pghash.dat? question?

Discussion in 'ProcessGuard' started by smiler, Nov 30, 2004.

Thread Status:
Not open for further replies.
  1. smiler

    smiler Registered Member

    Joined:
    Oct 1, 2004
    Posts:
    30
    Hi first of all i would like to say that process guard is a brilliant program,i downloaded the latest free version a few weeks ago and it is amazing!, you know exactly what is going on with all and any other programs that wants to run on your pc,well done diamondscs.
    My 2 questions are:-

    1/ What is pghash.dat,it comes up every so often?
    2/ I get regedit.exe come up sometimes twice in succession,one box then immmediately afterwards again ?,i know that regedit is to do with the registry and that maybe something wants to change the registry am i correct?

    A bit of advice please from those that know?
    Reagards
    Smiler :D
     
  2. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Hi,

    There are 2 very important configuration files in PG. PGUARD.DAT and PGHASH.DAT

    PGUARD.DAT stores your list of protected programs, while PGHASH.DAT stores the list of "allowed to run" programs (the security tab)

    Both these files are protected from being moved, deleted or opened in any way when protection is active, to ensure there is no way for a virus or trojan to stop PG from working. So if you are using DEFRAG, you should disable protection so these files can be defragged.

    Actually PG "defrags" them itself in a special way, so if you dont want to disable protection when defragging thats fine - PG should still have 0% impact on your systems performance :)
     
  3. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    If you see regedit prompts, its most likely the program you just opened or closed is using regedit /s to run a file (settings.reg for example), this happens for a few programs. You can decide whether it's OK to allow this by looking at the extra details, or by deciding whether you expect regedit to make changes - depending on what you just did. Like I say, its probably because you just opened or closed a program ?
     
  4. smiler

    smiler Registered Member

    Joined:
    Oct 1, 2004
    Posts:
    30
    Thanks Gavin for your helpful reply to my question re-pghash.dat and regedit.exe i will look closely at what program i opened before i get the message regedit.exe.
    If therefore i get the message pghash.exe come upagain should i therefore click accept and click in the check box with a tick on remember this decision future (something like that?).

    regards

    smiler :rolleyes:
     

    Attached Files:

  5. Andreas1

    Andreas1 Security Expert

    Joined:
    Jan 29, 2003
    Posts:
    367
    Location:
    Mainz (Ger)
    I, for once, get a prompt to allow regedit to run when I quit my email client, Becky. I suppose it has to do with either saving or backing up some of its settings. I keep on allowing this (on a case-by-case basis, see below).

    I suppose you mean regedit.exe (and not pghash.exe), don't you?
    I don't "always" it, because it doesn't prompt me so often that I get truly annoyed and if I leave it like that, I will notice everytime that an app tries to run the registry editor and I can cancel it if I don't want it.
    Coming to think of it, if the app was really up to no good, then it could just as well modify the registry directly - without regedit - and I'd not notice it...
    Oh, well. At least on some applications I will have the choice, so I'm gonna leave it at that.


    HTH,
    Andreas
     
Thread Status:
Not open for further replies.