Svchost flag

Discussion in 'ProcessGuard' started by WilliamP, Jul 14, 2004.

Thread Status:
Not open for further replies.
  1. WilliamP

    WilliamP Registered Member

    Joined:
    Jun 1, 2003
    Posts:
    2,201
    Location:
    Fayetteville, Ga
    I have NOD32 scheduled to do a scan on Wed. 1 AM .This morning PG wouldn't let it. The log said that windows svchost.exe tried to set an unknown flag on NOD32.exe. It hadn't done that before but I got 5 Windows updates yesterday so maybe svchost needs to set a flag. What should I do?
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi William, If svchost.exe has changed it may have activated the PG desktop when you were not there.
    Remove your svchost.exe from the checksum list then re-add it to make sure.
    I also added the latest upsdates today but I did it with PG disabled, rebooted and renabled, all is well so far.

    HTH Pilli
     
  3. WilliamP

    WilliamP Registered Member

    Joined:
    Jun 1, 2003
    Posts:
    2,201
    Location:
    Fayetteville, Ga
    I checked the Checksum for svchost.exe and the date was 7-13-04 so it was changed with the update. I reprogramed the scan for NOD to see if that will take care of it. The PG pop up was activated when NOD tried to start its scan. Hopefully this will fix it.
     
  4. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Hi,

    Thanks for the info, we'll look into this. Please send the file svchost.exe to us - check the log and make sure you are sending the right file, it was the one in C:\Windows\System32\svchost.exe ?

    Also please paste a copy of the incident including the unknown flag and any info in that line
     
  5. WilliamP

    WilliamP Registered Member

    Joined:
    Jun 1, 2003
    Posts:
    2,201
    Location:
    Fayetteville, Ga
    After re-programing the scan in NOD it worked. I guess that when the checksum changed for svchost.exe the scan had to to be programed again. :rolleyes:
     
Thread Status:
Not open for further replies.