log window : "unknown flag"

[gkweb]

While i was setting up my PG (full version), some executables at start generated some lines in the log window, i gave them "allow flags" consequently.
One of this line was strange :

{QUOTE->
[22:38:22] - [T] - c:\program files\ssm\syssafe.exe [1964] tried to gain Unknown Flag [001F03FF][001F03FB access on c:\windows\system32\svchost.exe [984]
<-QUOTE}

Since i carefully configured PG, i don't have anymore this message (i just got it once). I just wanted to report this in case it could be usefull.

[gkweb]

with my "clean" current configuration, i got this :

{QUOTE->
[12:45:07] - Process Guard Protection is ACTIVE
[12:45:12] - [T] - c:\program files\ssm\syssafe.exe [1940] tried to gain Unknown Flag [001F03FF][001F03FB access on c:\windows\system32\svchost.exe [996]
<-QUOTE}

SSM still works normally anyway.

[Gavin - DiamondCS]

Can you remember what you were doing at the time ? :)

[spy1]

Can I add another one to that?

[09:27:30] - [P] - g:\windows\system32\svchost.exe [948] tried to gain Unknown Flag [80000000][00000000 access on g:\windows\system32\csrss.exe [612]


As far as I know, that was when I started up this morning. Pete

[gkweb]

If i remember right the two times it was just after the startup
(but i don't have the line after each startup).

[Gavin - DiamondCS]

Hold tight, a couple of problems which are related :) Jason will be by soon enough to fill us in more

[Pilli]

This after adding Kerio to PG's list:

[20:45:51] - [T] - c:\windows\system32\csrss.exe [952] tried to gain Unknown Flag [001F03FF][001F03FB access on c:\windows\system32\svchost.exe [1476]

[Jason_DiamondCS]

Thanks guys, this is helpful and should be fixed in the next version.

-Jason-

[siliconman01]

Welcome to DiamondCS Process Guard.
This program does not need to be running for your system to be protected.

[04:48:38] - Window Log Started
[04:57:43] - [T] - c:\windows\system32\csrss.exe [668] tried to gain Unknown Flag [001F03FF][001F03FB access on c:\windows\system32\svchost.exe [1028]

I get this "unknown flag" when activating MS Outlook 2003. FYI

[Gavin - DiamondCS]

Yep I think we are going to release a new version very soon since this is fixed and now the log off problem is fixed. Jason must have found it just after I left tonight.. I missed out on the programming fun again ! ;D

[DolfTraanberg]

Ok, I have a simular one:
[22:24:46] - [P] - c:\program files\symantec\pcanywhere\awhost32.exe [464] tried to gain Unknown Flag [02000000][00000000 access on c:\winnt\explorer.exe [604]

awhost32.exe has every allowed option enabled
Dolf