mscorsvw.exe will not stop giving defense alerts no matter what

[Guest]

[martini1179]

I installed the Zune 3.0 software on my PC and I started getting the following error from Defense+ repeatedly:

"mscorsvw.exe could not be recognized and is about to modify the protected registry key HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root." 

It doesn't matter if I allow it or block it, the alert keeps popping up repeatedly. And yes the "remember this" box is checked. The alert used to come up every 20-30 minutes, but now its more like once an hour. :comodo110:

Either way, I checked this entry via regedit and there doesn't seem to be any changes made, although I'm not an expert.

This file is located in C:\Windows\Microsoft.NET\Framework64\v2.0.50727 and it passed Virustotal with flying colors.

I'm running Vista x64 SP1.

Any advice would be greatly appreciated. 

[fazio93]

Either way, I checked this entry via regedit and there doesn't seem to be any changes made, although I'm not an expert.

You can't tell if any changes were made just by looking in regedit

"mscorsvw.exe could not be recognized and is about to modify the protected registry key HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root." 

It doesn't matter if I allow it or block it, the alert keeps popping up repeatedly. And yes the "remember this" box is checked. The alert used to come up every 20-30 minutes, but now its more like once an hour. :comodo110:

Go to D+ > Advanced > Computer Security Policy > and look for the rule containing 'mscorsvw.exe". Highlight it, click "edit", go to "Access Rights" > and try either allowing all access to registry keys (by selecting "allow") or you can keep it on "ask" and click modify and under "allowed registry keys" add this (without quotes):

"*\SOFTWARE\Policies\Microsoft\SystemCertificates\*"

remember to pres "apply"
  

[martini1179]

Thanks, it worked. I should have known what to do, since I've been using Comodo for about 2 months now with few problems. 

You can't tell if any changes were made just by looking in regedit

  Out of curiosity, why not?

[fazio93]

Glad it worked.

Out of curiosity, why not?

When COMODO warns you about a file trying to 'modfy' a key, might just be that the file wants access to it (e.g. open, close, query). You can't tell any of this from regedit. you would need something like RegMon.  

[Tags:]