Page 1 of 1

apod.exe - ZoneAlarm reports Suspicious Behaviour

Posted: Thu Apr 20, 2006 9:26 pm
by steve
Many thanks for apod.exe - I look forward to seeing what will come up as my screen background each day! :D

I have ZoneAlarm Security Suite (v6.1.744.001) on my PC. ZoneAlarm pops up a warning every day about apod.exe:

Description: Astronomy Picture of the Day was prevented from controlling the keyboard input of the process: C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServer
Rating: High
Date / Time: 2006/04/20 19:03:18+1:00 GMT
Type: Message
Subtype: Access Keyboard
Data: C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequest
Program: C:\Program Files\APOD\apod.exe


Why does apod.exe interact with csrss.exe?
Is apod.exe simulating keystrokes? If so, why?

Posted: Fri Apr 21, 2006 1:15 am
by lior
Apod.exe simulates one keystroke in order to exit the screen saver mode before changing the wallpaper. I believe you leave your system running at night. When apod.exe changes the wallpaper, it first generates a single keystroke in order to make sure the screen saver is off. Of course, this is harmless to your system.

Posted: Fri Apr 21, 2006 2:19 pm
by makc
wow.
it appears gods still visit us.

Posted: Fri Apr 21, 2006 5:21 pm
by aardvaark
According to ZoneAlarm everything is suspicious.That's why I don't use it.I get tired of closing the pop-ups from them.