Appguard Review

[Peter2150]

Just an update. Just tested the new xdata ransomware. Appguard stopped it cold.

 

[Deleted member 178]

normally you should be able to uninstall AG without disabling self protection.

 

[Deleted member 178]

This was purchased and I have entered my license details. It activated successfully.

Ok so I can't uninstall AppGuard. I have checked "Stop self protection" and tried putting the slider to the "Off" mode and also tried stopping the service but every time I try to uninstall I get (even when logged in as my admin account):

I thought it may by AppLocker blocking something but it's not this as the logs are clear. Also tried making myself a Superuser but this didn't help.

Help please

are you on SUA?

 

[ParaXY]

Ok so I managed to uninstall but not using the "Programs & Features". I had to rerun the AppGuard installer and it then proceeded with the uninstall. I then rebooted and reinstalled and rebooted again but I am still getting the same errors when changing the slider. I've tried "Restore all settings to default" but even that errors with the same error I posted earlier. I uninstalled using my admin account but have only tried changing the slider with my SUA account.

I have set AppLocker to audit mode so it doesn't interfere. Nothings getting blocked in Event Viewer.

Ideas? Not sure what to try next. I don't have any other security products running except WFC but I have disabled my firewall temporarily while troubleshooting this.

 

[askmark]

Ok so I managed to uninstall but not using the "Programs & Features". I had to rerun the AppGuard installer and it then proceeded with the uninstall. I then rebooted and reinstalled and rebooted again but I am still getting the same errors when changing the slider. I've tried "Restore all settings to default" but even that errors with the same error I posted earlier. I uninstalled using my admin account but have only tried changing the slider with my SUA account.

I have set AppLocker to audit mode so it doesn't interfere. Nothings getting blocked in Event Viewer.

Ideas? Not sure what to try next. I don't have any other security products running except WFC but I have disabled my firewall temporarily while troubleshooting this.

You could try using Sysinternals' Process Monitor, with a filter that includes only the AppGuard processes. Then look for any file and registry blocks when you change the slider.

 

[Deleted member 178]

Ok so I managed to uninstall but not using the "Programs & Features". I had to rerun the AppGuard installer and it then proceeded with the uninstall.

oh i had this one too, i thought it was my system...good to know...i will tell @Lockdown about it.

I then rebooted and reinstalled and rebooted again but I am still getting the same errors when changing the slider. I've tried "Restore all settings to default" but even that errors with the same error I posted earlier. I uninstalled using my admin account but have only tried changing the slider with my SUA account.

does AG is barebone or did you makes some changes in it?
SUA shouldn't have influence on AG.

I recall someone having that issue, but can't remember the fix...@Lockdown will surely know.

 

[ParaXY]

oh i had this one too, i thought it was my system...good to know...i will tell @Lockdown about it.



does AG is barebone or did you makes some changes in it?
SUA shouldn't have influence on AG.

I recall someone having that issue, but can't remember the fix...@Lockdown will surely know.

I literally installed it, all defaults, not a single change and after reading your post about lock down mode I got this error when trying to enable it. Very odd, Hopefully @Lockdown can help (oh now I get his username lol).

 

[Deleted member 178]

@ParaXY , just by chance, do you have some partitions or folders named with special characters (other than letters and numbers )?

 

[ParaXY]

@ParaXY , just by chance, do you have some partitions or folders named with special characters (other than letters and numbers )?

I'd say no:

Oh just saw you mentioned folders too. I have some folders like this on my D: drive:

# Paid - CCleaner

 

[ParaXY]

I have completely disabled AppLocker so this is not causing the issue.

Oddily, even after getting the AppGuard error when changing the slider (or other settings) it still enables lock down mode (I think?). I have the padlock AppGuard icon in system try.

Or not (?):

 

[Deleted member 178]

Oh just saw you mentioned folders too. I have some folders like this on my D: drive:
# Paid - CCleaner

remove the special characters to see, because AG doesn't support paths with them.

 

[ParaXY]

Didn't make a difference. Would a "-" cause an issue? Like:

TO READ - KINDLE

Guess I should ask, what is considered a special character for AppGuard?

 

[Deleted member 178]

those like @&$% etc...

 

[Deleted member 178]

Didn't make a difference. Would a "-" cause an issue? Like:

TO READ - KINDLE

Guess I should ask, what is considered a special character for AppGuard?

try without the " - "

 

[ParaXY]

Can I exclude all non system drives from AppGuard just to test if this is what is causing the issue?

 

[Deleted member 178]

can you post screenshots of each tabs ?

 

[ParaXY]

Sure thing:

 

[Deleted member 178]

i see nothing wrong, you didn't add partitions or folders in user-space tab right?

 

[ParaXY]

i see nothing wrong, you didn't add partitions or folders in user-space tab right?

None!

 

[Deleted member 178]

so i guess we will have to wait @Lockdown .

the only thing i can think about is to clean install the OS , update it , install drivers & needed softs then AG. (which is the most recommended procedure when installing AG).