Wilders Security Forums  

Go Back   Wilders Security Forums > Official Leapfrog Software Forum > FirstDefense-ISR Forum
User Name
Password
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

 
 
Thread Tools Search this Thread
  #1  
Old July 28th, 2006, 04:55 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default FDISR & ProcessGuard

I have been playing with ProcessGuard again and the bottom line is that ProcessGuard must be DISABLED, before you copy/update a snapshot, even removal of a snapshot can cause errors.
So my assumption is that you can work with ProcessGuard and FDISR, but you have to disable ProcessGuard during any FDISR-activity. But that is old news.

While the removal of a snapshot, with ProcessGuard=Enabled, caused real errors in the lower part of the processing screen, there is something very strange with copying a snapshot to a new snapshot, while ProcessGuard=Enabled.
There were 3 errors after copying, but those errors where mentioned in the upper part and not in the lower part of the processing screen

According the Activity Log, these are the 3 errors
Error #1
07/28/2006 21:48:07 Error - DCF::SetFileAttributes: Access is denied. (followed by this line)
07/28/2006 21:48:07 Windows error number 0x5

Error #2
07/28/2006 21:48:27 Error - DCF::SetFileAttributes: Access is denied. (followed by this line)
07/28/2006 21:48:27 Windows error number 0x5

Error #3
07/28/2006 21:48:27 Error - DCF::SetFileAttributes: Access is denied. (followed by this line)
07/28/2006 21:48:27 Windows error number 0x5


This is the last line of the Activity Log and this is also the message you get in the UPPER part of the processing screen, when the copy/update is finished.
07/28/2006 21:48:54 Copied 3.03 Gb (27209 files, 2471 dirs); Errors 3; 00:06:30.797

However in the LOWER part of the processing screen it says : Errors=0

Why didn't the lower part displayed : Errors=3 ?

Are there two kind of messages : UPPER error messages and LOWER error messages ?
And this has nothing to do with ProcessGuard, this is about FDISR.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #2  
Old July 28th, 2006, 11:46 PM
screamer's Avatar
screamer screamer is offline
Frequent Poster
 
Join Date: Apr 2006
Location: Big Apple USA
Posts: 921
Default Re: FDISR & ProcessGuard

Erik,
Here's my take; of course I could be wrong.

0x5 is "file Locked or Access Denied" error. I read somewhere that windows re-director flushes the contents of this file.

That's why you see it up top/processing screen (where it's happening) and not on the bottom since the copied/secondary snapshot never sees the flushed contents of the primary snapshot. I think it's more of a "windows issue" than a FD-ISR. If it were FD-ISR you would see some mention of it in one of the side tables "data added / data replaced / data removed"
Check Event Viewer for Event ID:26

...screamer
__________________
Cisco 851 + DIR-655 as Firewall NOD32 4.0.424.0 MalwareDefender2.1.0
Life Savers - FD-ISR & ShadowProtect

XPS 600, Pentium D "950" 3.4Ghz, 2GB Ram, 1 TB Seagate Barracuda + 2 160GB Seagate HDD, Dual nVidia GeForce 7800GTX
  #3  
Old July 29th, 2006, 03:05 AM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: FDISR & ProcessGuard

Quote:
Originally Posted by screamer
Erik,
Here's my take; of course I could be wrong.

0x5 is "file Locked or Access Denied" error. I read somewhere that windows re-director flushes the contents of this file.

That's why you see it up top/processing screen (where it's happening) and not on the bottom since the copied/secondary snapshot never sees the flushed contents of the primary snapshot. I think it's more of a "windows issue" than a FD-ISR. If it were FD-ISR you would see some mention of it in one of the side tables "data added / data replaced / data removed"
Check Event Viewer for Event ID:26

...screamer
You might be right. Of course these UPPER errors aren't striking and you don't expect to see errors there. The LOWER errors are striking, even when you don't read them, because FDISR will display an extra popup error message on top to warn you.

Another question. Whatever the reason may be, would you trust such a snapshot, with errors in the upper part and no errors in the lower part ?

For ProcessGuard & FDISR-users :
These errors only occured when ProcessGuard was ENABLED.
These errors didn't occur when ProcessGuard was DISABLED.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #4  
Old July 29th, 2006, 09:32 AM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 11,806
Default Re: FDISR & ProcessGuard

When I had ProcessGuard on my system, I found you absolutely had to disable it or the "dat" files of ProcessGuard weren't copied and of course PG would be messed up in the destination snapshot.

Worse still I discovered even when I disabled PG i was seeing errors copying to Archives. Those didn't stop until I uninstalled PG. Once I realized that, it was bye bye PG. There are now better solutions to the job PG does then PG.

Pete
  #5  
Old July 29th, 2006, 10:04 AM
screamer's Avatar
screamer screamer is offline
Frequent Poster
 
Join Date: Apr 2006
Location: Big Apple USA
Posts: 921
Default Re: FDISR & ProcessGuard

Quote:
Originally Posted by ErikAlbert
Another question. Whatever the reason may be, would you trust such a snapshot, with errors in the upper part and no errors in the lower part ?

For ProcessGuard & FDISR-users :
These errors only occured when ProcessGuard was ENABLED.
These errors didn't occur when ProcessGuard was DISABLED.

Normally I -think I might trust that situation. However since you have PG on your system, I certainly wouldn't trust the snapshot. I think the errors you are getting are unique. The types of errors I was getting W/ PG & FD-ISR are more reminicient to Petes. Therefore like Pete I canned PG Pronto!!

On my Laptop I get at least one error every night:
"Wrong date or filesize" "C:\Windows\Debug\Passwd.log"
The date always coresponds to todays date and filesize is 0kb
Last night I got 4 errors. Something to do w/ "Wrong Attributes" I'm too lazy to go down and look at the Laptop. I'll post these later for a solution.

...screamer
__________________
Cisco 851 + DIR-655 as Firewall NOD32 4.0.424.0 MalwareDefender2.1.0
Life Savers - FD-ISR & ShadowProtect

XPS 600, Pentium D "950" 3.4Ghz, 2GB Ram, 1 TB Seagate Barracuda + 2 160GB Seagate HDD, Dual nVidia GeForce 7800GTX
  #6  
Old July 29th, 2006, 01:52 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: FDISR & ProcessGuard

For the record, I don't use ProcessGuard, I only installed it for one day to do tests, which is too short to get a complete picture of PG.
When ProcessGuard was DISABLED, I didn't have any problems with creating new snapshots or removal of snapshots.
I don't like ProcessGuard, so I wasn't planning to keep it.
It was an opportunity for me to restore my system with ATI again, unfortunately the restoration was successfull.

I was more surprised by the UPPER errors, which I saw for the very first time.
Now I have to look for errors at two places on the processing screen.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #7  
Old July 29th, 2006, 03:42 PM
screamer's Avatar
screamer screamer is offline
Frequent Poster
 
Join Date: Apr 2006
Location: Big Apple USA
Posts: 921
Default Re: FDISR & ProcessGuard

Quote:
Originally Posted by ErikAlbert
For the record, I don't use ProcessGuard,...

I know, you've made that crystal clear

I'm suprised by the fact that you do not get the customary errors associated w/ ProcessGuard
I reveived errors whether or not ProcessGuard was enabled or disabled. Prehaps not as many when disabled, but none the less many more (and different) errors than you got.
__________________
Cisco 851 + DIR-655 as Firewall NOD32 4.0.424.0 MalwareDefender2.1.0
Life Savers - FD-ISR & ShadowProtect

XPS 600, Pentium D "950" 3.4Ghz, 2GB Ram, 1 TB Seagate Barracuda + 2 160GB Seagate HDD, Dual nVidia GeForce 7800GTX
  #8  
Old July 29th, 2006, 03:51 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: FDISR & ProcessGuard

Quote:
Originally Posted by screamer
I know, you've made that crystal clear

I'm suprised by the fact that you do not get the customary errors associated w/ ProcessGuard
I reveived errors whether or not ProcessGuard was enabled or disabled. Prehaps not as many when disabled, but none the less many more (and different) errors than you got.
Maybe I will get more errors like you, when I become a long time user of ProcessGuard. After all I used it just one day.
Or my total system likes ProcessGuard more than yours.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
 

Wilders Security Forums > Official Leapfrog Software Forum > FirstDefense-ISR Forum « Previous Thread | Next Thread »

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Settings
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -4. The time now is 06:45 PM.


Powered by vBulletin® Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2013, Wilders Security Forums