Getting PeerGuardian RC1 test2 working

[GHad]

Hi folks,

just want to share my experience. Due to an unsigned driver PeerGuardian will only run when Win7 started with F8 and Disable Driver Signature Enforcement. Here I'll show you how to get it run by signing the driver yourself:

1. Download pg2-rc1-test2.exe (Phoenix Labs » PeerGuardian 2)
2. Install normal, but don't launch
3. Download dseo12.exe (Driver Signature Enforcement Overrider 1.2 - NGOHQ.com)
4. Run as Administrator (not sure if needed, but anyway...)
5. Click through until various radio buttons show up
6. Now Enable Test Mode (select and click Next)
7. Sign a System File and point to "C:\Program Files\PeerGuardian2\pgfilter.sys" or whereever you installed PeerGuardian
8. Exit and reboot

EDIT: It turned out later that you need to execute this

bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS

in an elevated command prompt also. Plus PG only works if started manually after a
windows startup, it does not work when you select Run with Windows or put it in your
startup folder.

What happened? The test mode for driver signing will be on from now on so your own certificate for the driver is accepted. This is a mode for developers of system drivers normally. It has no side effect for other unsigned drivers as long as you don't sign them (at least I cannot think of/don't know). Only drawback is that there is now more text at your desktop Windows 7 branding. It has a new line Test Mode above the Windows 7 text, well I can live with that...

Greetz,
GHad

Edit:

I'm sorry for the direction the thread took. This wasn't my intention. This instructions can also be used with any other driver that is not digitally signed and I just wanted to show how I got my prog (PG2 for instance) working. I didn't say a word about the programs ualitiy or usefullnes. I just wanted to share experience.

 

[doubleblack]

This is only the case with x64 <_<

 

[GHad]

Yes you're right. Should I change the title?

Greetz,
GHad

 

[Digger]

this is actually the third presumed working way for this i have seen (not necessarily x64). I myself had problems at first (x86).

Resolved by first installing pg2-rc1-test2-2. Did not allow it to startup after install. setup pg2.exe in vista comp mode/ run as admin, and also setup the peerguardian2 folder property security permissions to allow full control **

Next installed pg2loaderRC5 -full option. *note this program and if not mistaken pg2 itself has a default install dir of C:\. (be sure to correct which drive as my win7 is on D:\ ) . Secondly. the pg2loader wants to create a folder and install in \program files\peer guardian 2 (**notice the spaces) while the actual pg2 installs in \program files\peerguardian2 (no spaces). You MUST install the loader in the original peerguardian2 folder or you will run into problems

Also did not allow it to initially run after install. Setup pg2loader.exe to vista comp / run as admin. Lastly, if using the shorctut placed on desktop "pg2loader", make sure that shortcut leads to the actual renaming of the dir for \peerguardian2\... or just delete that .lnk and create a shortcut from actual pg2loader.exe

If you read around you will see references to having to hit F8 everytime on boot for disabling of signed drivers i believe. This is not needed now

works like a charm. havent had it crash or hang once, even from updates or right click allowing/ban a specific ip. although before shutting down or restarting win7 i close the program down first.

 

[TripOG]

isnt peerguardian a joke... i read that it was foolish to expect it to actually do what it is said to do.. finding link now...

 

[TripOG]

PG2 is a placebo. Of course, you see some addresses blocked. The ****ing thing blocks ONE-THIRD of the Internet address space, by its own claim.

What you do NOT know is whether the addresses this piece of **** blocked were, in fact, the very peers who had the pieces you were downloading.

By inducing and then reinforcing paranoia, PG2 does more harm to torrenting than the RIAA, the MPAA and the FBI combined. I've said it before - if PG2 didn't exist, the MPAA would have invented it.

Here's just a small selection of the problems with this overhyped garbage:

http://www.slyck.com/forums/viewtopic.php?t=38295

The Media Defender internal email leak offered plenty of information for the taking. MediaDefender-Defenders said that they hoped that the email leak will prove to be a viable tool to protect against anti-P2P efforts. This is something BlueTack has been trying to do. After the email leak, a text file that compiles the complete IP (Internet Protocol) list Media Defender used while dropping fake files onto various P2P sites and networks was posted. While judging the effectiveness of these lists had proven to be an impossible task before the major leak, the effectiveness can now be tested.

Slyck began the investigation when BlueTack's 'Paranoid' IP filter blocked one of TVUnderground's new eDonkey2000 servers. A request for comment or information on the matter to BlueTack's team went unanswered. To this day, why BlueTack has blocked only one of TVUnderground's servers is unknown. In the meantime, Slyck is currently in the possession of a copy of BlueTack's IP filter lists, and further investigation into related matters appeared warranted.

According to the BlueTack website, "B.I.S.S. is a site dedicated to improving the safety and awareness of all our members and guests, providing News, Security articles, Software Reviews, Technical Support, Guides, IP Research and Free Software needed to help us keep our connections to the net and each other safe, secure, and free from unwelcome intruders."

Among the things offered are the blocklists, which have been met with either acceptance by the file-sharing community or complete rejection. Some say that the blocklists allow users to simply block any anti-filesharing company and allow users to connect with non-industry IPs. Others say that there is no way to get the right IPs before the IPs are changed to different addresses, thereby rendering the filters ineffective. It's been the subject of debate for quite some time amongst many experts with no real way to test the lists, at least until the Media Defender email leak.

The 'Paranoid' eMule IP filter was retrieved on September 27, 2007. The Level1 IP blacklist, which is supposed to block all known anti-p2p IPs, was retrieved on September 30, 2007. The idea behind getting these lists now is to offer ample time for Media Defender's now public IPs to be added to the lists for a much more effective blocklist for PeerGuardian users.

Slyck then obtained a copy of the publicly available 14.3MB compressed text file which lists all of the Media Defender's IP addresses. At this point, it became obvious that testing such a large volume of IPs would prove to be an overly time-consuming challenge, at least by hand. In order to alleviate this problem, it was best to test one particular IP range. Conveniently enough, the first range started with 116. Slyck then decided to test all of the IPs that started with the number 116.

The total number of IPs used by Media Defender starting with 116 was 1,474. Obviously, BlueTack did block all IPs that started with 116, but how many Media Defender IPs were successfully blocked? When Slyck investigated, there was a common theme that blocklists seemingly jumped over several ranges used by Media Defender. After some extensive study using the Level1 list for anti-p2p companies and the 'Paranoid' list, BlueTack would have successfully blocked 16 IPs. Thus, this sample test offered 1.09% protection against Media Defender in that range.

The IPs that were successfully blocked were: 116.255.1.109, 116.255.1.154, 116.255.1.244, 116.255.1.27, 116.255.1.52, 116.255.1.85, 116.215.157.243, 116.212.14.223, 116.199.202.170, 116.199.202.240, 116.199.207.83, 116.199.207.84, 116.199.226.78 , 116.199.227.11, 116.199.227.27, 116.199.227.67. The remaining 1,458 IPs would still be allowed through even with these two filters being used today.

While BlueTack may still perpetuate the idea that their filters are 99% effective, these latest findings will only fuel criticisms towards BlueTack's actual effectiveness. A complete test might not be possible short of creating a simple program to test every single number or spending weeks hand-testing every single Media Defender IP address. In the mean ime, it seems very apparent that BlueTack's filters have a few holes.

And that was tested against known and published addresses!! In order to catch those 16 addresses (probably by dumb luck and the law of large numbers), BlueTack also blocked more than 4 million INNOCENT addresses in the same range.

==============================================================
A SECOND TEST:

I am convinced that it is not authentic. I did a reverse lookup on 500 or so somewhat randomly picked addresses from the 5.3 million addresses in that list. Look at the results -- it's pretty clear that the vast majority of the items in the list are residential dynamic IP addresses from all over the world.

===============================================================

http://www.physorg.com/news110035755.html

Not Much Anonymity for Unprotected File-Sharers: Researchers Examine P2P Networks
The same technology that allows easy sharing of music, movies and other content across a network also allows government and media companies easy access to who is illegally downloading that content.

"Note that it is not our intention here to examine how accurate and comprehensive these lists are, though this would be interesting and challenging future work."


=============
"after a quick look through the document, found elsewhere (PDF) (thanks again guys), all their stats are based on a couple of assumptions: that the blocklist contains no false positives, and more importantly, that it fails to contain no address that should be included. i will leave it to others to comment on the likelyhood of these assumptions being correct."
===============
FROM PG;s ow website:

Well, it is accurate in the sense that it blocks everything on your blocklist. <No ****, really?>
It is impossible to know _all_ the addresses to block

PeerGuardian is known to be incompatible with McAfee and BlackICE firewalls. Outpost is also known to cause a problem if you shut down PG2 while it is running. There is currently no way around this, so we recommend you try switching to another firewall

PeerGuardian blocked someone, should I be worried?
Well, it was blocked, so why would you worry?

PeerGuardian is slowing down my connection!
This occurs because of the way PeerGuardian blocks packets, not connections.

PeerGuardian is blocking an IP like crazy, should I worry?
PeerGuardian will constantly block IPs. Many times you will see IPs get blocked three or more times before giving up - this is due to the way most computers handle reliable connecting. After a period of time, people may retry to see if you are responding yet. This does not mean people are spying on you. <No ... it means they are trying to download or upload files in a swarm where you are connected ...duh ...>

A block list is a list of bad IP ranges that are know to spy on people’s computers.
<That's simply a lie. A blocklist is =just a list of IP addresses. Its accuracy and completeness depend ENTIRELY on who created it and who contributed to it.>


This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software. <Translation - it's a POS, we know it's a POS and you're just as liable to get caught with it as without, and we ain't responsible. But thanks for the donation anyway ...>

Total of IP's being blocked right now:

* 2,377,645,666

<Yep TWO ****ING BILLION blocked connections all to TRY to prevent one percent of the known addresses of MD from getting through.>

first things first, if the government was and/or are spying on you right now, it will be on a IP range that is not on our blocklists and is a secret range of IPs, second thing is, if the government was and/or are spying on you right now, they would be doing it on a whole diffrent level.


<Then why are you blocking the Department of Agriculture's IP range? Are you afraid they'll detect someone pirating a seed catalogue?>


from the wall of text post on demonoid forums...

 

[Digger]

didnt know that this thread would take a turn towards the discussion OF use, rather than just use of.... but, anywho.... all this info you posted is quite old and well known around the community. Some statements i would concur, but for others i could throw up a few defensive arguments, who and why... and the alternative which is nothing blocking anything. In my experience sometimes it can be a pain to use as it does hang up websites while loading, due to mostly the overwhelming advertising down on a particular site, like a local newspaper site.... even if i can keep a few double click ads from being installed without disabling cookies and have the option to block/allow particular ranges or ips with a simple click or two is a nice thing. Even if anything this program could be used for a display of incoming/outgoing connections.... nevertheless you can always edit ip.txt files...

no, dont assume i think that this is the messiah of programs, no worries ever again.... but every little tool helps

and actually the blocklist is above the 7billion..... as for blocking the DoA ip range... why is someone connecting from there or you TO them for anything other than going to their website?

about the spying bit... a recently retired CIA has spoke about the recent years of "spying" on america during the Bush years, and not just if you place an overseas call or have any of the so called criteria for them to "flag" to have the reason to spy.... this same guy was an advisor on security during the obama campaign just fyi....



If i was a gambling man or a psychiatrist... i would say that you sound like you had a server\website of yours or a friends blocked by chance.... you sure brought out one heck of a case/agrument/bone-2-pic with pg2/iblock/bluetack

 

[TripOG]

nope i had nothing against pg it has done nothing to me and has not blocked me.. but i dont think its an effective program and using it it just like putting a bandaid on a broken leg

 

[Digger]

but i dont think its an effective program. just like putting a bandaid on a broken leg

dont understand your analogy there.

first off, its free. as for effective, define your "effective".

if not to use pg(bandaid) what kind of turnicate/splinter do you have/use... or do you just sit there with the broken leg?:sarc:

I guess you could say the same for Norton, as well as the other AV's as they all dont catch EVERYTHING, some catches things other dont and so on... Not too mention the reputation of slowing down systems aka mem hogs. so if to follow your analogy and apply it to AV... then you are saying why use the AV? just a bandaid right? Effective?

Lastly... your point/discussion should be aimed towards bluetack in the first place since they are the ones who make the lists

 

[TripOG]

the list are what im talking about but pg uses them, it does block the ips on the list but the list are garbage... blocking all those ips when no one even knows if their legit... if your going to dowload something illegal and their watching it, peerguardian is not going to save you...

your better off just being careful at what you download then expecting this program to protect you.

 

[dgba7aa]

This post worked and was extremely helpful. Thanks so much.

I had server 2008 and pg2 simply stopped working.

 

[Feanux]

Since this thread isnt too old, just a quick question. I followed the steps and it works like a charm, except when I start PG, there is no GUI; it goes through the generating cache list and my process explorer says its running but now visible GUI.

Any reason why?

 

[Tews]

Because this is a program that is meant to be run in the background, which makes sense to me... I dont need to watch it to know its working...

 

[Feanux]

I always liked the little bit of reassurance but oh well.

Weird though, I restarted my computer and the GUI popped up when I launched it. Restarted my computer later on, launched it, no GUI.

 

[harpua]

If you can't access the UI of PG, then it's probably not working correctly on your system even though the PG process may be running in the background. It may be running but not "enabled." The only way to be sure it is working properly is to open the program's interface and check to see if the IP's are scrolling by the way they should when the app is enabled and working properly. If you can't access the PG interface, odds are it is not working properly. The solution: Go into Task manager and disable the PG process and try to start it again and repeat until you get it running so you can access the program's interface. Then check to see if it is enabled or disabled and that the settings are properly set and the lists properly configured and updated, and that the IPs are scrolling by as you are accessing the net.

I've used the method explained in the first post (or a variation thereof) for quite some time and it works great for me. I did not have to run any special commands, however. Just used the DSEO program to enable test mode, reboot, and sign the PG driver, reboot, and that's all it took, iirc. Runs very well on my x64 system.

It's true, imo, that PG and the lists are not likely to block absolutely everything one might like to block, but they do enable one to avoid a lot of bad stuff (speaking from personal experience here) and I'd rather not be the lowest hanging fruit on the tree.

Also, there is an IP filter built into most of the better bittorrent clients like, e.g., Utorrent. There is also an IP filter updater app for updating Utorrents IP filter list with a single click. Works well in conjunction with PG. Nice to have two lines of defense operating, imo.

 

[thebladeroden]

I like PeerGuardian, haven't gotten one of those threatening letters since April ^_^

 

[ThumperSD]

EDIT: It turned out later that you need to execute this

bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS

May somebody explain to me what that command does? Will it mess up my registry in any way?

If I no longer wanted to use PG2 do I have to revert it back?

 

[swarfega]

Id recommend PeerBlock ? Peerblock Site over PG.

 

[ThumperSD]

Id recommend PeerBlock ? Peerblock Site over PG.

Is it compatible on W7 w/o any problems whatsoever?

BTW PG2 shows a bunch of IPs scrolling but it shows that they are all "allowed." Does that mean that these IP addresses are safe, hence they are allowed? I selected P2P, spyware and adware servers, government addresses, and ad trackers to all be blocked during the installation.

 

[ThumperSD]

Id recommend PeerBlock ? Peerblock Site over PG.

Okay well I uninstalled PG2 and installed Peerblock without any problems.

Now... do I need to reverse anything I did from the original post after PG2 uninstallation? I dont want to mess up any registry on my pc.

For example
bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS