Process Logger Service

Discussion in 'other anti-malware software' started by Mister X, Mar 17, 2017.

  1. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    6,528
    Location:
    U.S.A. (South)
    Good deal. "Click"
     
  2. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,533
    Location:
    The etherlands
    OK. The fix makes it consistent, but my preference is always year.month.day from a sorting perspective. :)
     
  3. mood

    mood Registered Member

    Joined:
    Oct 27, 2012
    Posts:
    2,899
    Good idea.
    @novirusthanks
    Is it possible to let the user customize the date-format?
    For example:
    Code:
    date_format=yyyy-mm-dd
    So that Process Logger Service is respecting the setting (set from the user) and is using it accordingly.

    Or, is it possible to let it use a format according to the user locale setting. (Different country = different locale, different date-format)
    If my locale is set to dd.mm.yyyy, Process Logger Service is using this format automatically.
     
  4. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,533
    Location:
    The etherlands
    And if this could apply not only to process creation and termination date formats, but also the log name, date.log.
     
  5. mood

    mood Registered Member

    Joined:
    Oct 27, 2012
    Posts:
    2,899
  6. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,533
    Location:
    The etherlands
    I may have asked this before.

    What is the correct method of updating these services? Can one just stop the service, copy the new (unzipped) service.exe and config.ini over the previous and restart?
     
  7. mood

    mood Registered Member

    Joined:
    Oct 27, 2012
    Posts:
    2,899
    You can execute uninstall.bat, which is deleting the driver, stopping and deleting the service.
    But it can be sufficient to just stop the service. Then copy the new executable ProcLoggerSvc.exe and overwrite the existing one. Now start the service.

    Regarding overwriting the config.ini:
    In the new config.ini is mentioned: "DeleteLogsOlderThanNDays=30"
    If you have a value of 0 in your existing config, and if you are now overwriting your config.ini with the new one, your old logs will be deleted.
    So, after you have copied it, make sure to modify the config.ini to your needs before you start the service.
     
  8. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    2,533
    Location:
    The etherlands
    Thanks @mood. I actually used your second method, and re-edited my config.ini.
     
  9. mood

    mood Registered Member

    Joined:
    Oct 27, 2012
    Posts:
    2,899
  10. mood

    mood Registered Member

    Joined:
    Oct 27, 2012
    Posts:
    2,899
    @novirusthanks
    Regarding System processes, Process Logger Service and ERP are showing different results, for example:
    Code:
    Process Logger Service v1.5:
    Process: C:\Windows\System32\smartscreen.exe
    System Process: False
    Process: C:\Windows\System32\reg.exe
    System Process: False
    Process: C:\Windows\System32\conhost.exe
    System Process: False
    
    ERP (latest beta)
    Process   : C:\Windows\System32\smartscreen.exe
    Action    : System file
    Process   : C:\Windows\System32\reg.exe
    Action    : System file
    Process   : C:\Windows\System32\conhost.exe
    Action    : System file
    
    Maybe it isn't a good idea to compare logfiles of two different products, but shouldn't Process Logger Service detect these processes as a System Process too?
    These are only examples, there are a lot more processes which are not detected as a System Process.
     
  11. Mister X

    Mister X Registered Member

    Joined:
    Aug 10, 2013
    Posts:
    2,904
    Location:
    Mexico
    I think they should. A system process is a system process no matter what imho. Nice finding. :thumb:
     
Loading...