iexplore.exe... new to Comodo Firewallgeneral; security question...

Learn about Computer Security General Security Questions and Comments
#1

Hello Forum,

This is my first post at Comodo Forums; thanks for being there. I’m a novice home comupter user and a recent security issue on my computer prompted me to contact another computer help forum to assist me with cleaning my computer; this process initiated my wantingness to install a firewall, using your CFP software, and I had a question or two (security related…) following my process…

Upon downloading and installing, I immediately got allow/disallow notifications regarding “iexplore.exe” and “svchost.exe” type processesl I know the program is in learning mode, which I assume is normal. I have since uninstalled, reinstalled and uninstalled my Comodo product again and again, because when I don’t “allow” in certain situations, I lose access to my internet (I get the window that exlporer can’t connect…). At this point, I’m not sure what is normal for your program or abnormal for my computer.

I have read that certain applications iexplore.exe are necessary whereas some are malware. I’ve gone so far as to locate iexplore.exe within the internet explorer folder (C:\Program Files\Internet Explorer\iexplore.exe) and change iexplore.exe’s name (to… for example… iexplorehuh.exe…) to see if I can note it popping up in the windows task manager process section, but I don’t. I’ll go back to the internet exlporer file again… and another iexplore.exe file has been created just above the one I’ve renamed; a new file has automatically added. I’m not sure if this is part of XP to automatically attempt to correct a connection problem thereby creating a new file after I had renamed the original, or malware recognizing me renaming its file and it creating another one. I’ve also noted a exlporer.exe file (C:WINDOWS\explorer.exe) which when opened takes me to My Documents… I’m confused.

I’ve followed the advise of Majorgeeks.com to clean my computer, they say it’s clean, but I keep having problems with Comodo and iexplore.exe and svchost.exe doing what I suspect to be weird stuff. Q: how can I tell of the iexplore is bad or a required part of my system??? Thank you.

#2

G"day and welcome to the forums.

iexplore.exe is the executable name for Internet Explorer.

svchost.exe is the executable name for the Windows Services Host application.

Both of these should be allowed to access the internet.

You should also be aware that there are instances of malware that use names VERY close to these, in the hope that users won’t spot the difference. Some examples are “iexplorer.exe” - note the extra “r”, scvhost.exe - the “v” and the “c” are reversed. Another trick they use is to use two letters so they look like a different single letter; “rnozilla.exe” is not the same as “mozilla.exe” - the former example is spelt " r n o z i l l a", but the “r” and the “n” together look like an “m”.

The alerts are there for a reason, so it does pay to actually examine each one. Luckily, CFP is not all that “noisy” after the first couple of days.

Hope this helps,
Ewen

#3

Ewen,

Much abliged, mate! Thank you for the reply, helpful… yes. I’ll continue to look through these forums and review older posts. Thank you again for your assistance, expertise and time. Cheers! -Rob

#4

iexplore.exe is the executable name for Internet Explorer.
should be allowed to access the internet.

That’s open for debate haha. (:LGH)

#5

In Australia you have to be 18 to drink, drive and vote. The coincidence is equally debatable and ultimately predicatable. :wink:

Ewen :slight_smile: