PDA

View Full Version : ProcessGuard and BoClean

mrgeek
November 9th, 2004, 10:54 PM
Installed ProcessGuard, I also have BoClean installed. Since BoClean is a memory scanner, do I need to check the box to allow any of the Boclean components access to physical memory , or am I ok leaving the boxes unchecked?
nick s
November 9th, 2004, 11:05 PM
-{ Quote: "Installed ProcessGuard, I also have BoClean installed. Since BoClean is a memory scanner, do I need to check the box to allow any of the Boclean components access to physical memory , or am I ok leaving the boxes unchecked?" }-
Hi mrgeek,

These settings for BOClean are working well for me. No alerts in the PG log regarding BOClean.

Nick
bones
November 10th, 2004, 05:56 AM
It shows up every 5 seconds in my Alert log. How to get it not to log?
mrgeek
November 10th, 2004, 09:06 AM
My settings are the same, except for allowing Global Hooks. I will check that box also. Thank you.
redwolfe_98
November 11th, 2004, 10:45 AM
mrgeek, i am not getting that logging of boclean.. i am using the full version of pg3, not the free version.. in addition to the default settings, i have boclean set to allow global hooks and to access physical memory.. it might not be necessary to allow it access to physical memory, but i figure that it won't hurt to allow it..
nick s
November 11th, 2004, 09:33 PM
-{ Quote: "It shows up every 5 seconds in my Alert log. How to get it not to log?" }-Hi bones,

I've been using PG + BOClean on two systems for over a year now and have never seen that behavior in PG logs. BOClean requires the Install Global Hooks option, otherwise you will get one blocked "global Shell hook" alert per session. I played around with settings for both apps but could not duplicate what you are seeing. Do you have termination protection enabled for BOClean (boclean.exe)? If you do, what apps have you given permission to terminate other protected apps? Also, if I terminate boclean.exe, it does not automatically restart. Do you see boclean.exe starting/stopping in Task Manager?

Nick
bones
November 11th, 2004, 09:43 PM
-{ Quote: "Hi bones,

I've been using PG + BOClean on two systems for over a year now and have never seen that behavior in PG logs. BOClean requires the Install Global Hooks option, otherwise you will get one blocked "global Shell hook" alert per session. I played around with settings for both apps but could not duplicate what you are seeing. Do you have termination protection enabled for BOClean (boclean.exe)? If you do, what apps have you given permission to terminate other protected apps? Also, if I terminate boclean.exe, it does not automatically restart. Do you see boclean.exe starting/stopping in Task Manager?

Nick" }-
Yes, termination protection is added by default. Looking through other permissions, these programs have permission to terminate other programs....... CSRSS.exe, taskmgr.exe, and winlogon.exe. BOclean has always started again immediately after manually shutting it down. I always wondered why that happened!

So, what sould I try?

Tnx,
bones
nick s
November 11th, 2004, 10:01 PM
-{ Quote: "Yes, termination protection is added by default. Looking through other permissions, these programs have permission to terminate other programs....... CSRSS.exe, taskmgr.exe, and winlogon.exe. BOclean has always started again immediately after manually shutting it down. I always wondered why that happened!" }-
Winlogon.exe is not given the terminate protected apps option in Learning Mode (on my systems). That would be the first thing I would look at.

Nick