Process Guard Activity

Hi,

I've been having a BSOD lately when I right click a file - Strange.

Any way I fired up File Monitor and noticed that process Guard and Exploer seem to error for some reason.

I get a lot of entries like these, any ideas? anyone



21:17:11 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
21:17:11 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
21:17:11 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
21:17:12 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
21:17:12 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
21:17:12 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
21:17:12 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
21:17:13 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE

 

Getting the same stuff now. Win2k3 SP1.

I am guessing it is some kind of SP1 bug.

Maybe you got it for XP SP2?

I am going crazy trying to fix it.

 

By the way, it doesn't matter what explorer is opening...

I mean to say it is not a processguard problem. If you uninstall
process guard then whatever process is next for explorer to
"check out" for the context menu will show up in file monitor.

For example, I saw this with winrar's hook so uninstalled winrar,
then file monitor just showed explorer spamming on metapad.exe
a simple notepad replacement (when I right click text files).

I have to think explorer.exe is the problem and I have experienced
this kind of thing for year and years...

 

This is a file access query, ProcessGuard protects its own files from being deleted. Some access will fail, but any access really needed is always allowed.

All you need to know is that programs cannot delete the files while protection is enabled, even if procguard.exe is not running. FAILURE may be misleading from that log, depending on what explorer.exe was trying to do. Most likely getting the directory listing and refreshing icons, which would have actually worked - as you can verify by just looking in the folder