Very strange occurrence with PG 3.050

Discussion in 'ProcessGuard' started by nameless, Nov 14, 2004.

Thread Status:
Not open for further replies.
  1. nameless

    nameless Registered Member

    Joined:
    Feb 23, 2003
    Posts:
    1,184
    Just installed PG 3.050 on my WinXP SP-2 system. Started clean.

    I happen to have a little command-line utility named sleep.exe, which I use in command scripts (i.e. CMD files) to pause during their execution. I have a few scripts that load on startup, and those scripts call sleep.exe. So far so good.

    I had PG's learning mode enabled.

    Long after startup, and when no command scripts (nor sleep.exe) were running, I ran Sysinternals Regmon 6.12. This was new to PG, so I expected PG to block the dynamic driver loading, and then I'd dismiss Regmon's error message, then rerun it, and all would be well.

    Instead, I got an error from Regmon, and also alert from PG that sleep.exe was trying to install a driver. So learning mode added an entry in PG to give sleep.exe permission to install drivers.

    I'm as confused as you are. I wasn't running Regmon from a batch file, and again, sleep.exe wasn't even running at the time. (I double checked in Process Explorer.) But again, I had run sleep.exe by way of the scripts that run at startup, within the same Windows session.

    I deleted the sleep.exe line in PG, and ran Regmon again. This time all went exactly as I expected: Regmon threw an error, PG threw an alert, learning mode added what it needed to, and a second run of Regmon worked fine. The file sleep.exe didn't come up at all.

    Out of curiousity, I deleted Regmon in PG, and tried again. It did the same thing it did the first time, adding an entry for sleep.exe.

    I just thought this was strange.
     
    Last edited: Nov 14, 2004
  2. Kenjin

    Kenjin Registered Member

    Joined:
    Sep 29, 2004
    Posts:
    63
    affirmative. experienced the same a couple of days ago with 3.0 version...
     
  3. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi, I have no idea what is going on here either, we will have to await a DCS response in the morning.

    Thanks. Pilli
     
  4. nameless

    nameless Registered Member

    Joined:
    Feb 23, 2003
    Posts:
    1,184
    I'm getting the same sort of odd behavior with other applications now. I had Paint Shop Pro all set up--global hooks allowed, because it needs them to do screen capturing.

    But just now, I went to use PSP to take a screen cap, and ProcessGuard told me that CMD.EXE tried creating a global mouse hook. This makes no sense.

    That's just one more example--there have been others lately that I can't remember well enough to explain. (One had to do with CMD.EXE accessing physical memory.)
     
  5. Jason_DiamondCS

    Jason_DiamondCS Former DCS Moderator

    Joined:
    Nov 11, 2002
    Posts:
    1,046
    Location:
    Perth, Western Australia
    Sounds weird, I tried regmon over here and noticed no issues with it, nor with Paint Shop. Just keep an eye out for it and post all the weird things you notice, might help to track down the issue.
     
Thread Status:
Not open for further replies.