CPF3 reports mscorsvw.exe as suspicious again and again

[Guest]

[guenthk]

mscorsvw.exe is a signed application belonging to the Microsoft.NET Framework. Nevertheless my CPF3 reports it as being suspicious from time to time. The suspicious action is that it attempts to create a new file or directory in some Windows system directory.

How can I get rid of this annoying alert, which occurs only since several weeks on my Windows Vista system?

(I cannot successfully submit mscorsvw.exe for analysis to Comodo just since it is signed.)

Klaus.

[Vettetech]

If you get a D+ pop up about it then click trusted and make sure remember is checked off.

[3xist]

mscorsvw.exe is a signed application belonging to the Microsoft.NET Framework. Nevertheless my CPF3 reports it as being suspicious from time to time. The suspicious action is that it attempts to create a new file or directory in some Windows system directory.

How can I get rid of this annoying alert, which occurs only since several weeks on my Windows Vista system?

(I cannot successfully submit mscorsvw.exe for analysis to Comodo just since it is signed.)

Klaus.

This is where some "common sense" is needed. If you know a certain process, app or whatever is 100% trustworthy, Allow it.

In this case- It is part of the Microsoft Framework, It's just CFP 3's Behavior analysis. Nothing to worry about :-)

Josh

[guenthk]

If you get a D+ pop up about it then click trusted and make sure remember is checked off.

I've done that many times, but that's just the problem: CPF3 apparently doesn't remember my decision. (Perhaps because it is a new file having a new, different name each time?)

And why does this alert occur only since several weeks?

I should also mention that the alert seems to pop up only if I haven't used my computer for several minutes and the screensaver is about to start up.

Klaus.

[Vettetech]

That is cause .NETframework is how some screensavers work. Did you make it trusted and click remember?

[guenthk]

That is cause .NETframework is how some screensavers work. Did you make it trusted and click remember?

Yes, of course, but CPF apparently doesn't remember my decision.

[3xist]

Yes, of course, but CPF apparently doesn't remember my decision.

Are you sure the box is ticked for "Remember my decision?" When the alert comes up?

Put it as a Trusted Application when the Alert comes up (I think that's what Vettetech what meaning)...

Josh

[Vettetech]

It does remember. I have 250 programs in my pc and Comodo remembers them all. Have you tried putting D+ in training mode for a bit? Since the alert happens when your screen saver starts have you tried setting your screen saver to start in 2 minutes and sit in front of your pc so you can catch the alert. Is there anything in your logs?

[guenthk]

In the meantime I have emptied ("remove") my (very long) list of "pending files" and switched back and forth between paranoid, safe, clean PC, and training mode. The annoying alert referring to mscorsvw.exe didn't occur any more so far, even if I wait for the screensaver to start. I'll return here if it should occur again.

Emptying the list of pending files has been an emergency action, of course, since I cannot assess every single file.

Btw: What's the difference between "Treat this application as .... trusted application" and "Allow this request"+"Remember my answer"

Isn't a file, to which an alert refers, transferred automatically to my list of trusted files if I click "Allow" and "remember"?

[Vettetech]

First of all Safe mode is the best mode for D+. If you just allow a program even with remember check off it will allow it for that session only. But if you make it trusted it will remember that you told D+ the program is trusted so it shouldn't ask you anymore. You do not need to have D+ in clean pc mode so that way there you do not need to deal with pending files.

[Tags:]