Constant popups for nod32krn.exe and (moreso) SASERV~1.exe

Ok, I did a little digging on the site and found a similar issue- with no responses.

When I start my system, I get several pop ups from Comodo Firewall V3 within a few minutes. The first bunch is usually for NOD32krn.exe, which is a process that checks for updates for NOD32, my anti virus program. These are (or were?) pretty insistent, but they seem to have gone away (at least for this instance). Each time I hit “allow” with the “remember my answer” box checked, but it kept coming back. I defined it as a trusted application several times both in the pop up itself and in the user interface. It seems to have quieted down for now, however…

On the other hand, SASERV~1.exe, which has a mcafee logo by it (which makes me think its siteadvisor which I use) keeps coming back. I’ve been clicking “ok” about twenty time so far with “Allow this request” and “remember my answer” selected, and tried about ten times to define it as a trusted application, but it still comes back. I read about the parent thing, but I don’t think its reasonable that I have over thirty parents for this one program installed in firefox and internet explorer (only the former of which I use often.)… Even so, I’d like to try disabling that “parent checking” option I heard about on a different forum.

Any suggestions?


The problem with SASERV~1.EXE was a problem with prior versions, but seems to be fixed in the current version. Which version are you using? There is a fix for the problem even for older versions. Click Firewall>Advanced>Network Security Settings>. On that page locate and Remove (select the rule and click Remove) every entry for SASERV~1, including any entry that uses the full path name (not just the 8.3 name). Then browse to a web page (or whatever will cause a CFP pop-up for SASERV~1). On the pop-up, choose “Treat this program as…” and select “Trusted Application” from the drop-down. This should fix the problem.

I did as instructed and it seems to have actually gotten worse, if possible… Thanks for trying though, but its just popping up every few seconds.

I’m running the (or what seems to be the) latest version of the firewall ( and I checked for updates- none are available… I just read that its supposed to be 3.0.14.something… Somethings not right here.

I recently ran a battery of virus/malware scans including NOD32’s In-depth analysis, Asquared free, webroot spy sweeper, trendmicro housecall, and symantec security check. They all turned up clean, save symantec with a suspect file in a folder I promptly deleted. (I didn’t need it)

I really like this firewall, but if it keeps bothering me, I may have to switch back to zonealarm, as much as I don’t want to. (:SAD)


The newer version is here:
You should save your configuration (after Removing the SASERV~1.exe entries: click Miscellaneous>Manage My Configurations> and click Export. On the balloon, click the configuration name (probably only one on the list) and this will open the Save dialog. Save the configuration somewhere easy to find and not in the CFP directory (I use My Documents\CFP directory). This has the advantage that you will save some time with CFP learning your system. When you install the new version, it will detect the old one and ask if you want to remove it first. Do that and then after the reboot, run the install again to finish the process. Then, click Miscellaneous>Manage My Configurations> and click Import. Browse to the directory where you stored the configuration file from above and select it. This does not overwrite the existing configuration file, but only adds the imported file to the list of configurations that you can select. Then click Miscellaneous>Manage My Configurations> and click Select and choose the configuration with the name you saved. You may want to have a look at the thread:
which is a discussion of NOD32 and how to configure it best for CFP.

Thanks, I’ll be sure to give that a shot when I get back to that computer.


–Siege Force