AppDefend and Physical Memory Access...

Hi nameless1,

Scraped together a bit of ambition after a long day...ATM I am running GSS, Ewido, NOD32, Outpost, CommView, TrueCrypt (with an open volume), SpeedFan, AnyDVD, Nero, and VMware (with a Windows 98 guest host running). Had to pass on RivaTuner since I have an ATI card, and I don't have access to Virtual PC. Anyway, no hangs related to physical memory access. In fact, zero physical memory access alerts from GSS for any of these apps.

What's more interesting, though, is that I usually run VMware on my other desktop. There, VMware does generate physical memory alerts from GSS. One obvious difference between the two machines is that the other has NVIDIA graphics. Just speculating, but perhaps these hangs are related somehow to graphics hardware/memory/drivers.

Nick

 

Thanks, and I can't believe you took all that time and trouble (thank you very much). RivaTuner does work with ATI cards, but I kind of doubt that RivaTuner is at fault with this problem.

The problem being described in this thread isn't unwanted physical memory access alerts, but rather near system freezes when the physical memory alerts do occur.

Some of the applications I listed don't generate physical memory alerts... They were just the applications I thought might be related to the problem, since they install drivers.

So to have any hope of reproducing the problem, you would have to generate a physical memory alert. If you have AD fully configured already, you would have to find an application rule that allows physical memory access, and set it back to "Default". Then you would run the application (and do whatever is needed) to make the alert be generated.

It makes no difference which application generates the alert...

For example, to reproduce the problem on my system, I can take any application rule in AD that I currently have set up to allow physical memory access (for example, ezmerge.exe from http://www.boilsoft.com ), and set it to Default, or "Ask User / Block", or "Ask User / Allow". Then I'd use ezmerge.exe to join video files. Bang, I get an alert, and the system comes to a standstill.

 

Just tried that on both desktops using VMware as the app requiring permission to access physical memory. On the ATI (9200 Pro) desktop, no alerts (as before)...on the NVIDIA (6600 GT) desktop, I get alerts but no hanging. When I get a chance, I will test the remaining apps on the NVIDIA desktop as well.

Nick

Edit...I should mention that I have run every private and public AD beta and have never seen the access physical memory alert hang any of my systems. What's striking to me, though, is that I never see any physical memory alerts on my ATI-based desktop.

 

Hi Nameless,

Have you tried running SDTRestore which requires physical memory access?
http://www.security.org.sg/code/sdtrestore.html

Its possible that all your alerts are related to one thing, but SDTRestore may be doing a physical memory alert which is different to the others and shouldn't hang your system. This would be a useful test to see if EVERY physical memory alert hangs your machine, or only the certain type probably caused by the NVIDIA drivers.

 

Hah, thanks Jason, looks like you are onto something. I ran SDtrestore 0.2, and got numerous physical memory alerts, but no hanging. (Numerous, because I hit "Block Once" a few times.)

So it may be related to NVIDIA video drivers? I also run an NVIDIA nForce2-based mainboard.

In case it matters, I am running the version 81.98 WHQL GeForce drivers.

 

Hi nameless,

It doesn't really matter what the drivers are. Keep an eye out for the next beta which should have this issue resolved. Hopefully anyhow, as I cannot replicate it on my systems, though I have a pretty good idea what it is.

 

I told you everything would get fixed by this beta lol

Now Jason, you really should stop talking about that beta each two post you make now, or you'll see some angry impatient ppl that will spam your forum with the migthy question that start with "when" end end with "next beta ?"

The new year would be a great time isnt it

 

Hi f3x, the beta will be just around the corner.

 

This solve the misterious third componment

Ghost Security :
AppDefend - Protect your applications
RegDefend - Protect your registry
NfoDefend - Protect your informations*

* Now with the new desinformation center, fool your friend and viruses !

Now the very worst thing you can do is to talk about the imrpoved log tab

 

Post and attached pic removed. No politics please according to our TOS.

Edit:
Off topic post removed.

 

The only application I have noticed this problem with was Gaim, but it was the new beta version that they have available.

I don't think it's AppDefend but rather how the the problem application was built/coded.

In any event, Jason has said he is working on fixes for this in the next version which is good news.

 

Hi Jason,
Can you give us a hint on how far the corner is away?