apod.exe - ZoneAlarm reports Suspicious Behaviour

steve · Post by **steve** » Thu Apr 20, 2006 9:26 pm

Many thanks for apod.exe - I look forward to seeing what will come up as my screen background each day!

I have ZoneAlarm Security Suite (v6.1.744.001) on my PC. ZoneAlarm pops up a warning every day about apod.exe:

Description: Astronomy Picture of the Day was prevented from controlling the keyboard input of the process: C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServer
Rating: High
Date / Time: 2006/04/20 19:03:18+1:00 GMT
Type: Message
Subtype: Access Keyboard
Data: C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequest
Program: C:\Program Files\APOD\apod.exe

Why does apod.exe interact with csrss.exe?
Is apod.exe simulating keystrokes? If so, why?

lior · Post by **lior** » Fri Apr 21, 2006 1:15 am

Apod.exe simulates one keystroke in order to exit the screen saver mode before changing the wallpaper. I believe you leave your system running at night. When apod.exe changes the wallpaper, it first generates a single keystroke in order to make sure the screen saver is off. Of course, this is harmless to your system.

makc · Post by **makc** » Fri Apr 21, 2006 2:19 pm

wow.
it appears gods still visit us.

aardvaark · Post by **aardvaark** » Fri Apr 21, 2006 5:21 pm

According to ZoneAlarm everything is suspicious.That's why I don't use it.I get tired of closing the pop-ups from them.