Termination by windows\system32\services.exe

Discussion in 'ProcessGuard' started by ric, Apr 29, 2005.

Thread Status:
Not open for further replies.
  1. ric

    ric Registered Member

    Joined:
    Aug 2, 2004
    Posts:
    7
    c:\windows\system32\services.exe tried to terminate my c:\windows\system32\alg.exe prog. (application layer gateway service) Is there any way of stopping this other than Process Guard? Ric
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Ric, Services.exe maybe checking to see if it can stop alg.exe rather than actually doing it. alg.exe is part of ICS and used by third party firewalls.

    So if you allow the terminate does alg.exe get killed?

    Services could have a legitimate reason for termination I guess.


    Thanks Pilli
     
  3. csm324

    csm324 Registered Member

    Joined:
    Apr 26, 2005
    Posts:
    10
    Hi All,
    I have read elsewhere on the net,that services.exe and alg.exe could be trojans.
    Does anyone know if this is possible.

    I had the same alert come up on PG yesterday..I allowed the action and everything still works fine!

    Chris
     
  4. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Most likely not trying to terminate anything, but it could be a single THREAD inside ALG.EXE being stopped. In general, Windows own processes should always be allowed to do what they want :)

    csm324, you can be sure its the real services.exe if its in the right folder - Windows\System32
     
  5. Vikorr

    Vikorr Registered Member

    Joined:
    May 1, 2005
    Posts:
    662
    Just a guess, but I think you'll find that what those sites meant was that Services.exe and alg.exe may be targeted for infection by trojans...which is why those two programs are on my protected list of programs in PG.

    Actually, any windows service that runs on my comp (and interacts with other programs) I protect with PG, same with anything that has access to the internet.
     
Thread Status:
Not open for further replies.