. Also, an application published by the trusted publisher (with the above policy) cannot read/write to other MemoryGuarded Applications (even though the trusted publisher application is not being MemoryGuarded) whereas a power application is able to read/write to the memory of other Guarded applications.

 

Barb, got it thanks. How do you want bugs reported?

When adding multiple (one at a time works) power apps the gui is freezing also service stopped and needed reboot after adding licence key so far.

On the up side power apps fixed my SBIE issue discussed in this thread https://www.wilderssecurity.com/showthread.php?t=310812

Thanks

Edit: In lock down mode some desktop shortcuts don't work. Win 7 x64.

 

We are getting ready to launch an AppGuard specific web site and we hope to have these types of instructions on that site (yes it would be cooler to be able to automatically configure for those products, but baby steps...).

Anyway, if anyone has any specific settings that they've come across, it would be great if you could email them to me at AppGuard@BlueRidgeNetworks.com and I will get them to our web master (do people still use that term? - guess I'm showing my age) so that they can be incorporated.

 

Thanks for the feedback!

Reporting bugs to AppGuard@BlueRidgeNetworks.com would be best. Good find BTW.

I'm glad power apps fixed your SBIE issue. That's what we were hoping for.

If the desktop shortcuts are linked to executables in System Space (i.e. c:\windows or c:\program files) then they should launch, but if they are linked to User Space apps, then they are not launching by design (in locked down mode everything is blocked from launching from user-space). If you are seeing system-space launch blocks, please send us any AppGuard blocking messages. Launching blocks should still be reported to the AppGuard GUI in this build. If they aren't set the Alerts to All and recreate the issue and see what messages you get in the AppGuard GUI.

 

Just wanted to say that I will be travelling over the weekend. I hope to log in periodically to handle AppGuard beta questions and issues, but the best bet is to email AppGuard@BlueRidgeNetworks.com.

 

Brilliant, will do. No blocking messages at all so far, will change settings to see i I can get them, but reboot resolved it. The apps were in program files.

Cheers

 

Chris what did you do to get sandboxie working on the new beta?