AppGuard - co i jak?

[F4z]

Wyszła wersja stabilna 4.3.13.1 -

[Aby zobaczyć linki, zarejestruj się tutaj]

Link do pobrania -

[Aby zobaczyć linki, zarejestruj się tutaj]

Instrukcja -

[Aby zobaczyć linki, zarejestruj się tutaj]

Jeśli chodzi o listę zmian, to nie widzę nigdzie oficjalnie podanej, więc zebrałem wszystkie te, które były podane na Wilders Security:

Kod:

1. Locked down is no longer on the main GUI (can still get to it from the tray menu) and Medium is changed to “Protected” .
2. Enhanced Alerts: The ability to display Toasters and Popups are added for all blocking events. Toasters are those little messages that popup periodically in the bottom right-hand corner of your screen. Check boxes for these options appear on the Alerts tab. Please let us know your thoughts on these. Are they a nuisance? Since the defaults are still set to be similar to the current ones (where only blocked launches and access to the private folders are reported), they shouldn't be any more annoying than now, but let us know. Experiment with these also. I've turned the toasters on for all events and I find it interesting, but novice users may be alarmed and request support. If you know how AppGuard works, then it may interest you, but if you don't it might be alarming.
3. The “AppGuard Stopped <xx> suspicious activities” toaster will now appear approximately every 3 hours. Is this too annoying?
4.  Minimize buttons were added for the main GUI and the AppGuard Activity Report.
5. The AppGuard Activity Report can how be resized horizontally (i.e. made wider).
6. New Driver for Windows 8 and above only. If you are on Windows 10, if you can test opening Office documents that are Outlook attachments that would be appreciated. Also test calendar operations in Outlook
7. New Policy Settings:
 New Publishers:
  <tcOrganization>McAfee, Inc.</tcOrganization><tcLocation>Santa Clara</tcLocation><tcState>Oregon</tcState><tcCountry>US</tcCountry>
  <tcOrganization> Oracle America, Inc. </tcOrganization><tcLocation>Redwood Shores</tcLocation><tcState>California</tcState><tcCountry>US</tcCountry>
  <tcOrganization>Intuit</tcOrganization><tcLocation>Mountain View</tcLocation><tcState>California</tcState><tcCountry>US</tcCountry>
  <tcOrganization>Citrix Online</tcOrganization><tcLocation>Fort Lauderdale</tcLocation><tcState>Florida</tcState><tcCountry>US</tcCountry>
  <tcOrganization>Cisco WebEx LLC</tcOrganization><tcLocation>San Jose</tcLocation><tcState>California</tcState><tcCountry>US</tcCountry>
  <tcOrganization>Cisco WebEx LLC</tcOrganization><tcLocation>Santa Clara</tcLocation><tcState>California</tcState><tcCountry>US</tcCountry>
  <tcOrganization>LogMeIn, Inc.</tcOrganization><tcLocation>Boston</tcLocation><tcState>Massachusetts</tcState><tcCountry>US</tcCountry>

 New exception Folders:
  c:\windows\system32\spool\printers
  c:\program files\adobe\adobe\pcd
  c:\program files\adobe\slcache
  c:\$recycle.bin\
8. Embedded wildcards (?, *) for user-space and power apps are now supported.
9. A bug was fixed where some blocked launches (out of System32 and Syswow64 directories) were not being reported properly. BTW, this bug was reported by Cutting_Edgetech (Thanks again).

[Aby zobaczyć linki, zarejestruj się tutaj]

Kod:

1. Power apps in (x86) or system32 should have the correct paths shown in the GUI.
2. Java runtime programs are now Guarded (you might have to reboot to actually see these in your list and of course they need to be installed).
3. When adding user-space and other folder/file policies, AppGuard will remember the last path.
4. Jar files are now prohibited from running from user-space.
5. You can now delete schtasks.exe and at.exe from your policy if you desire (but we DO NOT recommend that).

[Aby zobaczyć linki, zarejestruj się tutaj]

Kod:

By popular demand this version allows jar files to run, but Guards java executables. A bug was fixed where AppGuard was not adding JRE exes in x64 program files directory to the Guard list. Also, the IMDisk issues are "fixed" in the sense that AppGuard will not allow you to add rules for the folders because IMDisk is not reporting a proper volume name to the OS. Those that already have some IMDisk rules in their policy may have to restore to defaults to see the fix. You can now add up to 32 power apps.

[Aby zobaczyć linki, zarejestruj się tutaj]

Kod:

1. “Unrecoverable” message wording has been changed to less intimidating wording. This message appearing is actually a "feature" to warn when an invalid rule has been set. I think the original wording was unfortunate because it led even me to think that there was a crash situation (and I even approved the original wording so I have no excuse except that I'm old).
2. Bug fix for the publisher settings flakiness reported yesterday.
3. Bug fix for a bug our QA department found (I almost hate to tell you all about this one because it might get you looking for more like these): Select one of the "Allow xxxx Launches" menu options. The icon will change to show lowered protection. Click on the "Customize" button on the main GUI. The icon changes to show that protection is on (but it isn't!). I actually wanted to mention what caused this bug. For some reason (unfortunately the developer can't remember why and he didn't leave a good comment in the code or the source code repository), when the customize button is clicked, the GUI requests that the policy be updated from the Service) and this request is what causes the status to get out of sync. Anyway, Cutting_EdgeTech, you were right about the delay when clicking on the Customize button. There is a 500 millisecond delay added while waiting for the policy update. You are observant to notice a 1/2 second delay!!!
4. Cutting_EdgeTech's issue with java programs not being discovered (fingers crossed). Actually Cutting did try the fix last night, and it didn't seem to work, but the policy version was incremented in this build so this should force a merge of the new policy with the old policy (and maybe that will set things straight).

[Aby zobaczyć linki, zarejestruj się tutaj]

Kod:

1. A broken link to a help page was fixed.
2. Java apps in the C:\program files folder on x64 systems should be discovered and Guarded (for real this time).
3. The GUI is now DPI-aware meaning that it should look much better on high-resolution screens.

[Aby zobaczyć linki, zarejestruj się tutaj]

Oprócz tych zmian, AppGuard teraz domyślnie blokuje różnego rodzaju skrypty, których wcześniej nie blokował - js, jse, vbe, wsf (może coś jeszcze, ale tego nie wiem) oraz pliki z rozszerzeniem .hta.
Wynika to z tego, że za pomocą wyżej wymienionych skryptów dało się całkowicie ominąć ochronę AppGuarda - 

[Aby zobaczyć linki, zarejestruj się tutaj]

Ponadto jeśli komuś zależy na zwiększeniu ochrony, to polecam dodać PowerShell.exe do chronionych aplikacji.