When I block ACDSee from accessing the net I end up loosing connectivity to the internet, I take it I am blocking svhost.exe which is causing the problem is there a work around.
I have turned off auto update and anything else I could find in ACDSee that needed to access the net, but I still have a problem, any help would be appreciated
Nivek
Date/Time :2007-04-29 16:13:34
Severity :High
Reporter :Application Behavior Analysis
Description: Suspicious Behaviour (svchost.exe)
Application: C:\WINDOWS\system32\svchost.exe
Parent: C:\WINDOWS\system32\services.exe
Protocol: UDP Out
Destination: 255.255.255.255::bootp(67)
Details: C:\Program Files\ACD Systems\ACDSee\8.0\ACDSee8.exe has tried to use C:\WINDOWS\system32\svchost.exe through OLE Automation, which can be used to hijack other applications.
Hi nivek,
some additional information needed here:
Does ACDSee try to connect to the internet when you import a picture from the internet via copy and paste by any chance?
Cheers,
grampa.
Nivek,
I was just wondering bc I had the same issues using MS PowerPoint. Whenever I imported a pic from the internet via copy&paste Comodo would ask me to allow PP to connect to the internet. If I blocked it I lost connectivity. If I allowed it everything just kept working. Either way these were rated high severity events. So I thought this might have been the case with ACDSee as well.
Haven’t used ACDSee myself I can only guess here so I think we should wait until someone who actually uses ACDSee finds this topic.
However, it shows a similar behaviour as e.g. NERO which also tries to connect to the internet when started (without any update-intentions) although you don’t lose internet connectivity.
Hope you’ll be sorted out soon.
If I get any further ideas (I’ll keep thinking about it) I’ll let you know.
Bye for now,
grampa.
Well I may have sorted the problem out myself all off the IP addresses are broadcast addresses going to the router for DHCP discovery reasons so I set up a rule to allow them as none of the addresses are not public internet addresses, and the problem seems to be fixed.
The same thing seems to be happening to other people in the forum but with different programs.
What I still do not understand is why they are using ACDSee to broadcast to DHCP on my router as shown below.
Is Comodo firewall reporting this correctly or is windows XP just hooking onto the program because it’s open for some reason???
Destination: 255.255.255.255::bootp(67)
Details: C:\Program Files\ACD Systems\ACDSee\8.0\ACDSee8.exe has tried to use C:\WINDOWS\system32\svchost.exe through OLE Automation, which can be used to hijack other applications.