Odd Message

Discussion in 'ProcessGuard' started by joeblow, Jan 28, 2004.

Thread Status:
Not open for further replies.
  1. joeblow

    joeblow Registered Member

    Jan 23, 2004
    I saw 5 lines of this message in the log:

    [end task] c:\windows\explorer.exe [1012] was blocked from terminating an application using end task.

    What's odd is that explorer.exe is in the list of pg's programs and has 'terminate' among its allowed privileges.

    Did I misunderstand the help file? I thought it said that allowed privileges take precedence over blocked privileges, so shouldn't explorer.exe be allowed to terminate anything?
  2. Pilli

    Pilli Registered Member

    Feb 13, 2002
    Hampshire UK
    Your understanding is correct I think :)
    It is the logging that is a bit obscure, this is dealt with in the new version 1.250 due for release within the next few days.
    The new logging should enable you to see what explorer is trying to End task which will help with your rule making.
  3. Jason_DiamondCS

    Jason_DiamondCS Former DCS Moderator

    Nov 11, 2002
    Perth, Western Australia
    End Task isn't part of the normal "Terminate" allow/block. It is handled by a General Protection option and when that is enabled no End Task termination can occur.

    Explorer will sometimes try to End Task applications which are not responsive which is why you got the log.

Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.