AppGuard a good HIPS?

[jjbula]

Matt did a review of AppGuard and appeared to really like it.

Do you think it should be included on the www.remove-malware.com list of good preventative solutions with Defensewall, Drivesentry and CIS with D+?

Any bad things I don't know about Appguard? Appears to be much better than what I use now. (Geswall)

[Dieselman]

Thank you Joe. Very good reply. To each his own.

[Nashua]

Any bad things I don't know about Appguard? Appears to be much better than what I use now. (Geswall)

It is a very good HIPS. No problems at all from what I've experienced. Works fine with avira. It seems really good. Really low CPU usage and very simple to use. The only downside is that you have to pay for it. So, I go with DriveSentry.

[jjbula]

Thank you for the replies.

I guess it's tough to make generalizations on which is "better". Depends on the expertise of the user, how many programs it isolates and how it interfaces with the user when it detects a threat.

My litmus test includes protecting my computer from teenagers on the internet. They are not experts and I want it to be as automatic as possible after I set it up for them.

I don't mind a one time fee as I think it will be low cost of ownership over 2 yrs or more.

I know these HIPS products can't be perfect and am glad there are no major flaws with this one.

[jjbula]

Just wanted to give you an update.

I tried Appguard all of 15 hrs. Good install and rebooted a couple of times due to an issue with, I think, Firefox 3.5. Then all was well though the computer was slowed down. Tested the ability to block USB .exe files and it worked great.

Then the computer (Parallels VM windows XP from 2002) locked up. First, wouldn't boot Firefox. Then it stopped responding altogether. Forced a Parallels shutdown, reboot then lock up again. This time it just wouldn't respond at all after boot up.

So I reverted to a previous snapshot with the free version of Geswall still installed. I will be happy for now with Geswall, Avira and threatfire. I also still have the free (scanning) version of PrevX still installed. Geswall doesn't appear to slow down the VM at all. I still don't like that you have to remember to re-engage it after turning it off. I will work on the USB rule to block USB malware. I'm hoping I can make Geswall as protective as Appguard with tweeking.

Off topic but curious --

PrevX gave me a false positive a week ago. Scanned the file with Virus Total and it found nothing. Is PrevX trying to scare folks into paying for it? Kinda sneeky and makes me wonder about them.