Global Hook question

wayne_b · Jun 1, 2004

Current PG configure

Does it cause problems problems to enable Allow Global Hooks for a Individual Trusted Application if one is unsure if needed or not, Trend Micro PC-cillin comes to mind, TSC.EXE in particular, after having problems with my ATI Control Panel, I set Allow Global Hooks and the problem stopped (Problem: ATI control panel icon taskbar would disappear after starting)

1 Jun 06:18:18 - [1 of 2] Success: Driver is active and secure.
1 Jun 06:18:18 - [2 of 2] Success: Process Guard's Protection is currently Enabled.
1 Jun 06:18:18 - General Protection Options
1 Jun 06:18:18 - [1 of 4] Block End-Task is disabled.
1 Jun 06:18:18 - [2 of 4] Block Appinit registry key is enabled.
1 Jun 06:18:18 - [3 of 4] Block Drivers/Services is disabled.
1 Jun 06:18:18 - [4 of 4] Block Global Hooks is enabled.

Process Guard v2.000 Protection List
Date Saved: 01 Jun 2004 at 08:48:01

Total items in list:- 26

001 - c:\program files\processguard free\dcsuserprot.exe
002 - c:\program files\tds3\tds-3.exe
003 - c:\program files\processguard\procguard.exe
004 - c:\program files\processguard\dcsuserprot.exe
005 - c:\windows\system32\lsass.exe
006 - c:\windows\system32\services.exe
007 - c:\windows\system32\svchost.exe
008 - c:\windows\system32\winlogon.exe
009 - c:\windows\system32\smss.exe
010 - c:\windows\system32\csrss.exe
011 - c:\windows\system32\wbem\winmgmt.exe
012 - c:\windows\system32\wbem\wmiadap.exe
013 - c:\windows\system32\drwtsn32.exe
014 - c:\windows\explorer.exe
015 - c:\program files\internet explorer\iexplore.exe
016 - c:\program files\outlook express\msimn.exe
017 - c:\program files\trend micro\internet security\pccmain.exe
018 - c:\program files\spywareguard\sgmain.exe
019 - c:\program files\spywareguard\sgbhp.exe
020 - c:\program files\trend micro\internet security\tsc.exe
021 - c:\program files\ati technologies\ati control panel\atiptaxx.exe
022 - c:\windows\system32\cthelper.exe
023 - c:\program files\trend micro\internet security\tmoagent.exe
024 - c:\program files\trend micro\internet security\pcclient.exe
025 - c:\program files\roger wilco\roger.exe
026 - d:\red storm entertainment\ravenshield\system\ravenshield.exe

---001-----------------------------------------------
Long Path :- c:\program files\processguard free\dcsuserprot.exe
Short Path :- c:\progra~1\proces~1\dcsuse~1.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---002-----------------------------------------------
Long Path :- c:\program files\tds3\tds-3.exe
Short Path :- c:\progra~1\tds3\tds-3.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- None

---003-----------------------------------------------
Long Path :- c:\program files\processguard\procguard.exe
Short Path :- c:\progra~1\proces~2\procgu~1.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- Allow Global Hooks

---004-----------------------------------------------
Long Path :- c:\program files\processguard\dcsuserprot.exe
Short Path :- c:\progra~1\proces~2\dcsuse~1.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---005-----------------------------------------------
Long Path :- c:\windows\system32\lsass.exe
Short Path :- c:\windows\system32\lsass.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---006-----------------------------------------------
Long Path :- c:\windows\system32\services.exe
Short Path :- c:\windows\system32\services.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---007-----------------------------------------------
Long Path :- c:\windows\system32\svchost.exe
Short Path :- c:\windows\system32\svchost.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---008-----------------------------------------------
Long Path :- c:\windows\system32\winlogon.exe
Short Path :- c:\windows\system32\winlogon.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---009-----------------------------------------------
Long Path :- c:\windows\system32\smss.exe
Short Path :- c:\windows\system32\smss.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---010-----------------------------------------------
Long Path :- c:\windows\system32\csrss.exe
Short Path :- c:\windows\system32\csrss.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---011-----------------------------------------------
Long Path :- c:\windows\system32\wbem\winmgmt.exe
Short Path :- c:\windows\system32\wbem\winmgmt.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---012-----------------------------------------------
Long Path :- c:\windows\system32\wbem\wmiadap.exe
Short Path :- c:\windows\system32\wbem\wmiadap.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---013-----------------------------------------------
Long Path :- c:\windows\system32\drwtsn32.exe
Short Path :- c:\windows\system32\drwtsn32.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---014-----------------------------------------------
Long Path :- c:\windows\explorer.exe
Short Path :- c:\windows\explorer.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- Allow Global Hooks

---015-----------------------------------------------
Long Path :- c:\program files\internet explorer\iexplore.exe
Short Path :- c:\progra~1\intern~1\iexplore.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- Allow Global Hooks

---016-----------------------------------------------
Long Path :- c:\program files\outlook express\msimn.exe
Short Path :- c:\progra~1\outloo~1\msimn.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- Allow Global Hooks

---017-----------------------------------------------
Long Path :- c:\program files\trend micro\internet security\pccmain.exe
Short Path :- c:\progra~1\trendm~1\intern~1\pccmain.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- Allow Global Hooks

---018-----------------------------------------------
Long Path :- c:\program files\spywareguard\sgmain.exe
Short Path :- c:\progra~1\spywar~2\sgmain.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- None

---019-----------------------------------------------
Long Path :- c:\program files\spywareguard\sgbhp.exe
Short Path :- c:\progra~1\spywar~2\sgbhp.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- None

---020-----------------------------------------------
Long Path :- c:\program files\trend micro\internet security\tsc.exe
Short Path :- c:\progra~1\trendm~1\intern~1\tsc.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- Allow Global Hooks

---021-----------------------------------------------
Long Path :- c:\program files\ati technologies\ati control panel\atiptaxx.exe
Short Path :- c:\progra~1\atitec~1\aticon~1\atiptaxx.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- Allow Global Hooks

---022-----------------------------------------------
Long Path :- c:\windows\system32\cthelper.exe
Short Path :- c:\windows\system32\cthelper.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- Allow Global Hooks

---023-----------------------------------------------
Long Path :- c:\program files\trend micro\internet security\tmoagent.exe
Short Path :- c:\progra~1\trendm~1\intern~1\tmoagent.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- Allow Global Hooks

---024-----------------------------------------------
Long Path :- c:\program files\trend micro\internet security\pcclient.exe
Short Path :- c:\progra~1\trendm~1\intern~1\pcclient.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- Read,Write,Terminate,Suspend,GetInfo,SetInfo
Option Flags :- None

---025-----------------------------------------------
Long Path :- c:\program files\roger wilco\roger.exe
Short Path :- c:\progra~1\rogerw~1\roger.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- Allow Global Hooks

---026-----------------------------------------------
Long Path :- d:\red storm entertainment\ravenshield\system\ravenshield.exe
Short Path :- d:\redsto~1\ravens~1\system\ravens~1.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- Allow Global Hooks
Click to expand...

Since I enabled Block Global Hooks I had to set Allow Global Hooks for these application due to Error as noted below;

Application: Rogerwelco.exe

Application Error:
*********************
Unable to initialize Direct Input
*********************

PG Log
*********************
1 Jun 08:39:50 - [HOOK] c:\program files\roger wilco\roger.exe [2896] was blocked from creating a global Low Level Mouse hook [0000000E][00000000]
*********************

Application: RavenShield.exe

Application Error:
*********************
OS: Windows XP 5.1 (Build: 2600)
CPU: GenuineIntel Unknown processor @ 2432 MHz with 511MB RAM
Video: RADEON 9500 PRO / 9700 (6444)

DirectInput Error

Couldn't set cooperative level
*********************

PG Log
*********************
History: UWindowsViewport::OpenWindow <- UGameEngine::Init <- InitEngine
1 Jun 08:43:20 - [HOOK] d:\red storm entertainment\ravenshield\system\ravenshield.exe [3520] was blocked from creating a global Low Level Mouse hook [0000000E][00000000]
*********************
Click to expand...

Since I trust these application and since I do get 'Hook Flags' such as listed below, just wondering if it's ok to give permission?;

1 Jun 09:04:24 - [EXECUTION] c:\program files\trillian\trillian.exe with commandline "c:\program files\trillian\trillian.exe" was ALLOWED to run
1 Jun 09:04:25 - [HOOK] c:\program files\trillian\trillian.exe [3808] was blocked from creating a global Mouse hook [00000007][00000000]
1 Jun 09:04:25 - [HOOK] c:\program files\trillian\trillian.exe [3808] was blocked from creating a global Keyboard hook [00000002][00000000]
1 Jun 09:05:31 - [HOOK] c:\windows\system32\notepad.exe [2396] was blocked from creating a global Mouse hook [00000007][00000000]
Click to expand...

Sorry if this looks confusing and/or appears to be a dumb Q

-wayne

Pilli · Jun 1, 2004

Hi wayne_b, Yes, the allow global hooks is needed by some programs to operate correctly. Trend micro probably needs access to one or more of your protected list files, this is quite normal especially if the program starts to create many log entries. If for some reason a program is changed then the checksum would warn you and you could make a decision as to whether to allow it or not, for instance after you have installed an update.

Regarding mouse hooks - Many programmes (such as Trillian & Netcaptor) require these for the "Mouse guestures function to work properly, they usually only make one or two log entries and I usually ignore them - this depends a lot on how you use theose functions I guess.

If you run TDS3 you will quite often be requested to allow a new dcsmutex.exe to be allowed as this update (usually weekly) comes as part of the TDS3 regular update file.

HTH Pilli

Log in or Sign up

Global Hook question

wayne_b Registered Member

Pilli Registered Member

Log in or Sign up

Global Hook question

wayne_b Registered Member

Pilli Registered Member

Useful Searches