GuardedID® Help
Frequently Asked Questions
Windows 10 USERS: Click to configure IE 11 as Default Browser.
WEBROOT USERS: Click to configure Webroot.
GuardedID® and keyloggers
Using GuardedID® for Windows
Driver Warnings for Windows
GuardedID® is a software program that encrypts your keystrokes between the keyboard and your desktop applications and internet browsers, so that keyloggers cannot steal your personal or financial information.
GuardedID® works with all major browsers to block keyloggers from grabbing information going to internet applications. GuardedID® also protects desktop applications like MS Office, bookkeeping software such as QuickBooks and TurboTax, Skype and other messaging programs, and Windows “login” screens.
A keylogger is a piece of software that records every keystroke you make on a keyboard. Malicious (“malware”) keyloggers are designed to avoid detection from anti-virus programs and invade your computer without your knowledge or consent when you install a program, get an email, visit a website or otherwise use your computer online. Once installed, the keylogger records all your key strokes, and then sends your personal and confidential information back to the cyber criminal.
What’s the difference between GuardedID® and other anti-keyloggers?
GuardedID® takes a unique approach to protect your confidential information. When you type on your keyboard, GuardedID® encrypts all keystrokes at the point of origin (your keyboard), then carries those encrypted keystrokes to any browser or desktop application via its own proprietary path, bypassing the place where keyloggers reside. This way, existing and new keyloggers can’t get their hands on your keystrokes.
In addition to anti-keylogging, GuardedID prevents screen-scraping malware from taking screen shots while you are in any application, and warns you of clickjacking attacks. The GuardedID anti-subversion feature detects untrusted drivers and kernel level compromises, and displays a warning containing the location of any suspect driver.
Do I still need my anti-virus product suite?
Yes. GuardedID® prevents keyloggers from seeing what you type. You still need programs to keep viruses out of files (anti-virus/anti-adware) and to keep intruders out of your machine (personal firewall).
If my computer is infected with a keylogger, will Guarded ID protect me?
Yes. GuardedID® will protect the keys you type inside your browser, even if your anti-malware programs do not have current signatures. When the GuardedID® light is green and says “On”, (or the “G” icon in the notification area in the lower right of your screen flashes as you type), GuardedID® is protecting your keystrokes from keyloggers.
What applications and browsers does GuardedID® protect?
GuardedID® protects all applications and browsers with keystroke encryption. For Mac users, Apple protects many if not all browser password fields.
Will GuardedID® work with any keyboard?
GuardedID® works with PS/2 keyboards as well as USB keyboards, including wireless keyboards. Certain enhancement drivers for advanced specialty keyboards may not function when GuardedID® is enabled.
Does GuardedID® protect a USB keyboard plugged into my laptop?
GuardedID® protects typing from all active keyboards; the laptop keyboard and/or USB keyboard and/or PS/2 keyboard.
What is “screen scraping” (aka “screen logging”)? Does GuardedID® protect me?
GuardedID® includes a blocker to hide your screen from screen loggers. “Screen scraping” loggers capture snapshots of your screen each time you make a change. GuardedID® does not stop the loggers from attempting to steal — it sends them all black screens!
What is clickjacking? Does GuardedID® protect me?
Yes, one of GuardedID®'s security features is “Clickjack warning.” Clickjacking is a type of cyber threat whereby an invisible link or button containing malicious code can be placed over a legitimate link or button on any website without the user’s knowledge. This malicious link could also appear as a non-threatening link that essentially sends the user to another website without their knowledge. When a user clicks on an unseen link the cyber criminal has the ability to take control of that computer and download keystroke loggers and other malware, which can wipe out the computer’s hard drive.
In another example of clickjacking, a web user thinks they are clicking a legitimate button to close a dialog box — but the button click actually deletes all the email messages in their Gmail account. Or, a user believes they are clicking on a button to decline to take a survey, when they are actually transferring money from their bank. Cyber criminals use this technique to raise an article’s Digg score or get paid for a pay-for-click advertisement.
The GuardedID® anti-clickjacking feature helps prevent against these types of attacks by making the clickjacking locations visible to the user. GuardedID® highlights invisible buttons and links with red dashes, showing the end user that the web page that they are on may contain malicious code. GuardedID® also highlights in red dashes any ads, links, or content that is being served from a third-party site. When you go to these third-party sites you should always use caution, making sure you are on a legitimate site.
I am using Firefox with Vista and some sites are slow. Can I do anything?
Yes, you can elect to turn off some of the GuardedID® security features, however, that is not recommended.
Because GuardedID® helps to keep you secure and aware of potential compromises, including clickjacking attacks, there could be some sites that will take longer to fully appear when using Firefox with Microsoft Vista. To address this issue, you may wish to temporarily disable the GuardedID® anti-clickjacking feature. Go to the GuardedID® toolbar and click “Manage” then click “Preferences”. Under the Anti-Clickjacking Options section, click on the boxes to turn off these features. This should eliminate the delay in Firefox. If this does not solve the issue, then GuardedID® is most likely not causing the delay; we recommend you reset your GuardedID® preferences to re-enable the anti-clickjacking features.
Does GuardedID® hide my keystrokes when I am using Remote Desktop programs?
No. The keystrokes going to Remote Desktop Connection programs cannot be hidden by the current GuardedID® releases.
Can I use the software on multiple computers?
One GuardedID® license will protect two computers.
How do I know GuardedID® is working when I’m typing in desktop applications?
When you are in a desktop program like Excel or Outlook, the “Desktop Protection” agent is active. When you see the “G” in the notification area (system tray) at the bottom right of your screen, you know that GuardedID® Desktop Protection is ready. Each time you press a key, the “G” will flash to indicate that encryption has occurred.
On Windows 7 and Windows 8 desktop, if you cannot see the “G” in the notification area, you can:
1. “Right click” on the current time in the notification area. A menu will pop up.
2. Select “Customize notification icons”.
3. Find the “G” and “GID Desktop Application” in the left column. Change its setting to “Show icon and notifications.”
4. Press the “OK” button.
Why do fields change color when I click into them? What is CryptoColor®?
The CryptoColor® feature changes the background color of a text field to let you know that your keystrokes are being encrypted from the keyboard.
GuardedID® protection is provided to most desktop programs by the “Desktop Protection” agent represented by the “G” in the notification area (system tray) in the lower right of your screen. You can temporarily disable protection, or stop running the program (exit). Neither option uninstalls the software.
•Temporarily disable protection by right-clicking on the “G” and deselecting “Enable”. The GuardedID® icon will display a red circle with a white “D” as a reminder that Desktop Protection is disabled. To re-enable GuardedID®, go back to the “G” icon in the notification area and click “Enable”.
•Exit protection by right-clicking on the “G” icon and selecting “Exit”. GuardedID® will display a reminder that Desktop Protection is terminated. To restart Desktop Protection, go to “Start | Run | Programs | GuardedID®” and click on “Desktop”.
You can turn GuardedID® toolbars off by changing the Secured Mode “Always On” setting using the GuardedID® “Manage | Preferences” tool. Uncheck “Always On”, click “OK”, then close all web browser programs. When you open the web browser program again, GuardedID® will not Activate to the Secured Mode.
Also, you can disable GuardedID® in one browser program, but not the other, using each program’s setting for add-on programs.
Note: GuardedID® cannot protect your computer against keyloggers when it is disabled or exited.
Firefox has ended support for all binary extensions, including the GuardedID® toolbar. GuardedID® still protects your keystrokes in Firefox (watch for the blinking “G” icon in the notification area at the bottom right of your screen). However, CryptoColor® is supported in Internet Explorer only at this time. A CryptoColor® plug-in is in development. Look for it later in 2016.
When you are using browsers such as Chrome, Opera, etc. that do not have GuardedID® toolbars, the “Desktop Protection” agent is active. When you see the “G” in the notification area (system tray) at the bottom right of your screen, you know that GuardedID® Desktop Protection is ready. Each time you press a key, the “G” will flash to indicate that encryption has occurred.
Why does the toolbar show a red “Off” when the cursor is not in a field that I can type into?
Inside the browser, GuardedID® is only active when the keyboard cursor is in a text input field. If you click inside a web page where there is no input field, GuardedID® will show RED “Off”. Once you move the cursor into a text entry field on a web page, GuardedID® will turn “On” and protect your typing.
Why does the toolbar show a red “Off” when typing in the fields at the top of the browser?
The fields at the top of the browser (the Address or URL field and the Search field) are outside the Internet data section of the browser. The toolbar is only active when the keyboard cursor is “inside” the data section. The top bar fields are protected by the GuardedID® “Desktop Protection” agent. The flashing “G” indicates safe operation in those fields.
Internet Explorer has an Advanced setting, “Enable third-party browser add-ons”. To make sure this is enabled, select “Tools” in the IE menu and click “Internet options”. Select the “Advanced” tab. In the second group you will find the setting. Make sure it is checked. Close and re-open IE to activate the setting. Then repeat the steps to make the toolbar appear.
GuardedID® uses the Windows driver signatures to be certain that your kernel is intact. If this message is reported for a Microsoft driver like “i8042prt.sys” for Windows 7, the issue is likely due to Microsoft update KB3004394. Copy and paste http://support.microsoft.com/kb/3024777 into the address bar of this browser for more information.
Otherwise a disk error or software error (again, not connected in any way to GuardedID®) has damaged the Windows catalogs. In this case see http://technet.microsoft.com/en-us/library/cc734083.aspx.
If the driver is not a Microsoft driver, it is either an old, unsigned driver (contact the device vendor for a current, signed driver), or a rogue driver that should be removed before using the computer for sensitive operations.
I received a “GuardedID® keyboard driver is not responding” warning. What should I do?
GuardedID® constantly verifies that its kernel driver is secure. Under some conditions, legitimate Windows programs might block this verification. If you type 10 characters and GuardedID® cannot verify, it will issue this warning.
The recommended solution is to reboot. If that is not practical, “warm restart” your computer by closing the Internet browser and exiting the “Desktop Protection” (the “G” in the notification area [system tray] on the bottom right of your screen). Then go to Start | Programs | GuardedID® and restart “Desktop”. If warm restart does not help, try to reboot.
The most common repair is to uninstall GuardedID®, reboot, then reinstall GuardedID®, making sure that the installation is free of warnings. Reboot after installation. If the problem continues, contact support@strikeforcecpg.com.
Does GuardedID® work with games, such as GT (Gran Turismo) or WoW (World of Warcraft)?
No. You must disable GuardedID® during game play. GuardedID® is designed to protect your browser sessions and desktop applications (MS Word, Excel, Outlook, VPN clients, IM chats, etc.). GuardedID® protects some “online web browser games” but not all of them. GuardedID® currently does not protect gaming applications that sit on your desktop like GT or WoW, because games like these remap the keyboard for gaming functionality, etc. Before you launch these games, right click on the “G” in the notification area (system tray) in the bottom right of your screen, and select “Exit” or deselect “Enable” (GuardedID® cannot protect your computer against keyloggers when it is exited or disabled.) You will then be able to game with no issues. After you are finished gaming, go to “Start | Run | Programs | GuardedID®” and click on “Desktop” to restart GuardedID® Desktop Protection.
Certain games played inside IE or Firefox may be affected by GuardedID®. If your game play is disrupted, you can disable GuardedID® by right-clicking on the “Tools” item in the browser’s menu and untagging GuardedID®. Approve disabling of GuardedID® (if asked). After you are finished playing, return to the “Tools” menu and re-enable GuardedID® toolbar. Close and re-open the browser to activate GuardedID® protection.
A serial number (called Machine ID) is assigned to each computer. Your Machine ID is already activated, but with a different license key. If you have another license key, try to activate with it. If not, please contact support@strikeforcecpg.com to resolve this issue.
Sometimes I see the wrong character when I type. What can I do?
This can happen for two reasons:
Non-standard programs look like keyloggers. Certain programs use Windows Message Hooks in a non-standard way that makes them appear to GuardedID® as keyloggers. Every time you type into one of these programs you will see numbers in sequence (e.g., “1234”) instead of what you are typing. To use these programs without GuardedID® protection:
1. “Right click” on the “G” icon in the notification area (system tray) in the bottom right of your screen. A menu will pop up.
2. Deselect “Enable”. Note: GuardedID® cannot protect your computer against keyloggers when it is disabled.
When you are finished with the non-standard program, remember to go back to the “G” icon in the notification area and click “Enable” to re-enable GuardedID®.
GuardedID® has gotten “out of sync.” If you type a letter and you see a number, GuardedID® has lost track of which field on your desktop you are working in. The best way to recover is to log off your desktop and log back on again.
If you don’t wish to log off:
1. Open an application like Notepad, wait a few seconds, and then type a few characters. Close the application. This may correct the problem.
2. Go back to the original application you were using when you saw the issue. If a number still displays instead of the character you typed, GuardedID® is still “out of sync.” (You’ll continue to see a number, then the character you typed, for every key you press.)
3. Stop typing, wait 2 seconds, and GuardedID® will reset a buffer to get back in sync and display only the characters you are typing.
If the problem continues, contact support@strikeforcecpg.com
Why do I see a notice about “LicMgrEP.exe”?
The “LicMgrEP.exe” is part of GuardedID® protection license manager. If you are installing or using GuardedID® for the first time, the notice may come from your Internet Security software. Allow LicMgrEP.exe to continue as long as it is properly signed from StrikeForce Technologies.
I am replacing parts on my computer. Will GuardedID® still work?
Before you replace parts on your computer, make sure you have a record of your license key then deactivate GuardedID®. You can see your license key in the “Manage | Manage License” by right-clicking on the “G” in the task bar. Write down the long string of characters and dashes shown in the license field. Then use the tool to deactivate GuardedID®.
,p>Once your computer is repaired or parts replaced, simply click the “Activate” button in the GuardedID® icon or toolbar, enter your license key, and click “Activate”. GuardedID® will start protecting your computer.How do I move a GuardedID® license from one computer to a new one?
If the old computer still works, make sure you have a record of your license key, then deactivate GuardedID®. You can see your license key in the “Manage | Manage License” tool in the GuardedID® toolbar. Write down the long string of characters and dashes shown in the license field. Then use the tool to deactivate GuardedID®.
Once your new computer is ready, and GuardedID® is installed, simply click the “Activate” button in the GuardedID® icon or toolbar. The Manage License form will open where you enter your license key (that you previously wrote down); click “Activate”. GuardedID® will start protecting your new computer.
If the old computer is not available, send an email with the name and email address you used when you purchased GuardedID® to support@strikeforcecpg.com. You will receive additional instructions.
Driver Warning for \Driver\i8042prt or \Driver\kbdhid on Windows XP
Usually indicates that Windows Crypto service has been disabled in some way. The Microsoft Crytographic Services are important for protecting your computer security.
The “Resolution” section of the following Microsoft article has the steps that usually help to resolve the problem with cryptographic services which causes GuardedID® to warn about \drivers\i8042prt.
http://support.microsoft.com/kb/822798/
Driver Warning for \Driver\DKbFltr on computers with Windows 7 64-bit
Check your computer for the following conditions:
•In the folder [C:\WINDOWS\system32\drivers\] the file “DKbFltr.sys” shows 0kb in size.
•In the 64-bit folder [C:\WINDOWS\sysWOW64\drivers\], there is a “DKbFltr.sys” and its size is ~25kb, and it is properly signed (view its properties)
If this is the case, delete the 0kb file C:\WINDOWS\system32\drivers\DKbFltr.sys and the GuardedID® Status will return to normal. Acer laptops with Windows 7 64-bit are likely to have this problem.
TopDriver Warning for an unsigned driver from a valid source
Older or special Windows XP keyboard Drivers might not be signed. This applies to some versions of \Driver\Ps2, \Driver\Ps2Led, \Driver\qkbfiltr, \Driver\PCTCore, \Driver\hask, and \Driver\HpqKbFiltr. Others are specialty devices for gaming, etc.
Find the driver file in %systemroot%\system32\drivers (usually with a “.sys” suffix. e.g. \Driver\Ps2 = Ps2.sys)
Select the file, right-click, select Properties
Check for “Digital Signatures” tab. If the file is not signed, check with the manufacturer for an updated driver.
Driver Warning for an unknown driver and unknown source
Find the driver file in %systemroot%\system32\drivers (usually with a “.sys” suffix. e.g. \Driver\Ps2 = Ps2.sys), scan it with your anti-virus program and research it on the internet with sites like Virus Total.