Comodo Firewall asking permission to allow WMIADAP.exe [Resolved]

This started around July 6, 2009, shortly after I used Windows Update to install the .NET 3.5 Service Pack 1 update.

Shortly after I start my computer, everytime Comodo would warn me that this executable wants to modify a few protected registries. Unfortunately I haven’t memorized all of them, but it has been a few:

  • FirstCounter
  • Last Counter

Being the first two that appear that I remember the most. Are these normal registry keys or should I be concerned? I don’t suspect it is necessarily spyware or malware because (based on what I was informed) modifying registry keys isn’t typical for them.

Here is my IS software:
Comodo Firewall -
Serial # 579417106D9D4df98496D5E6B5B46FD9
Version: 3.8.64739.471

AVG Anti-Virus 8.5 Free Edition:
Version - 8.5.375
database - 270.13.8/2224

Operating System:
Microsoft Windows Vista 32-bit

I hope I listed all of the necessary information, any help would be appreciated.

Were these notifications alerts which you had to allow, deny? Or were they these small popups right above the systray?

Thank you for the quick response, I wish I was online last evening to answer quickly.

They were the type of notifications I had to allow or deny, so far I have allowed it each and every time, but set the system not to remember my answer.

It happens each time I start my computer, since I just started it now I can list the registry keys:
-HKLM/SYSTEM/ControlSet001/Services/WmiApRpl/Performance/First Help
-HKLM/SYSTEM/ControlSet001/Services/WmiApRpl/Performance/Last Help
-HKLM/SYSTEM/ControlSet001/Services/WmiApRpl/Performance/Object List
-HKLM/SYSTEM/ControlSet001/Services/WmiApRpl/Performance/Library Validation Code
-HKLM/SYSTEM/ControlSet001/Services/WmiApRpl/Performance/Perf IniFile
-HKLM/SYSTEM/ControlSet001/Services/WmiApRpl/Performance/Disable Performance Counters

wmiadap.exe is a process which forms a part of the Microsoft Windows Operating System. The AutoDiscovery/AutoPurge ( ADAP) process transfers performance libraries to the WMI repository. This program is important for the stable and secure running of your computer and should not be terminated.

I would say you should ‘Remember’ the ‘Allow’ or even make it ‘Trusted’

Thank you for your quick response, will do.

This thread is now locked. PM any Mod or Admin if you require it re-opened.