JeremyNicoll

Turning off EAM didn't do what I expected

Recommended Posts

Win 8.1 64bit,  Firefox v62.0.3 (64bit),  EAM 2018.9.0.8961

In the course of investigating https://support.emsisoft.com/topic/29988-unexpected-interaction-between-eam-and-firefox/   I chose to reboot the machine (full shutdown, cold start) and bring it up without EAM running.  That didn't quite work as I'd hoped, so I've had another go - more carefully - this morning... and it still didn't do what I expected.   What I did was:  

I stopped and restarted debug logging, then unticked Settings - "Start on Windows startup", then did the fulll shutdown and reboot.

When the desktop restarted, there was no EAM systray icon (as expected), but Process Hacker (which starts automatically) showed me that  a2service.exe  was running.

Today I then manually started   a2start.exe   and used the GUI to stop & restart debug logging; I'll PM the logs to GT500.

 

Yesterday I used the GUI which started when I manually ran  a2start.exe  to close EAM by using the EAM systray icon's  "Shut down protection" option, and although the various a2... executables then disappeared from Process Hacker, that isn't really what I'd wanted to achieve - a system that had never had EAM start in the first place.

 

In the GUI, the Settings - "Start on Windows startup" option is described in terms of having real-time protection active, or not.   If unticking it is meant to result in a system with  a2service.exe  running, then it's not at all clear to me what  a2service.exe  is actually then doing; the tooltip needs better text and possibly the option itself needs a better title. 

Share this post


Link to post
Share on other sites

You have to set the Emsisoft Protection Service to manual in order to prevent it from running on startup.

Share this post


Link to post
Share on other sites

The option in the GUI only prevents a2guard.exe and a2start.exe from loading on startup. It no longer changes the service start type.

Edited by GT500
Fixed typo.

Share this post


Link to post
Share on other sites
1 hour ago, GT500 said:

The option in the GUI only prevents a2guard.exe and a2service.exe from loading on startup. It no longer changes the service start type.

What do you mean by "prevents ... a2service.exe from loading on startup"?   Or maybe, what do you mean by "loading"?   After reboot with the GUI thing switched off, a2service WAS running.

If  "You have to set the Emsisoft Protection Service to manual in order to prevent it from running on startup" really is the case, what exactly is the use-case, for an ordinary user, of changing the "Startup" switch in the GUI? 

Share this post


Link to post
Share on other sites
2 hours ago, JeremyNicoll said:

What do you mean by "prevents ... a2service.exe from loading on startup"?

Sorry, that was a typo. I meant a2start.exe.

 

2 hours ago, JeremyNicoll said:

If  "You have to set the Emsisoft Protection Service to manual in order to prevent it from running on startup" really is the case, what exactly is the use-case, for an ordinary user, of changing the "Startup" switch in the GUI? 

As far as I know, it should keep the protection from being active, even though the service is still loaded. There should be a setting in the config file that the service reads when it starts to tell it not to activate protection on startup.

BTW: You can use Process Hacker to check and see if EAM is hooking a process.

Process_Hacker_Find_Handles_or_DLLs.png
Download Image

Process_Hacker_Properties_Modules.png
Download Image

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.