Comodo reports modifications from processexplorer on Avast

Salut Forum,

today I have downloaded the Process Explorer from a secure page (computer magazine). This program is about to replace the standard taskmanager and provides more features and tools.

After download I checked the file with Avast Antivirus and Spybot - no result. I also loaded it up to an online malware scanner, no result also. After start, Comodo reported, the program would be safe and contains a signature of Microsoft and can be trusted. But it also noted, ProcessExplorer tried to modify files of Avast Antivirus (WebCheck and Avast.exe) - I blocked this actions.

Does anybody know the background of this attempts of PE? A false positive of Comodo? Why Avast in particular? I would expect a virus, trying to brake through the defensive shield of Avast, but all scans are negative, the file (PE) is safe - what should be expected from the source (chip.de).

Can anybody help me to understand this and most important - did PE attempt to attack Avast (file changes sound like)?

Thanks in advance,
Salazar

Hello Salazar,

This tool is from former sysinternals now microsoft so if you don’t trust the source go to:

www.sysinternals.com it will bring you to MS download page for sysinternals tools.

I have it in D+ as Trusted Application, i assume your running it Custom ?

Hello Ronny,

I think the source is to be trusted, it is from a famous German computer magazine and the file has been scanned with several tools and appears to be clean. So I estimate the source is ok - as Comodo also recognised the program as trustworthy.

I am just confused about its tries to modify Avast files - I started it just a minute ago and it did not try anything like this again…

Thanks,
Salazar

Greetings!

Is it trying to access the process in memory, or modify the file?

Cheers,
Ragwing

Greetings Ragwing,

it tried to modify the files, two executables of Avast. I deleted the version of PE and downloaded a newer one directly from Microsoft and until now, the attempts did not occur again.

Greetz,
SAlazar