AppGuard 4.x 32/64 Bit - Releases

Is the guy adding it to Guarded Apps or Exception Folders ?

He said he added it to Guarded Apps.

 

I think he added it in the Folder Settings. You won't see the term "Deny Access" in the Privacy column found in the Guarded Apps list, only "On" or "Off". "Private (Deny Access)", however, can be found in the Folder Settings.

That's why I asked for his clarification.

 

Agree. He may have added it to Guarded Apps, but there was no need to go to the Settings.

 

If the guy comes back on to the thread, would someone please help him out ? I'll be going offline in a short while.

I will send him a PM.

Thanks for catching it.

 

I agree.

 

Have been exchanging PM's with Jeff @Lockdown and have it sorted. And yes I did try adding it by the Settings instead of Add Program Realised that wasn't right so asked before I screwed things up.
Many thanks for everyone's help

 

I'm glad you sorted it out. Yeah, Jeff is very helpful.

 

And so it is very unlikely a home user would need to add this to guarded apps?

 

You could. It shouldn't hurt anything. If something were blocked, you can always UnGuard it, do what you need, then re-Guard it.

 

After reading some of replies , I have a Q. :
I need a to test AppGuard , Where can I download it? and is it free or not ?

Sorry, this is 1st time for me here .

 

Use the 4.X installer. It still has a 30-day trial I think. Since its still up and available, you might as well try it using the trial. There is no meaningful difference between version 4.X and 5.X at this time. However, 4.X is end-of-life. 5.X has no trial. It is paid-only. So use this installer with the trial:

http://www.appguardus.com/support/products/AG44/AppGuardSetup-4-4-6-1.exe

 

Thanks for link(more info)

Many thanks, sure I need for test before purchase.
The time for VM.

Unfortunately there is no trial for latest version !!!??

 

Yes, there is no trial for the latest version (5.x)

 

May have to go through the blacklist here: https://www.wilderssecurity.com/thr...-tuersteher-light.359127/page-67#post-2652091 to see if anything has been added.

Unless @Lockdown has some automated compare with previous lists?

 

Thanks for the link here. I will look at it sometime over the next week to see what, if anything, needs or should be done. Based upon a really quick look it appears that nothing needs to be done. I will check it in more detail.

 

Much appreciated. Over and above your ongoing valuable presence here.

 

Does anyone see any blocked writes to C:\Program Data or C:\Users ?

For anyone that has Google Chrome Enterprise installed, do you see a block of Windows Installer attempting to access GoogleUpdateHelper.msi ?

 

I compared the new blacklist with an older file, and in the following list you'll see all changes (14 new entries)
Edit: Correction

Spoiler: new Blacklist - added entries

*attrib.exe
*auditpool.exe
*cacls.exe
*eventvwr.exe
*mmc.exe
*netsh.exe
*netstat.exe
*quser.exe
*Stash*
*takeown.exe
*taskkill.exe
*wmic.exe
*xcacls.exe
C:\ProgramData\Microsoft\Windows Defender\Scans\FilesStash\*

 

@mood I am confused ... these entries still appear on the new blacklist.txt?

 

I haven't yet seen any blocks of writing to Program Data.

 

Yes, these files has been added to the new blacklist
Edit: Correction

 

Yes, Adobe Reader is being blocked from updating. I just started using Adobe Reader recently for school so I just started seeing this block.

 

This is expected InstallGuard behavior. Add Adobe to the Trusted Publishers List. Then lower protection to Protected Mode and update. It won't work in Locked Down mode since it disables the TPL. AppGuard will block any *.msi\*.msp in User Space from a publisher that is not on the TPL - even if the *.msi\*.msp is digitally signed.

The alternative is to lower protection to Allow Installs and update Adobe.

 

I also have Google Chrome Interprise installed. I know it gets blocked very often when checking for an update. I reported it here a few months ago. I will take another look at it, and post the block here when I get time. I'm studying right now.

 

You must mean the blocked read by Windows Installer of GoogleUpdateHelper.msi ? Post the block event please when you have time.