5 replies to this topic

[leobolfac]

running my wife XP, dwall 3.17. I almost never encounter problems, but my mostly clueless wife does.
all appeared normal, she went to use XP, I was not in the room. XP stoped working, and it appeared that somehow dwall was showing explorer.exe as untrusted (not iexplorer). I had to force a reboot, started ok, left the room and this happened again.
About the only thing I could figure out was that she was trying to open an MSWord file that was in her \my_docs which dwall had classified as untrusted. I checked the files she was working with, changed their status to trusted, I also disabled HIPS and she was able to finish the emergency project she was working on. So I really don't have a good diagnosis. XP was also running EAM and Blue Ridge AppGuard in lock down mode when these problems occurred. I have not seen any conflict with these apps running with dwall. But a few keystrokes from my wife and wow, XP runs not so good when dwall suddenly decides that explorer.exe is untrusted. please advise, as every time my wife runs into a security app hiccup with "her" XP, she makes my life uncomfortable.

[Ilya Rabinovich]

Please, check if you have c:\windows\defensewall_log_file.txt file. If you do, zip and post it here.

[leobolfac]

searched the XP, do not find the defensewall log txt file. Does it normally generate log file? Or only if something irregular happens?? This was an irregular event. I'm a little rusty in the finer points of dw as it rarely gives me problems. Only thing I can think of is that wife "triggered" something, and perhaps there was some conflict between dw and appguard, although I have not seen that when I'm running her XP. I opened the dw main window and went to Events Log and the only items showing are from today, now 03 march. I did find these files...
defensewall_inbound_excludes.txt
defensewall_inbound_profiles.txt
defensewall_trusted_modules.txt
defensewall_updaters_whitelist.txt
defensewall_whitelist.txt
defensewall_initialization.txt

I think my wife had previously rec'd MSWord files, by email or usb flash and dw had tagged them as untrusted, and had saved them in \my documents\ which is perhaps a protected zone reference appguard, and she used explorer to open the untrusted files from appguard protected space and there was a "conflict" causing dw to act as if explorer.exe was untrusted. Speculation...!!

[Ilya Rabinovich]

Maybe. But we may try another way. Go to the "Control panel"->"Administration"->"Event logs", run "Applications" one and check all the "defensewall" related items there. Export all of them, zip and send via e-mail to support [at] softsphere [dot] com.

[leobolfac]

UGH! there's 2,139 dw events between now, 05mar and 28Feb. All say Event 18 but for different reasons. All are info not warnings or errors. I cannot remember exactly when this event occurred. Not sure it happened the same day I posted here, 02mar, or a day or 2 earlier. Seems like too much data to sift thru manually to send you the properties info of each event as text file zipped. I did try to recreate what happened reference my speculation, but could not recreate the event that my wife originally created. This one may go unsolved! If it happens again, I'll note the date and time, check the logs and events so we have that info. Sorry I could not help more, and thanks for the continued support!

[Ilya Rabinovich]

Roger.