EdgeGuard Solo Support

What is EdgeGuard Solo?

EdgeGuard Solo is client security software that stops malware attacks traditional anti-virus, anti-spyware software miss. It prevents flaws in client software applications from being used to compromise the PC. Unlike other offerings that promise to stop malware that eludes traditional signature based defenses, EdgeGuard Solo is a simple ‘set and forget’ tool that defends its host without relying on the end-user having to take action. EdgeGuard Solo supports Windows XP SP2 and Windows Vista.

Supported Operating Systems

Windows XP SP2
Windows XP SP3
Windows Vista
Windows Vista SP1

Tell EdgeGuard Solo What Client Applications to ‘Guard’

After installation, end-users must tell EdgeGuard Solo what client applications to ‘guard’. Note, whenever a ‘guarded’ application launches another executable (e.g., Microsoft Internet Explorer launches an ActiveX applet) that executable becomes ‘guarded’ also.

To select applications for EdgeGuard Solo to ‘guard’, begin by right-clicking on the tray icon for EdgeGuard Solo. It looks like this:

The EdgeGuard Solo window will appear.

Because of how Microsoft Internet Explorer and Microsoft Office (Access, Excel, Outlook, PowerPoint, Word) were coded, EdgeGuard Solo has to handle them differently from most applications. So, for EdgeGuard Solo to ‘guard’ them, click the “Add Internet Explorer” and “Add MS Office Applications” buttons in the above window. Their respective executable names will be added to the listing in the window below.

To ‘guard’ any other arbitrary user application, (do not 'guard' services, more info) click the “Add” button and navigate to where the respective application’s executable is located, highlight it, and click the “Open” button. Below, illustrates adding Adobe Acrobat.

Finally, hit the “Apply” button at the lower right of the window. Changes (e.g., application added) are not implemented until the “Apply” button is clicked.

EdgeGuard Solo 'Guards' User Applications Not Service Processes

Some software, such as anti-virus, patch management, and operating system processes, should not be ‘guarded’ by EdgeGuard Solo. If one is unsure about whether something is a “service”, the “Task Manager” definitively answers the question.

To see “Task Manager”, right-click on the Windows bar normally at the bottom of the screen, select “Task Manager”, click on the tab that says “Processes”, and a window will appear like the one below. If the “User Name” field is not visible, click on “View” in the menu bar, click on “Select Columns”, and then click on the “User Name” check box.

If the process in question, such as iPodService.exe, lists something in the “User Name” column other than the user name of the person logged into the PC, then that process is a “service” and should not be ‘guarded’ by EdgeGuard Solo. Generally, a “service” is listed in the “User Name” column as “System”, “Network Service”, or “Local Service”.

If your PC and/or its applications operate abnormally with EdgeGuard Solo “Protection Enabled” but run normally with this unchecked, then there may be a “service” in the EdgeGuard Solo listing. Finding and removing that “service” from the list will eliminate those problems.

EdgeGuard Solo Can Sometimes Interfere with 3rd Party Software Installation

Warning: be very judicious about choosing to disable EdgeGuard Solo protection. A common attack vector is to trick end-users into installing seemingly innocuous software.

Some software installation requires write operations to sensitive areas of the PC. Any EdgeGuard Solo ‘guarded’ application or installation executable launched by a ‘guarded’ application would be blocked from writing to sensitive areas of the PC. For example, if a user downloads “setup.exe” with Internet Explorer (a ‘guarded’ application) and launches “setup.exe” via Internet Explorer, the installation may fail. To run it without EdgeGuard Solo inhibiting the installation, there are three options:

[Recommended] Save the install program (e.g., “setup.exe”) to the hard drive and then launch it from Windows Explorer
Temporarily remove the ‘guarded’ application involved in the installation/upgrade from the EdgeGuard Solo listing:
- Highlight the ‘guarded’ application, click on “Delete”, and then click “Apply”
- After the installation, click “Add”, navigate back to that application, click “Open”, and then click “Apply”
Uncheck the “Enable Protection” check box and then click the “Apply” button. Note, this completely disables EdgeGuard Solo protection. Afterwards, remember to click “Apply” after re-checking “Enable Protection”.

What if My PC is Attacked? What Do I Do?

Depending on which ‘guarded’ application was involved and the context of what actions were under way, you will see an alert similar to the one below. The alerts consist of wording such as ‘do not have permission’ or ‘access denied’. They are referring to a ‘guarded’ application being denied permission to or access denied writing to a sensitive area of the PC.

When seeing one of these alerts, make a note of:

what applications are running (e.g., your instant messenger received a message from an unknown source)
what sites your web browser is viewing
what files (picture, video, document, etc.) you have just opened.

The attack may have been caused by some malicious content.

Next, finish whatever you were doing. Sometimes, if the application you were using was the one that was attacked, you may lose your work up to the point it was last saved. Other times, you can click the “No” button in the alert box and still save your work.

Next, quit all open applications. One can close only the attacked application. However, the initially attacked application may be sophisticated enough to perform a memory injection attack on another application. Closing them all reduces the odds. Now, restart the applications. If the alert returns, then restart the PC itself. If you don’t mind the time required, your first step can be simply restarting the PC anytime you see one of these alerts.

Windows Vista UAC and EdgeGuard Solo

Windows Vista user account control (UAC) is a security feature intended to protect a PC by stopping a suspicious operation and asking the end-user whether or not to allow it to proceed. EdgeGuard Solo will protect its host whether UAC is enabled or not.

Known Issues

Windows/Applications Updates/Patches

Sometimes, EdgeGuard Solo can interfere with an update. Disable EdgeGuard Solo protection prior to operating system and application updates whenever possible. This is accomplished by unchecking the “Enable Protection” box and clicking the “Apply” button. When the update/patch is completed, re-check the “Enable Protection” box and click the “Apply” button.

To be sure that EdgeGuard Solo protection is disabled during Windows Updates, go to the Control Panel and select the “Automatic Updates” item. Select the radio button for “Download updates for me, but let me choose when to install them.” When there is an update for you, Windows will create an icon in the ‘notifications’ area of your PC, usually in the lower right corner. At this point, disable EdgeGuard Solo protection and then double-click that notification icon to install the update.

Known Conflicts with 3rd Party Software

EdgeGuard Solo was designed to work with any client software that conforms to Windows XP and Windows Vista programming guidelines. EdgeGuard Solo may inhibit normal application operations when these guidelines were not followed.

EdgeGuard Solo Beta, Version 1.2.4.0

Google Chrome Beta

EdgeGuard Solo does not currently support the web browser Google Chrome.
Most browsers are properly ‘guarded’, including all versions of Internet Explorer, Mozilla Firefox, Opera, and Safari for Windows

Adobe Acrobat 8.0

‘Guarded’ applications cannot print to Adobe Acrobat because it attempts to write to critical system directories when rendering PDFs.
Workarounds:
- Open EdgeGuard Solo, uncheck the “Enable Protection” box, click “Apply”, conduct print job to Adobe Acrobat, re-check “Enable Protection” box, and click “Apply”
- Open EdgeGuard Solo, highlight the ‘guarded’ application, click “Delete”, click “Apply”, conduct print job to Adobe Acrobat, and add application back to ‘guarded’ list (click “Add”, navigate to application executable, click “Open”, click “Apply”)

Windows Live Messenger (i.e., next-generation MSN Messenger)

Following a recent update to Messenger software, there is a conflict that hinders normal operation when EdgeGuard Solo guards it. All prior versions of Messenger ran normally when guarded by EdgeGuard Solo.
Blue Ridge is working with Microsoft to resolve the issue.

Known EdgeGuard Solo Bugs