ProcessGuard in Security http://www.dslreports.com/forum/r16654778 en Fri, 04 Dec 2009 19:59:06 EDT Fri, 04 Dec 2009 19:59:06 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16769079 Mele20 :
said by controler See Profile :

I guess now in my mind PG is a dead product as TDS-3 was
Don't you think that may be because of Microsoft locking the kernal in Vista so PG won't work and DiamondCS will be sued by Microsoft if they hack the kernal? There is a thread at Wilders started by another vendor with security software similar to PG asking everyone to boycott Vista for this reason. Pay particular attention to Herbalist's posts begining with #27.

»www.wilderssecurity.com/showthre···t=143678
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"]]> http://www.dslreports.com/forum/remark,16769079 Thu, 24 Aug 2006 02:39:02 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16766151 controler : I guess now in my mind PG is a dead product as TDS-3 was]]> http://www.dslreports.com/forum/remark,16766151 Wed, 23 Aug 2006 18:28:24 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16761306 daT : After reading this I though I'd pop in with my 2c.

Since v3.15 I've had the driver/service disabled. Why? Because I use SAV CE and, along with a lot of other users of the product find PG going schitzo after each av defintion update. The only recourse was to disable the feature.

Pretty much rendered PG pointless... almost.

I see that there are still issues with that aspect of the tool.

And this is not a new issue.

From what I can recall its been 6 months now.

And, there are still a number of other issues related to the latest build.

Its a shame really as, imo, this tool was indespensible.

I don't run it any longer on my XP box, and, not needed on my 'nix box :D
--
daTerminehtor]]> http://www.dslreports.com/forum/remark,16761306 Wed, 23 Aug 2006 00:26:36 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16760857 Wake2 : After my post earlier today I found that if I clicked Melanies picture and clicked preview than PG alerts
that explorer.exe wants to install a driver/service,
same results if I click magnify in Windows Picture
and Fax Viewer, PG alerts that explorer.exe wants
to install a driver /service, but if I click the
picture, and click open with Windows Picture and
Fax viewer, PG alerts rundll32 wants to install a
driver service, when the picture is opened, and
when you click on magnify same results PG alerts
that rundll32 wants to install a driver /service.

If you terminate spoolsv.exe and open Melanies picture
than PG gives no alerts period at all.

If you manually add spoolsv.exe to PG and allow driver
service install you get no alerts from PG when opening
that picture.

edit forgot to add no alerts until I rebooted than once
again the PG driver service weirdness with Melanies pic
was back.

Regards,

Wake]]> http://www.dslreports.com/forum/remark,16760857 Tue, 22 Aug 2006 23:03:01 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16760475 controler : Mine says explorer.exe is trying to install the service or driver.

Nice to see others seeing the same thing.

controler]]> http://www.dslreports.com/forum/remark,16760475 Tue, 22 Aug 2006 22:07:30 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16757027 Wake2 : ok i downloaded the Melanie pic, opened it with
Windows Picture and Fax Viewer first time got no
reaction from PG (have the full version) second
time though when hit magnify PG does alert that
rundll32.exe tried to install a driver / service.

I have rundll32.exe set to allow once, and I am
using PG version 3.4.10 Full.

Regards,

Wake

Edited: If you use task manager to shut down
spoolsv.exe and than reopen Melanies pic using
Windows Picture and Fax Viewer and hit magnify
PG throws no alerts for rundll or driver service
install .. have a Lexmark Printer and no GeForce
video card installed.]]> http://www.dslreports.com/forum/remark,16757027 Tue, 22 Aug 2006 13:59:04 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16756123 FiL : Im a avid PG user, and love its newest build.

Got a Geforce 4 system @ home I can test this problem out on.
I'll DL the proper prog's from here at work, then transfer em to the the Geforce pc.

Check back in a day or 2. :)]]> http://www.dslreports.com/forum/remark,16756123 Tue, 22 Aug 2006 11:28:23 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16755463 norwegian :
Maybe I need to pull out the old system with the ATI card in, and see.

This computer and the minor problems I have seen with the last 2 builds was tested on a machine with GeForce card, so this maybe is a common denominator.

It would be great if at least someone else checked this out. What of the graphics card on Clone 171162's machine.

It also maybe an issue with the Full version, which I was almost in the process of buying, but Kaspersky are travelling some in roads of late, and it would seem a waste of money, unless I bought PG, and ran a free A/V.

I was actually thinking if it was a glitch with A/V software, but without seeing this event, and running something like Filemon I am only guessing here.

Would have liked to be more help, but without reproducing the same thing here, I am out of idea's, sorry.

]]> http://www.dslreports.com/forum/remark,16755463 Tue, 22 Aug 2006 09:37:23 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16755392 anon : Can someone clarify whether this bug is a security risk or a bug which needs some manipulation to expose if this thread is anything to go by ?]]> http://www.dslreports.com/forum/remark,16755392 Tue, 22 Aug 2006 09:26:40 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16755264 controler : I installed the full version on three computers. One XP Pro, One XP home laptop and One Dell XP home. I never dissallowed services.exe. In the main GUI tab
I have exe protection enabled. on top and bottom I have all 4 ticked. Open task manager and make sure spoolsv.exe is running Open the picture with Windows picture and fax viewer. PG may not alert on the first opening but usualy does on the second for sure. Otherwise when you open it and PG doesn't alert, all you have to do is click the magnifying glass and then PG alerts.
This is using the last two builds of PG FULL.
I have two LIC after the TDS-3 event.
The Dell is a used one I bought that had a fried MOBO,
So it has new Mobo & Hard Drive with fresh clean install of XP Home, PG & BoCLean.
If you shut down spoolsv.exe, the alerts go away.
It's not a system issue but tow of the desktop do have GeForce video cards installed. One had the GeForce software installed that came with card, the Dell only has the Windows driver for the card installed.
I know PG is having some issues with GeForce video cards?

controler]]> http://www.dslreports.com/forum/remark,16755264 Tue, 22 Aug 2006 08:54:01 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16754487 norwegian :
I downloaded the image of both pictures, off Internet Explorer to the desktop as you requested, the addresses came from the desktop image when viewed with FileAlyser.

But as prior, had no warning of any sort, and double-checked that spooler service was set to "started", and automatic, but this test was with the latest version 3.4.1.0, but the first test was with the prior build.

Good luck finding the answer;
just one of those software glitches from installation maybe, corrupt read/write, interpretation of the code ?

Also does everyone only see it with the "Full" version, as I could only test with the free version ?

]]> http://www.dslreports.com/forum/remark,16754487 Tue, 22 Aug 2006 01:59:45 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16753634 controler : Pg doesn't alert on the download, nly the opening of the picture. It doesn't matter if you download it with IE or Firefox.]]> http://www.dslreports.com/forum/remark,16753634 Mon, 21 Aug 2006 23:10:46 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16753486 norwegian :
Even with the latest version of PG, still get no warnings. Maybe it has to do with the web addresses in the data of the picture, without sounding paranoid. ;)

ht tp://ns.adobe.com/xap/1.0/
ht tp://www.w3.org/1999/02/22-rdf-syntax-ns#'
ht tp://ns.adobe.com/iX/1.0/'>
ht tp://ns.adobe.com/xap/1.0/mm/'>
ht tp://www.iec.ch
ht tp://www.iec.ch

On a side note: PG didn't alert to opening Opera to post this(fresh install of PG, turned off learning mode).

What is going on down at DCS headquarters ?]]> http://www.dslreports.com/forum/remark,16753486 Mon, 21 Aug 2006 22:46:56 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16751194 controler : Spanner

I hear that but have that hole sealed as far as MS knows.

It happens on any install I have. Doesn't matter which computer. When I see it on a fresh install on a new computer I wonder. Support will not even make a peep on this one.

If there is hidden meta stuff attached to those JPGs, The site don't know about it I am sure. I know Melanie personaly.

con]]> http://www.dslreports.com/forum/remark,16751194 Mon, 21 Aug 2006 16:45:59 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16741833 SpannerITWks : controler

Hey well i'm NO expert you All know that, but when i saw Irondell's post about the 'clean' JPGs, a bell immediately started ringing. Yeah, the bells the bells lol.

Anyways as cleaning image files " can " remove ALL MetaData, i'm " presuming " there " may " be a connection there. Quite why spoolsv.exe needs to be running @ the same time i'm not 100% sure.

But as i was just writing the above, the bells started again lol. Didn't the WMF exploit fiasco have some connection with spoolsv.exe, or was it the TextCreateRange exploit, or maybe both ?

Possibly someone can verify this, or otherwise !

Spanner
--
I Only Know What I Know, But I'm Learning all The Time - Stay Safe - Spanner intheWorks
/SpannerITWks]]> http://www.dslreports.com/forum/remark,16741833 Sat, 19 Aug 2006 23:09:21 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16741610 controler : Spanner

I never got a reply from DCS on this and most likely never will. It only happens with spoolsv.exe running.

So you say it is the meta feature huh that they use to tag files?]]> http://www.dslreports.com/forum/remark,16741610 Sat, 19 Aug 2006 22:17:37 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16739973 SpannerITWks : Irondell

In a word, MetaData ! Normally hidden extra data within the file, sometimes can be used for dodgy purposes.

Spanner
--
I Only Know What I Know, But I'm Learning all The Time - Stay Safe - Spanner intheWorks
/SpannerITWks]]> http://www.dslreports.com/forum/remark,16739973 Sat, 19 Aug 2006 16:23:21 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16739836 anon : I have noticed that if you 'clean' JPGs with this »www.snapfiles.com/get/jpgcleaner.html ProcessGuard doesn't give out the usual alert. Why is that I wonder??]]> http://www.dslreports.com/forum/remark,16739836 Sat, 19 Aug 2006 15:55:43 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16660707 Nogard is me : I don't have BoClean running, I do however have PG running on all cylinders. I didn't get the message at all. I have Print Spoiler running also. ]]> http://www.dslreports.com/forum/remark,16660707 Mon, 07 Aug 2006 14:48:45 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16658561 controler : yes all you need is the spooler running in task manager.
It still does not answer why Pg alerts only on those files and not others on my drive. Has to be a way PG tags them.

controler]]> http://www.dslreports.com/forum/remark,16658561 Mon, 07 Aug 2006 08:26:52 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16658508 norwegian :
Ah it was just setting up the printer for a hard copy, and PG was alerting to it. Love the software, but if I stay with KIS, it will not be on my machines. It was my first layer of defense for ages. :(

Kaspersky are advancing too much :) ]]> http://www.dslreports.com/forum/remark,16658508 Mon, 07 Aug 2006 08:06:36 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16658479 controler : nick r over at Wilders was able to figure out you need the print spooler running before PG will alert.
I dissable the spooler with task manager and I do not get an alert either. ]]> http://www.dslreports.com/forum/remark,16658479 Mon, 07 Aug 2006 07:56:58 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16658414 norwegian : I didn't click Nate, but clicked on Melanies file a dozen or so times, and opened it with various imaging software, but nothing unusual. Reboot and Watcher didn't record any changes in file structure either. ]]> http://www.dslreports.com/forum/remark,16658414 Mon, 07 Aug 2006 07:38:32 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16658370 controler : thanks norweigen

You have to be running the latest version, everything ticked and has to be either Melanie or Nate form the website. Running XP]]> http://www.dslreports.com/forum/remark,16658370 Mon, 07 Aug 2006 07:15:31 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16656785 norwegian : Got nothing, other than a picture, opening with various image tools. PG though when running paint(windows) asked permission for paint program, and svchost as well after, but otherwise no other warnings. All the time I ran PG, never saw the service/driver request.

Maybe I missed something ? ]]> http://www.dslreports.com/forum/remark,16656785 Sun, 06 Aug 2006 22:04:04 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16656636 norwegian : I have had it uninstalled, but willing to try installing the free version, if needed. Chicken indeed ;)]]> http://www.dslreports.com/forum/remark,16656636 Sun, 06 Aug 2006 21:43:07 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16656584 controler : Chickens]]> http://www.dslreports.com/forum/remark,16656584 Sun, 06 Aug 2006 21:36:38 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16655464 controler : And you have BoClean installed?]]> http://www.dslreports.com/forum/remark,16655464 Sun, 06 Aug 2006 17:58:55 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16655424 controler : Did you have exe protection enabled,Plus all 4 globals checked?

con]]> http://www.dslreports.com/forum/remark,16655424 Sun, 06 Aug 2006 17:47:07 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16655387 Nogard is me : I tried for about 5 minutes and I didn't get a pop up saying anything about explorer tring to install a driver. ]]> http://www.dslreports.com/forum/remark,16655387 Sun, 06 Aug 2006 17:40:23 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16655008 controler : We need to get more users verify this or nothing will be done.

What I wonder about it how does PG tag these files? How does it know one from another? It isn't the size, I tried that. I even resized the dang things and still alerts.
I have a ton of JPG's myself and PG only alerts on a few.
Can get no answer what so ever from DCS. Wrote them pri and in their so called forum.
Love the program, Hate their support now.

con]]> http://www.dslreports.com/forum/remark,16655008 Sun, 06 Aug 2006 16:21:13 EDT Re: ProcessGuard http://www.dslreports.com/forum/remark,16654990 Clone 171162 : Chalk up one more verification. I've been getting this PG alert with literally dozens of jpgs, ever since upgrading to V3.4 final. Its probably a bug?]]> http://www.dslreports.com/forum/remark,16654990 Sun, 06 Aug 2006 16:18:03 EDT ProcessGuard http://www.dslreports.com/forum/remark,16654778 controler : Hello

I am seeing something wierd with PG. I and one other user has verified this. I saw it on my XP Pro desktop, then today installed PG on my laptop and see it there also.
I can't get a reply from DCS and not many are even trying it out over at Wilders.
I was wondering sif some of the users here could give it a try?

All you do is follow these steps.

1. go to »www.kkln.com/

2. click on the tab On The Loon

3. Click on Melanie

4. When the page loads, right click on her picture.

5. Click save as to desktop.

6. Open the file with Windows picture and fax viewer.

7. If Pg doesn't peep at first, close the picture and try it again. Sometimes takes twice.

8. Open the picture and click the magnify button.

On mine and one other posters system, PG alerts saying explorer.exe is trying to install service/Driver

controler]]> http://www.dslreports.com/forum/remark,16654778 Sun, 06 Aug 2006 15:35:07 EDT