wwdisp.exe able to terminate IEso protection failed?

Discussion in 'ProcessGuard' started by ronny, Jun 23, 2004.

Thread Status:
Not open for further replies.
  1. ronny

    ronny Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    231
    Location:
    Belgium
    Perhaps a stupid question:
    but why is "webroot\window washer\wwdisp.exe" able to terminate C:\program files\internet explorer\iexplorer.exe? I have NOT given wwdisp.exe permission to terminate in the processguard options.

    I do get a warning from Processguard log when windowwasher tries to close it , but as i say it is still able to close IE! In this case,this is not so alarming because i gave windowwasher the permission to close IE, but still i expected that processguard would block the attempt :eek:
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Ronny, I am not exactly clear on what you have given permission to, is wwdisp.exe window washers's main executable?

    Thanks. Pilli
     
  3. ronny

    ronny Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    231
    Location:
    Belgium
    I gave no permission to terminate things to wwdisp.exe in Process Guard, but when i cleaned with windowwasher , i gave it (thus the program itself, not in PG) permission to close my IE browser, which was open.I was curious if it could close it , because it was protected by PG, i thought it wouldn't be able.
    Yes it is.
    Thank YOU!
     
  4. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Did you enable "Close message handling" on IE?
     
  5. ronny

    ronny Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    231
    Location:
    Belgium
    No , i didn't :oops:
    I did not know this is necessary.
    [some time later]
    Ok i enabled "close message handling " now, but window washer is STILL able to close IE! o_O Ok i admit i get a "human verification dialog" but this comes too late , IE's webpage(s) is (are) yet already closed.
     
    Last edited: Jun 23, 2004
  6. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Ronny, If you get a Human Interface then Process Guard is doing it's job, sometimes you may have to load a program a couple of times to get Close message handling to work properly.
    Please read through the FAq's here for more information: https://www.wilderssecurity.com/showthread.php?t=20348

    HTH Pilli
     
  7. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,042
    Is it closing IE or crashing it. I'd bet the latter. You should close IE before running Windows Washer, unless you don't use Window Washer to clean anything related to IE. If I run WW i will usually log off and then log back on. When WW cleans the Index.dat that is a key file for IE, it isn't really cleaned properly until you log off and then log back on.

    I would have all normal programs closed before running WW, and then log off and log back on.
     
  8. siliconman01

    siliconman01 Registered Member

    Joined:
    Mar 6, 2003
    Posts:
    780
    Location:
    West Virginia (USA)
    I'm running Windows XP-SP1a Home Edition and Window Washer 5.5.0.15. I don't see IE closing when WW is washing. I don't even see an option in WW that specifies this.

    I have wwdisp.exe ALLOWED to Terminate, but I certainly do see any termination of IE 6.0
     
  9. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    I'm running Window Washer 5.5.1.19 (updated it a couple of days ago) and get this output from the PG log:

    24 Jun 09:33:08 - [EXECUTION] c:\program files\internet explorer\iexplore.exe with commandline "c:\program files\internet explorer\iexplore.exe" was ALLOWED to run
    24 Jun 09:33:16 - [EXECUTION] c:\program files\webroot\washer\wwdisp.exe with commandline "c:\program files\webroot\washer\wwdisp.exe" /shortcut was ALLOWED to run
    24 Jun 09:33:28 - [P] c:\program files\webroot\washer\wwdisp.exe [820] tried to gain TERMINATE access on c:\program files\internet explorer\iexplore.exe [836]
    24 Jun 09:33:29 - [EXECUTION] c:\program files\webroot\washer\formdata.exe with commandline "c:\program files\webroot\washer\formdata.exe" -auto was ALLOWED to run

    When I start the wash sequence, Window Washer prompts me with: "Items may not be cleaned properly. Would you like to close Internet Explorer?" If I click yes, IE closes. Then PG flashes blue with the warning above.

    My IE settings in PG are:

    ---013-----------------------------------------------
    Long Path :- c:\program files\internet explorer\iexplore.exe
    Short Path :- c:\progra~1\intern~1\iexplore.exe
    Blocked Flags :- Write,Terminate,Suspend,SetInfo
    Allow Flags :- None
    Option Flags :- Allow Global Hooks

    and I don't have wwdisp.exe in the Program Protection list. Just my observations. I normally don't run Window Washer with IE open.

    Nick
     
  10. ronny

    ronny Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    231
    Location:
    Belgium
    Thanks Nick that's exactly what i mean!
    Why is it able to close IE when i click "yes"?
     
  11. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    I am only able to kill IE with APT 1.9 "Kill 8" (SC_Close close message method) with my settings as they are above. If I enable Close Message Handling for IE and follow the wash sequence above, PG asks for confirmation but IE closes before I can type in the 5-letter combination. I also noticed that even though IE's window has closed, the IE process still exists in Task Manager.

    Nick
     
Thread Status:
Not open for further replies.