I’ve been noticing a rather odd behavior with firefox 3. Whenever I drag something in the browser (an image for example, just click hold and drag), Defense+ triggers with a hit for accessing com interface spoolss (see attached, it also triggers for accessing the monitor whether or not I block spoolss).
From what I’ve read, spoolss is largely associated with the printer, so I’m quite curious as to why this is happening, if anyone else is experienced a similar event, and if there’s any harm in blocking off the events (I’ve tried combinations of blocking either or both the spoolss and the access screen with no apparent problems to browsing).
eh? I don’t understand, do you mean set firefox as a trusted app? I suppose I can add firefox as a trusted (at the moment I’m just allowing them as they go so I don’t get caught off guard).
I’m not sure about setting up spoolss as a trusted app though, since from what I’ve found there’s a exe, dll, and this com interface (the latter of which I have no idea how to begin to set as a trusted).
It does rather defeat the purpose of monitoring the application. And since this thing hits from a dell system restore, I suppose I can rule it out a malicious operation (not exactly sure why it needs the printer though).
This is a guess:
I tested by dragging a file into my Opera browser and what popped up was not from CFP (because all these progs are already defined by my D+) but Opera asking me where I want to save the file, with a standard Windows open dialogue box. This is tied to Windows Explorer, which is controlled by this setting: Explorer > Tools menu (or Control Panel) > Folder Options > View tab > Automatically search for network folders and printers
I tried turning off the auto search…, then switched firefox back to custom (without the spoolss rule), loaded up firefox, click and dragged your avatar and got hit by a pop up. So, I guess it’s not tied to the auto search like in opera.