PG and warning messages on OS reboot/logoff

Discussion in 'ProcessGuard' started by Dwarden, Jan 29, 2005.

Thread Status:
Not open for further replies.
  1. Dwarden

    Dwarden Registered Member

    Joined:
    Apr 11, 2003
    Posts:
    176
    Location:
    Czech Republic
    Sat 29 - 15:49:33 [MODIFY] c:\windows\system32\csrss.exe [628] was blocked from modifying c:\windows\system32\logonui.exe [2772]
    Sat 29 - 15:49:35 [MODIFY] c:\windows\system32\winlogon.exe [652] was blocked from modifying c:\windows\system32\logonui.exe [2772]
    Sat 29 - 15:49:35 [MODIFY] c:\windows\system32\winlogon.exe [652] was blocked from modifying c:\windows\system32\logonui.exe [2772]
    Sat 29 - 15:49:35 [MODIFY] c:\windows\system32\winlogon.exe [652] was blocked from modifying c:\windows\system32\logonui.exe [2772]
    Sat 29 - 15:49:36 [MODIFY] c:\windows\system32\svchost.exe [992] was blocked from modifying c:\windows\system32\winlogon.exe [652]


    When rebooting/logoff from OS i get lot of tray popups where PG probably shows events related to above ...

    To fix these i assume i need set
    csrss.exe
    winlogon.exe
    svchost.exe

    to Allow Modify & Read + Access to Physical memory

    i'm i right?
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Yes except that logonui does not require access to physical memory :) And all should be protected from Modification & Termination.

    Cheers. Pilli
     
Thread Status:
Not open for further replies.