Changelog
What's New
Release history for InfinityGuard. Every version, every fix, every improvement — documented here.
-
InfinityGuard Browser Extension is now available as a standalone download — no Windows app required.
All browser protections run independently. Includes a one-click PowerShell installer that registers the extension in Chrome, Edge, and Brave automatically. Double-click
Install InfinityGuard Extension.cmd, done.
Manual load-unpacked instructions included as a fallback for any browser not handled by the script.
-
Stable extension ID across all installs.
The extension now uses a cryptographic key binding in the manifest, giving it the same ID (
obooecnobkjgledlinbopnjlcdoojofe) regardless of where it's installed or loaded from. Settings, whitelist entries, and per-site preferences survive reinstalls and path changes.
-
Standalone mode popup — works gracefully when IG for Windows isn't installed.
The popup previously showed a red error state when the Windows service wasn't reachable. It now shows an amber "Browser Shield Active" card with extension-only stats and a prompt to try the full suite — no alarming UI, just accurate information.
Browser Shield — What's Included
-
Tracker & Ad Blocking. 234+ tracker and ad domains blocked via Chrome's native declarativeNetRequest engine — no page content is read, no requests are proxied through our servers.
-
Fingerprint Protection. Canvas, WebGL, audio channel, navigator, and screen APIs all return plausible noise instead of your real device signature. Prevents cross-site tracking that survives cookie clearing.
-
Phishing & Scam Detection. Live URLhaus and OpenPhish feed checks on every navigation. Detects ClickFix clipboard injection, tech-support scam overlays, fake update prompts, and scareware audio in real time.
-
Email Shield. Blocks tracking pixels and cleans redirect wrappers silently in Gmail, Outlook, Yahoo, AOL, iCloud, Proton Mail, and Tuta. Email content never leaves your browser.
-
Dark Pattern Detection. Flags urgency language, pre-checked consent boxes, and confirm-shaming on any page. Clicking the badge now opens a detail panel listing exactly what was found, the pattern type, and a Locate button that flashes the element on screen.
-
Cookie Consent Auto-Reject. Silently clicks reject on consent banners across the vast majority of sites — timed retries handle lazy-loaded and delayed popups.
-
Terms & Privacy Grading. Automatic pattern-based grade on any ToS or Privacy Policy page you visit. Optional AI plain-English explanations via a provider of your choice — Groq, Gemini, Ollama, LM Studio, or any OpenAI-compatible local model. Your API key stays in your browser only.
-
Tracking Link Stripper. Removes utm_*, fbclid, gclid, and 30+ other tracking parameters from every link you follow.
-
WebRTC Leak Protection, HTTPS Upgrade, Download Monitoring. Local IP exposure blocked at the browser level. Sub-resources and frames forced to HTTPS. Dangerous file types flagged before they open.
-
Dark pattern pill click did nothing visible. Clicking the badge previously scrolled to the first flagged element silently — if it was already in view, nothing appeared to happen. The pill now expands inline to show each detection with its type, description, and a Locate button.
-
Extension version was hardcoded in content scripts. The version shown in phishing warning overlays was a static string that would have stayed at 1.1.9 forever. Now reads from the manifest at runtime.
-
Consent rejection timer cleanup was never running. The
_cleanup() function was defined after the timers it was supposed to clear, and _clicked was always false at the point of check. Hoisted declarations and wired each timer to call cleanup on success.
-
Page scroll lock not restored after dismissing a phishing warning.
document.documentElement.style.overflow was reset in a dead remove event listener Chrome never fires. Moved into the proceed button's callback where it actually runs.
Faster & Network-Friendly
-
No more DNS slowdowns.
Fixed the rare "connected, but pages won't load" hang that happened when the malware-domain blocklist slowed Windows' name resolution. The highest-risk malware and phishing domains are still blocked at the system level — now applied in a way that keeps your connection fast.
-
Works cleanly with your VPN.
Connect a VPN (Proton, WireGuard, and others) and InfinityGuard recognizes it within about a second and steps aside so the VPN owns your DNS — then restores full protection the moment you disconnect. No more stalled browser when toggling a VPN on or off.
-
Scans report only confirmed threats.
You now see the threats InfinityGuard actually confirmed and handled — not the false positives it already cleared. InfinityGuard also no longer scans or flags its own files, and you can add your own folders to skip.
-
Safer handling of protected files.
Fixed a case where Windows Defender's own protected files could be mishandled, and improved how restores handle files Windows guards.
-
Fingerprint & tracker-blocking fixes.
Corrected errors that could misbehave on some sites, so privacy protection loads fully on every page. Added a global Alert Size control so on-page alerts scale for readability.
-
Install this update manually.
Download and run the installer over your current version — your settings, license, and quarantined items are all preserved. Earlier versions couldn't apply updates automatically, so this is the last manual step. From 1.2.5 onward, updates install themselves.
-
Windows Defender now has the final say.
A file is only quarantined when Defender agrees it's a threat. InfinityGuard's faster heuristics check with Defender first instead of quarantining on suspicion — so legitimate installers, developer tools, and packed apps stop getting flagged, while real threats are still caught immediately.
-
The in-app updater is fixed.
Clicking Update Now now opens the installer visibly and applies the update, instead of appearing to do nothing.
-
Stronger detection.
Expanded community virus signatures are restored, improving detection of known malware — bundled with a false-positive whitelist so the added coverage doesn't add noise.
-
Your quarantine now survives updates — safely.
The encrypted vault and its records are durable across restarts and updates: quarantined items are never lost or stranded, false-positive files stay restorable, and InfinityGuard cleans up its own leftover files so it never wastes your disk space.
-
Quieter and smarter.
Routine driver updates no longer trigger a wall of "system file missing" notices, and a heavy-workload system-load spike can no longer cause a running app to be wrongly quarantined.
-
License activation and plan changes now apply cleanly.
Activating a license, or removing one to go back to Free, now restarts the protection engines properly and shows clear on-screen progress instead of leaving you unsure anything happened. And a lapsed or cancelled subscription now correctly reverts to Free — previously an expired plan could keep paid features running.
-
A ransomware-precursor monitor is running again.
A behavioral watcher for early ransomware behavior — shadow-copy deletion, backup tampering, security-process termination, recovery-mode disabling — had silently stopped working. It's active and watching again.
-
YARA-detected threats now quarantine correctly.
A bug caused threats matched by YARA rules to fail when being moved to the encrypted vault; they now quarantine as intended.
-
Fixed a bug that could block your microphone and camera.
A privacy-hardening policy could disable mic and camera access at the Windows level — breaking voice chat and video calls in games, Discord, Zoom, and Teams — and it reapplied itself, so turning it back on in Windows Settings didn't stick. Mic and camera access is now yours to control by default. Your protection here comes from Privacy Sentinel, which watches for anything accessing the mic or camera and alerts you. Applies automatically on update.
-
Stronger quarantine encryption.
The quarantine vault's encryption key is now protected by Windows DPAPI instead of being stored on disk in plaintext. Existing quarantines migrate automatically and stay restorable.
-
Safer automatic response.
Fixed a case where IG's fileless-threat response could terminate a protected system process or one you'd marked safe — including a guard against ever killing its own components or a game's anti-cheat.
-
More reliable updates.
Corrected an internal version mismatch that could repeatedly prompt you to "update" to a version you already had. From this release on, updating from any older version jumps straight to the newest in one step.
-
A threat-feed entry could block InfinityGuard's own updates.
A malware feed (URLhaus) flagged a single malicious file hosted on GitHub's release-download host, and IG was blocking the entire host — which serves every GitHub download, including IG's own installer and updates. That host, and all of
githubusercontent.com, is now permanently allow-listed. Shared-hosting domains are no longer blocked wholesale; the file scanner still catches any actual malicious download.
Known issue in 1.2.0–1.2.1, fixed in 1.2.2.
-
DNS alerts no longer flood the threat log.
Busy shopping, CDN, and SaaS domains generate bursts of DNS lookups that can look like tunnelling. Those heuristic hits now collapse into a single quiet Network watch list instead of one alert per subdomain. Only domains confirmed against a threat feed surface as real alerts.
-
Behavioral anomalies now require corroboration before they surface.
A behavioral score on its own no longer raises a card. IG confirms with a scan first, and only shows a detection when something is actually found. Unconfirmed deviations are logged quietly and used to keep learning — no more phantom "anomaly" cards.
-
IG no longer flags its own components.
A path-matching bug let the behavioral scanner occasionally flag InfinityGuard's own service as suspicious. IG now correctly recognises its own files and never scans, quarantines, or acts on them.
-
Game anti-cheat processes are now correctly skipped.
A path-matching bug could let memory scanning touch anti-cheat components (Vanguard, BattlEye, EasyAntiCheat). IG now reliably skips them, removing any risk of an anti-cheat false trigger.
-
Suppressed-Detections manager.
The Quarantine page now lists every false-positive rule IG has learned — what it hides and how many detections it has suppressed — with one-click "re-arm" to start seeing a detection again.
-
One-click release for contained processes.
If a ransomware response freezes a process that turns out to be safe, you can now release it (or restore network isolation) directly from the Threat Log instead of using Task Manager.
-
Protected-file and protected-process guards unified.
IG will never quarantine or terminate a Windows system file, an anti-cheat process, or its own components — enforced in one place so no detection path can bypass it.
-
Verified self-updates.
App updates are now integrity-checked (SHA-256) and pinned to the official release source before the installer is allowed to run.
-
Reliable engine updates.
ClamAV engine updates verify their download source, and the post-update restart is now synchronous so a scanning-engine update can never leave the service stopped.
-
Windows Phone-Home & Copilot Audit — 40-point privacy check with Auto-Enforce.
Scans every way Windows phones home without consent: telemetry services, Copilot reinstall vectors, MAPS cloud reporting, MDM enrollment stubs, clipboard cloud sync, WaasMedic self-healer, and more. Scores 0–100. One-click fixes. Auto-Enforce re-blocks anything Windows reverts on the next restart or update.
-
IG Cleaner — deep system cleanup with VSS awareness and Ads Killer.
Reclaims storage silently eaten by Volume Shadow Copies, Windows Update caches, WinSxS, and Delivery Optimization. Ads Killer terminates Microsoft advertising delivery processes at runtime. Includes telemetry process scrubber and junk file sweeper. Available as a panel inside IG and as a standalone tool.
-
Browser Extension — tracker blocking, consent auto-reject, and Gmail shield.
Companion extension for Chrome and Edge. Blocks trackers and ads via declarativeNetRequest rules, automatically rejects cookie consent banners, shields Gmail from tracking pixels, and protects against browser fingerprinting. No separate account or config needed — integrates with the IG dashboard.
-
Defender unclassified behavioral alerts no longer inflate the threat count.
Detections with
category=Invalid / severity=Unknown — Defender's signature for AMSI heuristic noise with no actual verdict — are now routed to the activity log as informational entries instead of being counted as threats. These were causing phantom HIGH alerts with no actionable information.
-
Per-user service instances suppressed from persistence alerts.
Windows creates runtime service instances like
WpnUserService_10aafb on every login. These were being flagged as HIGH persistence detections and counted toward the threat total on every boot. IG now recognizes the ServiceName_XXXXXXXX pattern and suppresses these as benign.
-
Process Lineage Scorer now starts correctly.
The reference database (
process_lineage_db.json) was saved with a UTF-8 BOM by the previous build. Python's encoding="utf-8" cannot parse BOM-prefixed files, causing the scorer to silently report offline on every startup. Fixed by switching to utf-8-sig.
-
Script Shield: MEDIUM script detections now route to the threat log as LOW with context instead of being surfaced as active threats. Reduces alert fatigue from ambiguous PowerShell patterns that have no confirmed malicious behavior.
-
Defender quarantine badge count is now accurate.
The badge was counting all quarantine entries including previously cleared items instead of only active ones.
Privacy & Windows Hardening
-
Applied service disables now persist across reboots and Windows Updates.
When you fix DiagTrack, dmwappushservice, PcaSvc, or any other telemetry service, IG saves the preference to
audit_applied_fixes.json and re-applies the disable automatically on every startup — no need to click Fix again after every Windows Update.
-
DiagTrack and dmwappushservice fixes no longer fail on Windows 11.
SCM ACLs on these services reject
Set-Service even as SYSTEM. The disable now uses a 3-layer fallback: PowerShell → sc.exe config → direct registry write (Start=4), ensuring the fix always lands.
-
PcaSvc (Program Compatibility) now stays disabled after restart.
Service start type alone is not enough — TriggerInfo registry entries restart the service on system events regardless of disabled state, and WaasMedic resets the start type on updates. Fix now uses Group Policy keys + start type disable + TriggerInfo subkey removal, all three together.
-
LSASS PPL protection now applies correctly.
The previous fix wrote
RunAsPPL as REG_SZ "2" — a string type Windows silently ignores for this key. Fixed to write REG_DWORD 2, which Windows actually honors on next boot.
-
Privacy Audit: WaasMedic, Clipboard Cloud Sync, and MDM Enrollment checks corrected.
WaasMedic check used a null-conditional operator only available in PowerShell 7+ — always returned MEDIUM on standard Windows PowerShell 5.1. Clipboard check treated a missing registry key as UNKNOWN (Windows deletes the key when the setting is disabled in Settings — absence means off). MDM check now correctly identifies inert OOBE GUID stubs with no active ProviderID as safe.
-
System Tools cards no longer stretch into squares.
The feature grid used CSS
align-items: stretch (default), causing all cards in a row to match the tallest card's height. Fixed with align-items: start and minmax(0, 1fr) columns — each card is now its natural height.
-
File Shredder drag-and-drop now accepts folders.
Electron's
dataTransfer.items[i].getAsFile() returns null for directories. The drop handler now reads from dataTransfer.files instead, which Electron patches to include directories with full paths.
-
Build script now correctly bundles the process lineage database.
process_lineage_db.json lives in ProgramData after first install, not in Program Files. The build sync step was skipping it, causing Inno Setup to abort. The build now explicitly pulls the file from ProgramData before packaging.
-
AI Defense now requires scanner corroboration before quarantining.
Previously, the AI Behavioral Engine could quarantine files at high confidence without ClamAV, YARA, or HashDB confirmation. All AI detections now require at least one scanner to confirm before any file is quarantined — eliminating false positives on unsigned or packed executables.
Root cause: the real-time monitor called the AI engine directly, bypassing the scanner's skip-list entirely.
-
Unconfirmed AI detections logged as LOW severity instead of being silently dropped. These entries appear in the Threat Log with a "possible false positive" note and are automatically sent to ThreatVerifier, which runs ClamAV + Windows Defender and updates the entry with a verdict.
-
In-progress downloads no longer flagged by real-time protection.
Files with
.crdownload, .part, or .download extensions — and .tmp files inside the Downloads folder — are now skipped by the behavioral engine until the download completes. Chrome and Edge write to these temp paths during download.
-
New InfinityGuard shield icon replaces the generic blue square. All three sizes (16×16, 48×48, 128×128) now show a proper gradient shield on a dark background — consistent with the app's visual identity.
-
Fixed warning overlay not appearing on fast page loads.
The content script initializes at
document_start — before the DNS check completes. The background's fallback now calls window._igShowWarning() directly instead of setting a variable the content script had already walked past.
-
Download threats now appear in the Activity Log with the threat name and detection engine, matching how real-time file threats are reported.
-
New LOW severity tier in the Threat Log.
Unconfirmed AI detections appear as muted entries clearly labeled "Possible False Positive" — visually distinct from HIGH and CRITICAL. These are automatically updated once ThreatVerifier finishes its check.
-
Patch-script backup files excluded from the installer package.
.bak and .bak_* files generated by prior patch scripts were being bundled inadvertently. These are now excluded from both the Inno Setup package and the build sync step.