wwdisp.exe able to terminate IEso protection failed?

Perhaps a stupid question:
but why is "webroot\window washer\wwdisp.exe" able to terminate C:\program files\internet explorer\iexplorer.exe? I have NOT given wwdisp.exe permission to terminate in the processguard options.

I do get a warning from Processguard log when windowwasher tries to close it , but as i say it is still able to close IE! In this case,this is not so alarming because i gave windowwasher the permission to close IE, but still i expected that processguard would block the attempt

 

Hi Ronny, I am not exactly clear on what you have given permission to, is wwdisp.exe window washers's main executable?

Thanks. Pilli

 

I gave no permission to terminate things to wwdisp.exe in Process Guard, but when i cleaned with windowwasher , i gave it (thus the program itself, not in PG) permission to close my IE browser, which was open.I was curious if it could close it , because it was protected by PG, i thought it wouldn't be able.

Yes it is.

Thank YOU!

 

Did you enable "Close message handling" on IE?

 

No , i didn't
I did not know this is necessary.
[some time later]
Ok i enabled "close message handling " now, but window washer is STILL able to close IE! Ok i admit i get a "human verification dialog" but this comes too late , IE's webpage(s) is (are) yet already closed.

 

Ronny, If you get a Human Interface then Process Guard is doing it's job, sometimes you may have to load a program a couple of times to get Close message handling to work properly.
Please read through the FAq's here for more information: https://www.wilderssecurity.com/showthread.php?t=20348

HTH Pilli

 

I'm running Windows XP-SP1a Home Edition and Window Washer 5.5.0.15. I don't see IE closing when WW is washing. I don't even see an option in WW that specifies this.

I have wwdisp.exe ALLOWED to Terminate, but I certainly do see any termination of IE 6.0

 

I'm running Window Washer 5.5.1.19 (updated it a couple of days ago) and get this output from the PG log:

24 Jun 09:33:08 - [EXECUTION] c:\program files\internet explorer\iexplore.exe with commandline "c:\program files\internet explorer\iexplore.exe" was ALLOWED to run
24 Jun 09:33:16 - [EXECUTION] c:\program files\webroot\washer\wwdisp.exe with commandline "c:\program files\webroot\washer\wwdisp.exe" /shortcut was ALLOWED to run
24 Jun 09:33:28 - [P] c:\program files\webroot\washer\wwdisp.exe [820] tried to gain TERMINATE access on c:\program files\internet explorer\iexplore.exe [836]
24 Jun 09:33:29 - [EXECUTION] c:\program files\webroot\washer\formdata.exe with commandline "c:\program files\webroot\washer\formdata.exe" -auto was ALLOWED to run

When I start the wash sequence, Window Washer prompts me with: "Items may not be cleaned properly. Would you like to close Internet Explorer?" If I click yes, IE closes. Then PG flashes blue with the warning above.

My IE settings in PG are:

---013-----------------------------------------------
Long Path :- c:\program files\internet explorer\iexplore.exe
Short Path :- c:\progra~1\intern~1\iexplore.exe
Blocked Flags :- Write,Terminate,Suspend,SetInfo
Allow Flags :- None
Option Flags :- Allow Global Hooks

and I don't have wwdisp.exe in the Program Protection list. Just my observations. I normally don't run Window Washer with IE open.

Nick

 

Thanks Nick that's exactly what i mean!
Why is it able to close IE when i click "yes"?

 

I am only able to kill IE with APT 1.9 "Kill 8" (SC_Close close message method) with my settings as they are above. If I enable Close Message Handling for IE and follow the wash sequence above, PG asks for confirmation but IE closes before I can type in the 5-letter combination. I also noticed that even though IE's window has closed, the IE process still exists in Task Manager.

Nick