Opera wants to install a service/driver??

Discussion in 'ProcessGuard' started by Opera, Jun 20, 2005.

Thread Status:
Not open for further replies.
  1. Opera

    Opera Guest

    When I close Opera 8 an alert is triggered. Apparently, PG prevents the installation of a service/driver.

    Unfortunately, PG does not inform the user which driver/service is to be installed.

    The whole thing is a little bit strange. Can anybody confirm this alert?
     
  2. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,451
    Location:
    North Carolina, USA
    I currently use Opera 8.01 build 7642 and never has PG prompted with the allow/block driver/service install screen. I have not seen this on this version or any previous version of Opera. It sounds like something is wrong. Are you blocking the install? Is this repeatable as does it happen most of the time or just once?
     
  3. tuatara

    tuatara Registered Member

    Joined:
    Apr 7, 2004
    Posts:
    772
    I've seen this message in Opera only when it want to send something
    to the printer.

    Yes, i do think it is strange, if i want to print from Opera, i don't need this message. So i want to always allow all, allowed progs to send something to the printer.

    And it would be nice if you had some additional info,
    about WHAT kind of driver service it wants to install.
    So that you can make a normal decision if you want to
    allow this yes or no.

    And are there any situations that an allowed program
    must be stopped when it is trying to install a driver or service?
    For example when there is malware involved?

    And how will you know that?

    What i do is, scan with all my antimalware progs, and if those can't find anything, i switch the settings for the prog to 'allowed to install driver/server'.

    This is of course a strange way to look at things, but i will be very happy,
    if someone else here has got a better idea.

    BTW i also am using Opera 8.0 (build7561) and never saw this message in
    PG in another situation.
    At this moment, i am using TPF2005Pro and decided to disable PG
    because TPF2005Pro has the same features built-in.
    first i thought there was only a small overlap, after testing for quitte a
    few months i am convinced that if you are running tpf2005pro you don't need PG at all. it has the same features and many more!

    But since i have payed for it, i hope to find a situation, which proves the diff.


    o_O
     
  4. Opera

    Opera Guest

    "And it would be nice if you had some additional info,
    about WHAT kind of driver service it wants to install.
    So that you can make a normal decision if you want to
    allow this yes or no."

    Yes. It would it be great if PG were a little bit more verbose. I believe it's already on the wishlist.

    "And are there any situations that an allowed program
    must be stopped when it is trying to install a driver or service?
    For example when there is malware involved?"

    Certainly. That's the idea behind PG.

    "And how will you know that?"

    Generally, by having a look at the program. For example, you can ask yourself the question: why the hack does a browser need to install a driver when you close it?

    " Is this repeatable as does it happen most of the time or just once?"

    It happens every time when I close the browser. It does not happen with Opera 7. I use Opera 8.01 7583 (and WinXP Pro SP2).
     
  5. LFC

    LFC Registered Member

    Joined:
    Feb 23, 2005
    Posts:
    54
    i get this aswell with opera 8 when i close it
     
  6. fred22

    fred22 Registered Member

    Joined:
    Dec 6, 2004
    Posts:
    229
    i do not see this either (8.01 7642) and while i tested i printed this page and again no driver/service alert from PG
     
  7. Opera

    Opera Guest

    I have upgraded to the latest build. No change. If I close the browser a PG alert is triggered.
     
  8. tuatara

    tuatara Registered Member

    Joined:
    Apr 7, 2004
    Posts:
    772
    The best way is to send this opera file to DiamondCS and ask if it contains
    malware.

    If it does not, set PG to allow this executable to install drivers/services.

    I don't know HOW you can see WHAT (in detail) exactly is causing this message to appear.

    but it would be nice if there was someone here who could give you this info.

    Perhaps we can learn something then ;)
     
  9. Opera

    Opera Guest

    "If it does not, set PG to allow this executable to install drivers/services."

    There is no reason to do that. That's not the concept behind PG. You should NOT allow such actions unless required. In respect of Opera, no allow rule is required. The browser works w/o a driver.

    "I don't know HOW you can see WHAT (in detail) exactly is causing this message to appear."

    The PG alert bubble says: Opera wants to install a driver. Nothing more. The name of the driver is not mentioned. In other words, NO details are available.

    "The best way is to send this opera file to DiamondCS and ask if it contains malware."

    It can't. It's from the official Opera download site. Everybody can download it.
     
  10. tuatara

    tuatara Registered Member

    Joined:
    Apr 7, 2004
    Posts:
    772
    And what is DiamondCS support's reply if you send them this question by mail ?
     
  11. Opera

    Opera Guest

    I did not send an e-mail to them. They have seen this topic anyway. If they have an answer they will post it here so that everybody can benefit from it.

    In my opinion, this is an issue which should be solved in the long run (i.e., it's not THAT urgent). The release of TDS-4 is more important.
     
  12. Oddbod

    Oddbod Guest

    Hi.

    I have had that same alert from PG when closong Opera 8, i also had the same alert when i opened FlashFXP, in PG's logs it said it tried to install a driver/service but didnt name the driver or service.

    After i changed antivirus & had PG in learning mode for a short time the alerts stopped (due to learning mode)

    I thought it was something to do with Opera's voice support.
     
  13. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    PG does give the driver name in the Alerts section of its UI (double-click on the PG system tray icon to access it). Details will also be given in the PG logs (in the Logs subfolder of PG's program folder).

    I have never encountered this with Opera myself which raises the possibility of it being the printer driver that is trying to install a service. Have you been able to print webpages from other applications without encountering this?
     
  14. Opera

    Opera Guest

    I don't even have a printer ;-)
     
  15. Oddbod

    Oddbod Guest

    @P2K, PG didnt name the service for me with either Opera or FlashFXP, the logs & UI interface just said Opera was blocked from installing a driver/service named , just blank space after the named bit.
     
  16. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    That may be worth reporting to DiamondCS then - either your copy of Opera is doing something strange or your copy of PG is misreporting an activity - which could be due to a faulty install. Do you see similar reports for other applications?
     
  17. Oddbod

    Oddbod Guest

    @P2K, i only ever had that same alert for Opera & FlashFXP, after running in learning mode for a couple of hours to allow new A/V app to get it's aloows, the prompts stopped.
     
  18. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    I'll try to analyse it today, sorry for delays

    In paranoid mode, you could definitely DENY such a program this access - if it still works without it then thats ok, your choice. If something exploited a flaw in the browser and ran code, it could lead to a compromise. So its very important to use a browser without vulnerabilities ! well.. one with as few as possible :)
     
  19. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Had a quick look - cant see any reason for it to install a driver or service. Can't reproduce it when closing the browser.

    What plugins do you have, apart from the default ??
     
  20. Opera

    Opera Guest

    No Opera plug-ins.

    Please note, however, that I do not experience this issue on a different machine which is relatively "clean". Therefore, I could well imagine that the alert message results from a conflict because other low-level applications like Tiny Personal Firewall, Outpost Firewall, Ewido are also running on the problematic system.

    I find it more important that the PG reporting does not properly work (also on my clean machine): for instance, if I run Kernel PS which tries to run a driver called knlps.sys PG will block this action but merely report: "[DRIVER/SERVICE] c:\knlps\knlps.exe [776] Tried to install a driver/service named "

    The space behind "service named" is blank. In other words, PG does not identify the driver.
     
  21. Don Pelotas

    Don Pelotas Registered Member

    Joined:
    Jun 29, 2004
    Posts:
    2,257
    I see the same thing when i close Opera 8, never allowed it and it works just fine. :)
     
  22. Haceldama

    Haceldama Guest

    i had the same issue with versions prior to 7642 think something in the two versions prior to this one must have been faulty.i also occasionally encounter the missing entry regarding driver installs and so on(meaning no driver name stated, etc), though apart from opera in recent past i can not remember specifics.
     
Thread Status:
Not open for further replies.