A question for the developer: You say this is an offline program that does NOT rely upon cloud computing or your resources on a server of any kind so WHY only a rental licensing model? Also why a limitation on the amount of days offline before it stops working? Is your DRM more important than paid for functionality of the program? Why cannot you make your DRM work offline? Or are you requiring more than just DRM verification and demanding usage stats reporting or other spyware activity?
Why are you demanding continuous never ending payment for software than does not consume any of your resources of yours and whose activity is highly suspicious and some are classed as malicious activity hooking into other processes to gain insecure internet access!
In an ideal world your software will appear to be doing nothing unless some potentially malicious activity occours and then your program SHOULD get in the way and take control… and then it’s don’t what it’s being paid for… but normally it should just be monitoring windows various API accesses a bit like Processmon from sysinternals and only show itself when something unusual happens. Now if your program pops up when NOTHING unusual is going on just to prove it’s on duty and giving you your moneys worth that is called a false positive and is annoying and intrusive and my mind does not need that unnecessary interruption from my current train of thought and neither does anyone else need that distraction! Let alone anyone with ADD/ADHD etc.
Is this software really designed to provide a powerful, unobtrusive service or have you thought of a solution to a problem that you cannot really solve that you can try and make an indefinite revenue stream from for no real on going work?
Will this question every API action until I confirm that API call was ok or does it assume a large number of things are harmless and is programmatically informed that writes by an unknown process to the any users Documents folders not just the current logged in user like windows ransomware protection already does … and requires no learning… just requires user authorisation for every new process write attempts… Why are you using MSedgview to just manage license? Isn’t that substantial overkill or are you using it to do more than a simple https request to validate a license? Personally I block unsolicited MSEdgview2 executable web access as it’s often abused by developers to sneak out web activity that they may not be legally entitled to… your program certainly has no need for emulating a web browser session and rendering functionality that I can see! I just executed afksec-gurad.exe and it tried to make a write to after a little while it started making a write attempt to a protected folder “%userprofile%\Documents\Steinberg\FX Chain Presets\” WHY? and later on unsolicited requests to a an external IP number on port 80 which it should NEVER do in this modern day and age and when blocked by my firewall the firewall ui executable makes a similar port request to an unknown internet IP address… THAT is a malicious act hooking into an existing process and trying to get internet access via wfui.exe is suspicious activity that this program should be BLOCKING not MAKING!!!! Now ending that process and trying executing afksec-app.exe and seeing what that tries to pull… Ah that then uses MSedgwebview2.exe to make DNS and HTTPS connections that are repeated periodically. And pops up a user interface. When pressing start it launches the afksec-guard.exe with admin rights, it’s NOT set to launch with admin rights in the programs own settings or API use but the launch process does it. It messes with the firewall adds a couple of rules and then removes them presumably to see if it has access rights to change the firewall rules… It is also not possible to disable/stop monitoring one you have manually started it and one gets a 2 day trial without giving the program internet access. Personally I find this program potentially malware from it’s insecure web requests, attempting to write to certain ransomware write protected folders for no disclosed reason which were never and will never be allowed without a justifiable reason reason being given for that write action. I note it writes to a journal file:
C:\ProgramData\AFKSecurity\journal\journal.jsonl
Why? It is a legitimate location but with SSDs being used for system drives you as a developer have to justify repeated writes to the system drive… each unnecessary write to a system SSD mathematically contributes to the eventual demise of the system as a whole!
I note that the attempt to hook into the wfcui.exe is to gain access to their license server and done in the clear, no encryption which is amateurish, means I can probably packet sniff the license validation with a simple packet sniffer program and back engineer the communication required to validate the license… and hack it by providing my own server to spoof the activation server!
Personally I don’t believe that this software has the power or authority to protect me from any malicious software… it will have to have had the process executed before any potential restraining actions can be performed by this poorly designed software.
There is a report tab that provides vague summaries of what it saw but does NOT detail it . I has a button to write a report to my Documents but I don’t want to give this program write access to my Documents because of the prior suspect write attempts to ransomware protected folders.. The save report should be to a user definable location not a protected location that this program has no business writing into, as I do NOT trust this program due to it’s previously detected bad actions that should NEVER have occurred by legitimate software of this type. I’m ignoring the temptation to reverse engineer the licensing algorithm used and will be deleting this as at best snake oil monitoring things that may or may not be malicious, the software cannot determine and what is malicious and what is benign and performs acts that are detected by windows and other programs MalwareBytes windows firewall control that is being illegally may not be criminally ilegal but it is against the rules of good and well behaved programming trying to bypass the systems firewall by attacking the firewall UI process that might have permission to access the internet to check for updates like this hooked in to try and sneak past windows firewall rules. I’m erasing this now…