"Application has been modified" warning

Aloha,

I'm running ESET SSS 4 on XP Home (fully patched). Late last night, I received an email with an attached PDF file. I opened the PDF file and clicked on "print". I got a pop-up window from ESET saying something about the spoolsv.exe application has been modified, do I want to continue? Checked the 'deny' box, and decided to look into it in the morning.

Today, I cannot reproduce the error message, and I can find NO trace of this error detection in any ESET log file, or in the Windows event log. I know it was late, and I know I was tired, but I'm certain that I was not dreaming. So... where does ESET log things like this? Do I have to set a certain level of logging to capture this type of event? If so, where and how do I do this?

Mahalo for your assistance!

Harry Z.

 

Hello harryz,

Are you sure that iit was ESET that said that the "Application has been modified" and then asked if you wanted to continue?

You might check the Windows Event Viewer and see if there's any mention of an error at that time.

BFG

 

Had the same warning, about same module, from ESET immediately after taking MS updates for XP/Office XP.

Regards

 

Aloha BFG,

Yes, I'm sure it was ESET as I have no other "active" security program on that machine. I also checked the Windows event logs before posting my question.

Harry Z

 

Aloha MSM.

Mahalo (Thank you) for confirming that I've not totally lost it!

It does seem strange to me that ESET does not log this warning message. Any ESET guru's care to comment?

Regards,

Harry Z.