GSS and application Blocking

Hi,
Somthing is wrong with my gss (v 1.110). I have both appdefend (v1.000
) and regdefend (v2.050). My os is WIN XP SP2 with latest updates.

Normally when you block application from starting in appdefed the application is terminating. In my case application is suspended and is visible in sysinternals process explorer as gray. I cannot kill that application nor resume it.

br.
Darek

 

Hi Orion.

I'll have a crack at this one.

I tried an app a while ago (a rootkit scanner if i remember correctly),anyway,it showed some processes that i thought had shut down,and i ask around about it and a college gave me an answer along the lines of below,sorry i can't remember what he said exactly.

It's just due to some traces of the process being left behind on the drive or in memory after they have been shut down,basically,windows not cleaning up after itself properly. Something like that i think.

But your situation my be similar,the process tried to start,some traces of it were created which AD spotted and so gave you an alert,when you denied it,no more of the process was created,and then windows didn't cleanup the mess properly

 

A number of changes have occurred to the way execution occurs with AppDefend so with the next version it would be good to know if you saw this same problem or not. It's hard to know if it is an AppDefend problem or not at this stage.