AppGuard 4.x 32/64 Bit - Releases

In an email exchange, @Barb_C stated that even in Install Mode AppGuard still blocks some actions = AppGuard protections cannot be completely disabled by entering Install Mode or Exiting AppGuard.

So the above behavior, as I understand it in the context of that email, is expected and not a bug.

To me, it's just another hassle...

 

@Peter2150
Well, I don't want AG policies in control of Sandboxie. I don't want Sandboxie having to ask AG. "May I".
Same as I don't want HMP.A n' CryptoGuard having to ask AG.
I don't want my toys having to ask AG. "May I".
I've got ERP and HMP.A and Sandboxie as settled in old friends.
I can wrap my head around ERP+HMP.A+SBIE.
AG is head scratch.
AG had better behave or else, back to the bench.
How come for example Norton doesn't need Power App status....?

 

They said it also occurs when AG is disabled. I don't think AG should be blocking anything when disabled. I have never experienced this.

 

I've never had anything blocked with protection level set to off..(let alone show up in the AG log after the fact)...on Windows 7 x64. I don't mean to imply there isn't a bug, but if it does exists, I haven't seen it on my end so I won't be much help. While 'install' does retain certain protections, 'Off' = no protections on my end which is as I'd expect things to be.

To suggest that 'BRN' thinks there should be protections in off (eg disabled) mode has me confused. Are you sure you didn't just misunderstand the response? While exiting the GUI makes no change to the 'current' AppGuard protection status, (the gui is only that - a graphical interface) setting the protection level to off should disable everything.

If memory serves me you (someone at least) shared screenshots where AG was set to off and still showed blocks. This certainly implies a bug someplace, but without being able to reproduce the issue [since screenshots can be faked...adding a little more information, logs etc, would help them (or me and others) reproduce the issue] there's not much anyone can do until it can be reproduced. It could be something as simple as another piece of software, a global policy setting or even something like a registry tweak. There are so many possibilities that without first isolating the cause when 90%+ of others don't see this issue, you can't really expect them (or anyone else) to be able to figure it out with just a screenshot of a log.

A true FRST log or the equivalent might help...at least then we'd know which software you were working with and have a better position to start from while attempting to reproduce the situation and then figure out what is actually happening. Allowing BRN to have a remote access session or two on your PC might also help (though this isn't something I'd do personally) as they'd be able to locate\read everything they need without further input from your side.

Let me reiterate, I DO NOT think you are faking it, only that it's understandable why they might have misunderstood the issue (along with responding generically/incorrectly) and have thus far been unable [may have not even tried] to reproduce it.

 

I think it is a bug. I will list it as a reminder so they will have that in mind when looking at the code again. We don't want to loose AG users due to bugs.

 

I actually thought the same as you. If the option is unticked then I do not know why it is logging it in the event log. I think this should be considered a bug. I will list it as a bug. I think I read about this yesterday.

 

For quite some time now on my XP machine, I've been using AppGuard along with NVT ERP, and they've been very compatible with each other. No problems at all. I'm just wondering if I really need both -- or if they essentially do about the same thing and there's overlap?

 

Okay, thanks!

 

In my Windows 10 laptop, Install mode blocks installation of files from some installers. I still needed to set AppGuard to Off in order for the installation to proceed without blocking from AppGuard. When I say "blocked" this time I mean it literally. The installation couldn't proceed, shows errors, since AppGuard blocked it. AppGuard would show a blocking event, that's why I know that it's AppGuard that blocks it.

 

Didn't you say AG also blocks some things in OFF Mode?

 

Yep! I agree with you, of course.

My problem could also because of security software conflicts. I have KIS 2016, Zemana Anti-Malware (Real-time Protection On), HMP.A, and CryptoPrevent. Although, I have switched (removed and/or added) to other security softwares. But I could still experience the issue.

 

Yep! But the blocking is limited to the Activity Report. I'm not sure if it's just a GUI issue or that it really blocks something in my laptop.

 

Quarri MyPOQ is an example.
See here: https://www.wilderssecurity.com/threads/appguard-4-x-32-64-bit.355206/page-145#post-2530168

 

he pinpointed all

Important: 1, 3, 6, 8
Needed: 2, 5,7,10
not hurry because mostly cosmetic: 4, 9, 11

 

I already sent an email to AppGuard team describing my problem with AppGuard.

 

*shakes his head*

 

Okay. No asking. Set the folders and don't ask.
User added <NoVirusThanks EXE Radar Pro x64> to power application list.
User added <NoVirusThanks EXE Radar Pro Service> to power application list.
User added <HitmanPro.Alert> to power application list.
User added <c:\windows\cryptoguard> to private folder list.
User added <c:\sandbox> to private folder list.

 

I actually think number 2 is important because in many cases AG can only guard executions, and cannot block them.

 

I don't think it should be very hard to do. AG is the only one I know of that does not offer this functionality. All policy, and whitelisting based AE's I know of facilitate this functionality.

 

For me ALL of them are more than important, critical. I wish to have them all incorporated on next release. AppGuard needs an important overhaul as any other software that considers as a world class company does.