CRASH!!

Discussion in 'ProcessGuard' started by worldcitizen, Oct 15, 2004.

Thread Status:
Not open for further replies.
  1. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    I had my PC and ALL applications working perfectly all week without erros or crashes so today I decided to install PG. (latest version)

    Everything went ok until Giant Anti-Spyware started it's scheduled 2am scan. About 2 seconds into the scan my PC crashed and rebooted. No BSOD and I couldn't get the infor from Dr Watson because there was no dump file there.

    I checked in the XP administrative logs and there were no failures.

    I was typing in the serial number for Bubble Shooter when the Gian scan began then my system rebooted. You can see the details here. I didn't open up real player but there is something about real player there but it could have been because the game uses real player for it's sound and/or Giant does use real player for AVI files so that explains real player being opened.

    I later allowed Giant access to memory which it scans and I did a scan and got no crashes so what could it have been. This has only happened since I installed PG today. For the past 2 weeks Giant has been scanning everyday at 2am without problem or crashes. Hope someone can help otherwise I'll just have to shelve PG again.

    Dave

    The only piece of info I have is in the PG log:

    Sat 16 - 01:59:44 [EXECUTION] "c:\program files\absolutist.com\bubbles5\bs5.exe" was allowed to run
    [EXECUTION] Started by "c:\windows\explorer.exe" [624]
    [EXECUTION] Commandline - [ "c:\program files\absolutist.com\bubbles5\bs5.exe" ]
    Sat 16 - 01:59:50 [EXECUTION] "c:\windows\system32\notepad.exe" was allowed to run
    [EXECUTION] Started by "c:\windows\explorer.exe" [624]
    [EXECUTION] Commandline - [ "c:\windows\system32\notepad.exe" c:\documents and settings\david\desktop\serial bubble shooter.txt ]
    Sat 16 - 02:00:02 [EXECUTION] "c:\program files\giant company software\giant antispyware\giantantispywaremain.exe" was allowed to run
    [EXECUTION] Started by "c:\program files\giant company software\giant antispyware\gcasdtserv.exe" [2148]
    [EXECUTION] Commandline - [ "c:\program files\giant company software\giant antispyware\giantantispywaremain.exe" -scan -schedule -withui -withresultsui ]
    Sat 16 - 02:00:13 [EXECUTION] "c:\program files\real\realplayer\realplay.exe" was allowed to run
    [EXECUTION] Started by "c:\program files\common files\real\update_ob\realsched.exe" [1924]
    [EXECUTION] Commandline - [ "c:\program files\real\realplayer\realplay.exe" /runevent "c:\program files\real\realplayer\rpwa3260.dll" watchfolders_timer ]

    ---Process Guard Log Started---
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Dave,
    Does this .exe have server rights allowed in PG?
    Sorry I have no idea what "Bubbles" is :)

    I notice that real player was doing an update or something like that and there is a reference to rpwa3260.dll and I am wondering what allowances etc. you have for real player?

    How long did you leave PG in learning mode before rebooting twice and did you enable the four gerneral tabs before doing the second reboot?

    It is important that you try all your trusted and security programs before the final reboot so that learning mode can make adjustmernts to the protection list before learning mode is switched off.

    Thanks. Pilli
     
  3. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    Hi Pilli,

    I gave plenty of time for everything before rebooting twice but I forgot to run a Giant scan in learning mode and as soon as the scheduled scan began, as you can see, 2 seconds later my PC went black.

    I did enable the 4 general tabs (you mean the 4 global protections?) but I can't remember when I enabled them.

    What I did do was give all of Giant's executables all allowances except Secure handle. I ran another scan and no crash but that was a manual scan. Will the schedulaed scan conflict with PG?

    As for real player and realsched.exe they are in the list and I haven't given them any special allowances but Giant accesses realplayer when it scans manually to show certain graphics. With the scheduled scan I could not see a real player file but the pop up window is coloured so it's somewhere and probably needed realplayer for it to run although I couldn't see anything for scheduling in the Giant folder. It's a command I think. Real Player seems to run video and audio because I just ran a music video so I don't know what caused the crash. All I know is that 2 seconds into the SCHEDULED scan the PC rebooted.

    The scheduled scan runs everyday at 2am and it has never crashed in over a month except today after it ran for the 1st time with PG installed so I know there's nothing wrong with Giant but it looks like it had a fight with PG and PG got bitchy. LOL


    Dave
     
  4. jpc

    jpc Registered Member

    Joined:
    Jan 17, 2004
    Posts:
    45
    Location:
    France
    I Have the same problem : reboot if I try a scan with Giant and PG protection enabled.
    I have sent a mail to support@giantcompany.com. They have answered me :

    "Thank you for contacting GIANT Company Software, Inc.
    We aren't currently aware of incompatibility issues with Process Guard. However based on some of the memory and process checks we do it is possible Process Guard is being asked to monitor a great deal of data going through it. Can you describe your process guard settings so we can try to reproduce your issue? Also can you locate the file "errors.log" on your computer if it exists. This file will be located in your Giant AntiSpyware Program folder, which by default is c:\program files\giant company software\giant antispyware
    Once located, can you attach this file to a reply email so we can see if we are logging any issues."

    I Have answered that for Process guard, I have tried with :
    - all global protection options cheked + Protection enabled -> reboot after about ten seconds of scan
    - all global protection options uncheked + Protection enabled -> reboot after about ten seconds of scan
    - Protection enabled uncheked -> scan all drives OK

    I have sent my errors.log
    "6::ln 0:Dépassement de capacité::gcasServ:modMonitors:GetStoredLastCollection::14/10/2004 18:36:52:1.0.333
    91::ln 0:Variable objet ou variable bloc With non définie::gcasServ:modMonitors:ScanHostFile::14/10/2004 18:36:52:1.0.333"
    It'is in french cause I use French Windows XP

    I am waiting for answer.
     
  5. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Ah Thanks for the clarifiation Dave.

    It is important that you do run apps Like Giant, AV AT & firewall before leaving learning mode as there is a lot of backround interaction with Process Guard before PG comes out of learning mode.

    If Giant runs it's own scheduling .exe this may need to be on the protection list and it may also need the allow service / driver install.

    Personally I am surprised Giant uses real player, I won't have real in any form on my pc's :) Although it is OK providing you stop it's phone homes etc.and if you really need it.

    In the latest betas Jason is down to fine tuning the driver, close measage handling and many other things in the user wish list. It is imply stunning now, so hopefully it will not be long until the full release.

    Oh. Before I forget, did you delete your old .dat files after installing V3 PB1
    not really necessary but it does help if you start clean with the betas. V2 .dat files are not compatible.

    I'm off to the pub for my Friday night binge now. :D

    Enjoy your weekend. Pilli
     
    Last edited: Oct 15, 2004
  6. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,049
    Hi Dave

    When I tested I ran it thru all it's paces and there was no issues with Process Guard (using the latest private beta) I did complete scans with Giant, but I didn't try any scheduled scans as I don't run schedule stuff, but let my puter sleep at night.

    You might try setting up a schedule scan to run at a time when you can watch it. Might see something that gives a clue as to what is going on.


    Pete
     
  7. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,106
    Location:
    USA
    UGHHH wait up !!!!!! DARN !! :)
     
  8. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Just to 100% clarify, this issue was found (very strange issue actually) and is now corrected 100% ! :) thanks for the help everyone and do enjoy the weekend
     
  9. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    Hi Gavin.

    You said this issue was corrected. What do I do now?

    Dave
     
  10. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Dave, I believe Gavin was talking about the private betas. :)
     
  11. worldcitizen

    worldcitizen Registered Member

    Joined:
    May 15, 2003
    Posts:
    530
    So you mean that it will be fixed in the next version?

    That would be great if so.

    Dave
     
  12. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Yes, Dave the "unusual" and rather obscure issue with Giant has been 100% resolved.:)

    Cheers. Pilli
     
  13. Jason_DiamondCS

    Jason_DiamondCS Former DCS Moderator

    Joined:
    Nov 11, 2002
    Posts:
    1,046
    Location:
    Perth, Western Australia
    I already mentioned in the other thread that this issue has been fixed in the latest PRIVATE beta's, indicating that it will be in the final release.

    Currently you can work around this by disabling protection PRIOR to scanning, and re-enabling after.
     
Thread Status:
Not open for further replies.