AppGuard 3.x 32/64 Bit

You're welcome.

 

Hi!
And how about this nasty Blackhole exploit that nearly bypassed AG? Any news from devs?

 

I suggest you watch the 'retest' https://www.wilderssecurity.com/showpost.php?p=2140391&postcount=1828
A reboot saw absolutely no bypass

 

I have seen "retest", but anyways I would like to know how was this possible.

 

I mistakenly sent the wrong link to the developers so they have not weighed in on it yet. I just sent them the correct one.

From what I can tell, AppGuard did its job. Most likely the dll in question was loaded in IE's context so it was being Guarded by AppGuard so it could not become persistent on the system.

The video also shows that the AppGuardGUI executable was stopped. Since the GUI component does not apply the AppGuard protection, AppGuard's protection is not compromised.

When I hear back from the developers I will provide more information.

 

OK. Thanks a lot Barb!

 

That's my fear.

Buy now a 3.x license and in 2 or 3 months 4.x license will be launched and i will need to buy it again.

 

Not true. For the full statement on licensing, see the link in post #1850 on page 74 of this thread.

 

pegr I am not a buddy of yours so I could not send a pm

I use appguard and like it. Today for the first time I tried to use my usb stick. I could not access any of the portable programs on the stick until I turned appguard to "install" or "off". Can you tell me what settings I need to change to make everything compatible?
Thanks

 

AppGuard automatically prevents USB launches by default. You can't permanently turn this feature off - nor should you want to - but you can temporarily override it without lowering the AppGuard protection level. The procedure is described in the page of the help file that deals with AppGuard Status => AppGuard Tray Icon, reproduced below.

"When right-clicking on the tray icon, a menu will be displayed with the following options:

• AppGuard...: Displays the AppGuard User Interface
  [*]Protection Level: This option allows the Protection Level to be changed.
• Allow USB Launches: This option will suspend or enable guarded execution of an application or script from USB memory devices.
• Allow User-space Launches: This option will suspend or enable guarded execution of an application or script from user-Space.
• Guarded Execution: This option will quickly suspend or enable Guarded Execution for an active Guard List Application.
• Privacy Mode: This option will quickly suspend or enable privacy mode for a specific application.
• Help: Displays the AppGuard Help facility.
• About..: Displays information about the AppGuard application. You can also activate the AppGuard license using this menu option.
• Exit (GUI): Exits the AppGuard GUI application. The AppGuard service continues to protect your system, but GUI alerts and notifications are suppressed."

It's worth reading through the help file to get a good understanding of how AppGuard works.

Kind regards

 

I did read help before I asked but couldnt figure it out.
Also because I thought I needed to put it on "install" the USB reference didnt show up in the right click.

So I can get the USB stick to operate normally but I dont understand something.
If I set "Allow USB Launches Unguarded" the programs on the stick will not work.
Then I put the above back to guarded and set "Disable User Space Launch" then the USB stick software works correctly.


Thanks for the direction.

 

Hi silat,

I've been experimenting with this myself. "Allow USB Launches Unguarded" does work for me so not sure why it doesn't work for you. I think we're going to have to wait for Barb to comment on that one.

"Allow User-space Launches" will also allow USB stick software to run because USB sticks form part of user space. "Allow USB Launches" is more restrictive though because it will only allow software to run from USB sticks, and not from other parts of user space.

Kind regards

 

Perhaps the USB programs are trying to launch other exe's from user-space? Anyway, if you send the AppGuard blocking events you are seeing when your USB programs aren't working to AppGuard@BlueRidgeNetworks.com, we will take a look and see what is going on.

 

Hello Barb. I am thinking of loading a Windows image I have that was made right after installing Windows. I was wondering though if activating AppGuard again with the key Jmonge gave me would take away one of his installations?

 

it is ok man i have 32 licences

 

That's generous but I don't want to suck a license every time I reinstall, not that that happens often.

 

no worries man

 

It would fit you to have 32 computers

 

or 96, 1 license for 3 PC

 

Holy smoke!

 

Well, there are collectors for all kinds of things. I got to say, it's the first time I see someone mentioning so many licenses for a software.

 

I got a simple question here cause this is getting annoying:

Does Appguard break Applocker?

I have a clean Windows 8 Pro here with Appguard installed and I just wanted to see if Applocker works correctly. I created executable rules automatically for C:\Program Files as well as Script Rules. I enforced the rules and made sure the Application Identity Service was turned on. Then I made a gpupdate.exe /force and tested Applocker.

It just doesn't do anything. I can still run programs from D:\ drive although I only created rules for C:\Program Files. I just don't get it. For me it didn't work on Windows 7 as well.

Is Applocker just a Piece of crap or am I to dumb to set it up, which I highly doubt...

I really Need an answer to that cause I it's getting annoying... I played around with Applocker so many times and never ever got it to work....I don't get it, seriously ......

 

You can create AppLocker rules on Win 8 Pro but they don't actually work. Check the event viewer for error message 'need Enterprise SKU' or something if I remember right. Need to be on Enterprise editions it seems.

This Blog entry gives Enterprise only features which includes Applocker http://blogs.windows.com/windows/b/...e-assurance-for-today-s-modern-workforce.aspx

Why it lets you set them up?................Who knows.

Cheers

 

OMG, you're correct. I just looked at the even Viewer and it says SKU not available ... You can set it up for no reason making you think you're protected although you're not. Well that's just dumb, Microsoft...

Didn't even work on my Win7 Ultimate ...That's a fail @ Microsoft...

 

Barb I sent the email a few days ago.