EQS starts before Online Armor

Hey guys I installed both and now, when I start the machine, EQS asks if I want OA server to start...

isn't that funny? I think it means that if EQS were a malware, Online Armor wouldn't have stopped it as it ran before OA service started...

LOL

 

Yep,

EQS implemented with the latest official version early startup and late shut down protection. I am convinced malware shifts to drive by infections, system logon/shutdown and the user kernel space. So there is where you should focus on when choosing your layered defense. D+ of Comodo also does a good job at shut down, have not tested it with startup.

Regards Kees

 

this reminds me when I changed the startup order of Process Guard service

I had changed its driver's startup from "automatic" to "system"

then in the registry, in the key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DCSPGSRV

I created a new string value I named Group with data ProcessGuard

then in the key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder

I edited the data in the value List adding ProcessGuard between PNP_TDI and NDIS:

Code:

PlugPlay
PNP_TDI
ProcessGuard
NDIS
TDI

so when I rebooted ProcessGuard started before Sygate

these attached are very very old screenshots

 

so any malware can put itself before any security app just by editing those keys?...

 

that was I did, and seeing that worked (at the following startup PG's security tab showed the "new entries") I did the same with the symantec services (some of them already had the value "Group") so nearly the whole norton's services started before the spooler and after the sygate, because I placed them in the List just before the "SpoolerGroup"

about the malwares, I can only guess...