Hello
Several times, Comodo sent an alert telling me that a program A has modified the user interface of program B by sending special Windows messages.
Can someone tell me more about this alert ?
Thank you very much.
Hi gtaillandier
I’m assuming that program B is explorer.exe. You get these alerts because many applications use explorer.exe in a way (to add/claim filea*sociations, add context menus, etc…) that could also be used by a Trojan. It is important to realise that explorer.exe is the parent of most user started applications (including browsers). This is the favorite hole for firewall leak tests (and wild Trojan’s of course) to try and exploit, the parent-child relationship between explorer.exe (parent) and the default browser (child). So, CPF will warn you the first time these relationships are used… normally you’ve just used an app which you haven’t used in awhile (eg. WinZip) which has done something to explorer.exe. If you Allow these “Remembered” then CFP will only alert you again if something has changed or a new component is being used.
Hope this helps.
Hi Kail
Thank you for your answer.
In one alert, program A was URLSnooper and Program B Firefox.
Ah. OK, I assumed badly. Are you constantly being alerted for URLSnooper on Firefox?
Hi Mail
I have alerts for with other programs, but I don’t have notice them.
I’ll do the next time and post it on this topic.
( sorry for my english, but I’m French ).