PG "The Wall" and RKR

Discussion in 'ProcessGuard' started by SG1, Jun 24, 2006.

Thread Status:
Not open for further replies.
  1. SG1

    SG1 Registered Member

    Joined:
    Jan 16, 2003
    Posts:
    430
    I'm still "chasing my tail," trying to run SI's RootKitRevealer, can't get it to install and run (but it has in the past). I think it is due to PG be it an error on my part in PG settings, perhaps for services.exe or something else. And, I read that RKR now uses a random name generator as part of its process to fool black hats if they are perchance on one's PC, which may in turn buffalo PG. (?)

    Get different error msgs., when trying to run RKR, depending on if I check or uncheck the "allow driver" for services.exe but I still can't get RKR to load/run: this is driving me nuts, on principle alone... HOW do I get RKR to fire up, & get it by PG (if that's the holdup)? In short, what might I be doing wrong here? Ideas?

    Many thanks, for help,
    SG1 (Pat)
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
  3. SG1

    SG1 Registered Member

    Joined:
    Jan 16, 2003
    Posts:
    430
    Bubba;

    Thanks for your reply and info. BUT, enclosed are screencaps of the error msgs. I get, depending on if I check or uncheck box in PG for services.exe, per Wayne's (DCS-AU) note about that.

    Thanks again, SG1 (Pat)
     

    Attached Files:

  4. SG1

    SG1 Registered Member

    Joined:
    Jan 16, 2003
    Posts:
    430
    Sorry - hit the one image limit per post (I think). Here is 2nd screencap re error msgs., in trying to get RKR to fire up.

    SG1 (Pat)
     

    Attached Files:

  5. Disciple

    Disciple Registered Member

    Joined:
    Nov 14, 2002
    Posts:
    292
    Location:
    Ellijay, Georgia - USA
    SG1 you pretty much figured out the problem with RKR and PG with the random name generation. The permissions set for the current name are useless the next time you run RKR. The only reliable way to run it is to disable PG before starting RKR and then enable it when you are done.
     
Thread Status:
Not open for further replies.