Odd Message

Discussion in 'ProcessGuard' started by joeblow, Jan 28, 2004.

Thread Status:
Not open for further replies.
  1. joeblow

    joeblow Registered Member

    Joined:
    Jan 23, 2004
    Posts:
    7
    I saw 5 lines of this message in the log:

    [end task] c:\windows\explorer.exe [1012] was blocked from terminating an application using end task.

    What's odd is that explorer.exe is in the list of pg's programs and has 'terminate' among its allowed privileges.

    Did I misunderstand the help file? I thought it said that allowed privileges take precedence over blocked privileges, so shouldn't explorer.exe be allowed to terminate anything?
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Your understanding is correct I think :)
    It is the logging that is a bit obscure, this is dealt with in the new version 1.250 due for release within the next few days.
    The new logging should enable you to see what explorer is trying to End task which will help with your rule making.
     
  3. Jason_DiamondCS

    Jason_DiamondCS Former DCS Moderator

    Joined:
    Nov 11, 2002
    Posts:
    1,046
    Location:
    Perth, Western Australia
    End Task isn't part of the normal "Terminate" allow/block. It is handled by a General Protection option and when that is enabled no End Task termination can occur.

    Explorer will sometimes try to End Task applications which are not responsive which is why you got the log.

    -Jason-
     
Thread Status:
Not open for further replies.