Blocking & Un-blocking

Discussion in 'Ghost Security Suite (GSS)' started by Rico, Feb 3, 2006.

Thread Status:
Not open for further replies.
  1. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    1,695
    Location:
    Texas
    Hi Guys,

    Found "Ipodservice.exe" as a running process - I went to "services" stopped the service, then disabled IPodservice.exe. The next time I started Itunes RD asked if I should allow/block Ipodservice.exe. I chose "block." Note I don't have an IPod yet. Okay! If I choose (from RD) always block, how could I remove the block & allow ITunes to allow the service. Or simpler can & how do you re-allow in RD, after choosing always block/allow.

    Thanks
    rico
     
  2. tonyjl

    tonyjl Registered Member

    Joined:
    May 25, 2004
    Posts:
    287
    Hi Rico.

    Yes you can,select 'always block' from the alert pop-up,then if you open RD,you should see on the left an app group called 'ipodservice.exe',click on it,you'll see the registry key that it's blocked from accessing. Highlight the rule and at the bottom you'll see a box with two options,allow and block,just select allow,and it'll be unblocked.

    The way i do it sometimes,if disableing a service doesn't work,is end the service,close any appz that use it,then i just compress the file with winzip,or whatever you have. In your case,find where ipodservice.exe is located,right-click it,in the contextmenu should be something like 'compress to ipodservice.zip'. After that,delete the original file. When you want it running again,just extract the file.

    Hope that helps.
     
  3. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    1,695
    Location:
    Texas
    Thanks Tony, new it had to be simple just never did it before.

    Thanks again
    rico
     
  4. Rilla927

    Rilla927 Registered Member

    Joined:
    May 12, 2005
    Posts:
    1,710
    Hi Tonyjl, Rico:)

    I don't mean to bust in, but I'm in awe after I read this thread.

    So you can unblock things in RD now, when did Jason add that? I asked him about it and he said he was considering it. I bought it 10 mths ago and me being a novice didn't know you couldn't unblock something and I made a mess of my computer so I left it off ever since. Good news!

    Rico I see you are from Azusa. I lived there also when I was a little kid, 703 East Haltern, whole corner lot across from Azusa High School at stop sign.
     
  5. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    1,695
    Location:
    Texas
    Hi Tony,

    I told RD to always block ipodservice, I see it in what appears to be the log, section, can' seem to do anything here (see first pic), then from RD's configure ipodservice is a no show, (see 2nd pic), how do I remove this block?

    Note! I think the first pic. is/was too big I'll try again. Note though that ipodservice is a no show
     

    Attached Files:

    • rd.jpg
      rd.jpg
      File size:
      95 KB
      Views:
      174
  6. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    1,695
    Location:
    Texas
    Hi Tony,

    My first pic was too large new pic, from choosing RegDefend, next to settings. This portion of RD does not allow anything, to be done.
     

    Attached Files:

    • rd12.jpg
      rd12.jpg
      File size:
      92.7 KB
      Views:
      175
  7. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Rico,

    As you can see from the log, it is in fact Services.exe that wants to create the Ipodservice key

    So go to the Application Rules in the Main screen, and find the Services.exe rules group ('folder').

    In there you'll find the rule you apparently created, blocking services.exe from creating that key, and it's therefore there that you can modify or remove that rule.
     
  8. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    1,695
    Location:
    Texas
    Hi Tony, Perhaps I have a mental block that needs removing; however, i do not see anything to unblock? see pic.
     
  9. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    1,695
    Location:
    Texas
    Oops! I forgot to hit upload see previous post
     

    Attached Files:

    • rd33.jpg
      rd33.jpg
      File size:
      52.4 KB
      Views:
      151
  10. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Your last picture is from the RD log, and you're absolutely right there's nothing to tweak there.

    In your first picture however you'll notice that there's a Services.exe subfolder in your application rules, and that's where you gotta go to remove or tweak the rule
     
  11. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    OK, so select the rule, and hit Remove. That will allow you to start afresh.

    Or alternatively, enter the correct path to the Ipodservice Service (you can copy that from your log), and tell RG to allow modifying and creating keys and values for it by checking the appropriate boxes.
     
  12. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    1,695
    Location:
    Texas
    Hi Tony.

    Regarding post #9, I scrolled to the right & saw a column header "block" below block it said "create key" I higlighted this then right clicked & said remove rule. Next I started Itunes & RD prompted me to allow/block the creation of ipodservice.

    I hope this was correct? Did I remove portection for all services, that RD was watching. I would have thought I should have seen ipodservices & just allowed it.

    Help!!!
    rico the blocked
     
  13. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Rico,
    Let's do it from scratch.

    Go into that Services.exe folder, rightclick on the rule(s) in there, and choose 'remove rules'
    You will now have an empty Services.exe folder

    In that folder, press the 'Add Rule' button

    In the Add Rule screen, RIGHTclick in the Registry key box, and paste the following in there:

    HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\Ipodservice**

    Then press the Add Rule button and press the 'x' in order to close the 'Add Rules' Window
    (continued)
     

    Attached Files:

    • Ipod.gif
      Ipod.gif
      File size:
      16.2 KB
      Views:
      146
  14. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Now in the main screen, check these boxes to block without prompt.

    Still, allowing that particular service will not hurt either....


    Gotta go now, and grab some sleep: past 1 am over here...

    Good luck! :)
     

    Attached Files:

Thread Status:
Not open for further replies.