Process Guard Activity

Discussion in 'ProcessGuard' started by starfish_001, Jul 1, 2005.

Thread Status:
Not open for further replies.
  1. starfish_001

    starfish_001 Registered Member

    Joined:
    Jan 31, 2005
    Posts:
    1,041
    Hi,

    I've been having a BSOD lately when I right click a file - Strange.

    Any way I fired up File Monitor and noticed that process Guard and Exploer seem to error for some reason.

    I get a lot of entries like these, any ideas? anyone



    21:17:11 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
    21:17:11 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
    21:17:11 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
    21:17:12 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
    21:17:12 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
    21:17:12 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
    21:17:12 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
    21:17:13 explorer.exe:3272 FASTIO_QUERY_OPEN C:\Program Files\ProcessGuard\procguard.exe FAILURE
     
  2. kaishaku

    kaishaku Registered Member

    Joined:
    Jan 19, 2006
    Posts:
    5
    Getting the same stuff now. Win2k3 SP1.

    I am guessing it is some kind of SP1 bug.

    Maybe you got it for XP SP2?

    I am going crazy trying to fix it.
     
  3. kaishaku

    kaishaku Registered Member

    Joined:
    Jan 19, 2006
    Posts:
    5
    By the way, it doesn't matter what explorer is opening...

    I mean to say it is not a processguard problem. If you uninstall
    process guard then whatever process is next for explorer to
    "check out" for the context menu will show up in file monitor.

    For example, I saw this with winrar's hook so uninstalled winrar,
    then file monitor just showed explorer spamming on metapad.exe
    a simple notepad replacement (when I right click text files).

    I have to think explorer.exe is the problem and I have experienced
    this kind of thing for year and years...
     
  4. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    This is a file access query, ProcessGuard protects its own files from being deleted. Some access will fail, but any access really needed is always allowed.

    All you need to know is that programs cannot delete the files while protection is enabled, even if procguard.exe is not running. FAILURE may be misleading from that log, depending on what explorer.exe was trying to do. Most likely getting the directory listing and refreshing icons, which would have actually worked - as you can verify by just looking in the folder :)
     
Thread Status:
Not open for further replies.