[DeepGuard] TeamID in rules no longer work
Hi Dev team,
With the newest release Version 19.8 (63381) I found that TeamID in rules are not working properly in strict mode.
For example, I only allow apps with TeamID UBF8T346G9, which is Microsoft-Apps that can read/write .xlsx file:
allow suffix ".xlsx" "/ via any" rw "" "UBF8T346G9" ; Microsoft
This works in pervious version.
As the screenshot I attached here:
- file type ".uuidcache-114514-2" is not pre-defined. Deleting this file will trigger a DeepGuard pop-up, which I rejected.
- file-type ".xlsx" is configured as only processes with TeamID UBF8T346G9 can access it. But deleting it won't trigger any DeepGuard pop-up and thus user will have no chance to notice this event.
I checked the other rules that has TeamID, and it seems that these rules do not check the TeamID but instead allow the rule for all processes.
ProductName:macOS
ProductVersion:15.1
BuildVersion:24B5070a
F-Secure: Version 19.8 (63381), DeepGuard is running under strict mode.
Answers
-
Hallo @66f2e490
Thank you for your post.
Our technicians at R&D have investigated this problem.
It sounds like a potential regression related to optimization work done in that area. The technicians will review the difference in product logic between 19.7 and 19.8 and fix the issue.
I will inform you as I receive an update on this matter.
Thank you very much for bringing this problem to our attention and thank you for your understanding.
Best regards.
Pawel
-
-
How is it possible that DeepGuard will be fixed in version 19.10 when it has been announced that in version 19.9 DeepGuard is discontinued and switching to a new technology?
DeepGuard is being replaced with Behavioral Analysis?
Ville posted "DeepGuard will not exist anymore after 19.8" in another thread?
So what exactly is going on? -
-
How is it that you know, but nobody else does?
Where is the official announcement from F-Secure that it is moving to Avira components for its Windows product line?
There are a lot of people that do not want Avira on their systems. I know that I do not want Avira on my system - whether it is brand name labeled or white labeled F-Secure.
I think it is very underhanded and shady that F-Secure leadership (I am pointing my finger at you - F-Secure executives) is not making any official announcement about v19.9 becoming an essentially 100% Avira product.
![[Deleted User]](https://community.f-secure.com/applications/dashboard/design/images/defaulticon.png)
