write access on TDS

[Shelb]

Hi,
Sorry if this has been addressed before, but I keep encountering the following message regarding a write attempt on TDS from Process Guard. It has occured several times over the past few nights. I am using the version 1.15

{QUOTE->
[22:04:47] - [P] - c:\windows\system32\svchost.exe [944] tried to gain WRITE access on c:\program files\tds3\tds-3.exe [2364]
[22:05:48] - [P] - c:\windows\system32\lsass.exe [640] tried to gain WRITE access on c:\program files\tds3\tds-3.exe [2364]
<-QUOTE}

Is this something to be concerned about? Is there any reason for these processes to gain access over TDS?
Thanks,
Shelb

[DolfTraanberg]

Hi Shelb,
Those processes should already be in your protected list. Just give them allowed rights. And no, you don't have to be concerned about this.
You will see in PG all kinds of access attempts but these are legitimate
Dolf

[Shelb]

Thanks for the reply!
I am still using the demo version and cold only protect one process.
I will be purchasing a license shortly.
Aside from critical system processes, firewall, antivirus and my DiamondCS products is there anything else you would suggest putting on the protected list?

[Jason_DiamondCS]

Any program which starts as a service, and any program which starts automatically when your system is booted. Ensure that if you are adding Windows services to be protected you give them proper access. Process Guard adds all the common services itself so you shouldn't have a problem with the Windows services themselves.

I suspect in the future to try and get around programs like Process Guard, that malware won't target specific processes, but rather enumerate all running processes and find one that is suitable for its needs. Since Process Guard handles all the common services which are always running and have all the access, malware is extremely limited in what it can do, even if it manages to get into a process, it would have to be something like notepad. :)

Another suggestion would be to add all the programs which have internet access in your firewall, this way no trojan will be able to inject into a program which has real internet/network access.

-Jason-

[DolfTraanberg]

hmm, when your firewall and PG have been right configured you won't need TDS or PE ;D