Defense+ causing memory errors on Apps

[Guest]

[SilverHawkBR]

Rockmelt is a variant of google chrome. I barely use it, sometimes to access some newer stuff my old firefox can't handle right.

There is only one game i'll need, and it sits in the same place of the emulator.
Path for then is C:\Documents and Settings\Master\Desktop\project64kvelho

I'm running an admin account (named Master). No UAC (my skin fooled ya? its XP pro here mate).
Tried running as admin, same stuff. And, yeah, everything looks good from the

Training mode.. nope, doesn't work.

I'm starting to lose hope man..

[mouse1]

Don't give up yet, I am rarely beaten. If nothing else we will find a bug that can be fixed in CIS 6 (hopefully)

1) If XP pro is 32 bit, untick advanced protection mode and reboot then re-try. This will not effect security in 32 bit systems.

2) Try adding the whole directory as an installer/updater and to BO exclusions then reboot and retry.

If these two fail, then we will look at 3 way graphics card software interactions and disabling guard32. The latter often works, but affects security and so is mostly a way of specifying to devs where the bug is.

Best wishes

Mouse

[mouse1]

(Remember to put the installer updater rule at the top of the lis - I assume you checked this last time)

[SilverHawkBR]

Yeah, I did put it on top of list, confirmed. Tried, didn't work.

I'll give it a shot to what you said, and post back here the results.

[at]edit
So here goes, Enhanced protection mode IS disabled already.

And, finally.. adding everything inside the folder to D+ rules and setting then with the Installer/Updater policy didn't work. Adding to BO exclusions is no luck either.

  I said a while back that, deactivating the Defense+ both ways (setting the bar to Disabled and disabling in the options) work. It asks for a restart after disabling in the options right? Yeah, but i don't need to restart the PC for the app to work. Is that something to look at, or you think it's normal?

[mouse1]

Yeah, I did put it on top of list, confirmed. Tried, didn't work.

I'll give it a shot to what you said, and post back here the results.

[at]edit
So here goes, Enhanced protection mode IS disabled already.

And, finally.. adding everything inside the folder to D+ rules and setting then with the Installer/Updater policy didn't work. Adding to BO exclusions is no luck either.

  I said a while back that, deactivating the Defense+ both ways (setting the bar to Disabled and disabling in the options) work. It asks for a restart after disabling in the options right? Yeah, but i don't need to restart the PC for the app to work. Is that something to look at, or you think it's normal?

Well that's very strange. Ticking 'disable D+ permanently' is not supposed have any effect AFAIK. Will put thinking cap on.

Well lets try to see if this is guard32.dll related. Only do the following if you are sure your system is clean - ie no viruses an don't do anything risky until it is reversed. You should find this file in the system32 directory. Rename it, and reboot.

CIS will probably complain - say D+ is not working properly - ignore this. Just try your file. Then rename back to the original name and reboot to restore max security.

AS we understand it CIS can be run and D+ still provides some security with guard32 disabled, but not as much. So if this works the recommended route is to submit a bug report.

We can also try to look for graphics interactions - don't like the look of that Nvidia global hook

Best wishes

Mouse

[mouse1]

Oh while you are at it could you please rename usbguard.exe, and any other USB security executables from the same company and reboot.

Running some forms of USB security on top of CIS could be causing this.

Best wishes

Mouse

[SilverHawkBR]

Got no warnings about changing the name of guard32.dll 

But, the app WORKED! Flaawlessly!

Still.. messing around with this guard32.dll thing disabled sure looks, uh, "not recommended".. so..

So, what now?

  Ain't this a little bit dangerous? I mean, you said you have reduced defense when this guard32.dll is "disabled"... can't some sort of virus then do exactly what i did and disable it, harming the computer?

[mouse1]

Got no warnings about changing the name of guard32.dll  

But, the app WORKED! Flaawlessly!

Still.. messing around with this guard32.dll thing disabled sure looks, uh, "not recommended".. so..

So, what now?

I've just thought that it may be possible to work round this. The guard32 problem could be caused by the hooking strategy, or an interaction between hooks. You can change the hooking strategy by engaging 'advanced protection mode' and restarting. This should have relatively little effect on security. (Remember to restore guard32 to its original name first. If that dioes not work we'll try and see if we can use CIS to prevent CIS hooking the app and/or preventing other gobal hooks hooking the app ... may not be possible.

Ain't this a little bit dangerous? I mean, you said you have reduced defense when this guard32.dll is "disabled"... can't some sort of virus then do exactly what i did and disable it, harming the computer?

Not easily, CIS distinguishes between user and software actions. You can change its name and reboot, but try to write a batch file that does the same.

[SilverHawkBR]

Enhanced protection mode didn't work. 
And, yes, restored the guard32.dll to its name.

Giving a load of work this one..

[mouse1]

Installed myself on VMs and results are:

Version 1.6 Windows Installer
XP: Installs and runs OK

Version 1.5 Zip files
XP: Does not install and run, whatever you do, short of disabling guard32.dll. I ahve tried all the other tricks I was going to suggest to save you time.

Win7 x64: Installs and runs OK

IS 1.6 OK? Seems to deal with local ROMs, but does not provide them?

There is a bug here, which is worth reporting on the bugs board in standard bug format, if you would be so kind.

Best wishes

Mouse

[SilverHawkBR]

Yea, v1.6 does indeed work, but the online version of it ain't based on 1.6, instead, on 1.5.

So, yeah, bug report, here we go... Thanks for the help anyways.

[mouse1]

Yea, v1.6 does indeed work, but the online version of it ain't based on 1.6, instead, on 1.5.

So, yeah, bug report, here we go... Thanks for the help anyways.

That's OK, sorry I could not resolve it.

[SilverHawkBR]

No problemo... at least i got help. Well, when i recommend this AV, it ain't for nothing, you see.
You can lock it if you want.

[mouse1]

Thanks.

No I'll not lock unless someone spam the topic - maybe someone else will have an idea.  Probably merge with or link to your bug report when you do it.

Just a word to the wise - please read this post: here before submitting the bug, and submit in standard format following the guidelines. It really does help devs resolve the issues. You can refer to this topic when asked what you have tried to resolve it - say 'Extensive attempts to resolve with a mod, documented in this post'.

Good luck

Best wishes

Mouse

[Tags:]