Comodo blocking services.exe from modifing registry key

Discussion in 'other firewalls' started by hoakman, Nov 13, 2009.

Thread Status:
Not open for further replies.
  1. hoakman

    hoakman Registered Member

    Jul 29, 2009
    Hi, does anybody have any idea as to why services.exe would want to do this. On a fresh install of Windows 7 Comodo firewall is blocking services.exe from modifing registry key HKLM\SYSTEM\ControlSet001\services\BITS\Start.
    This appeares every 10 minute.
  2. HKEY1952

    HKEY1952 Registered Member

    Jul 22, 2009
    HKEY/SECURITY/ (value not set)
    Welcome to Wilders Security Forums hoakman.....


    services.exe is a part of the Microsoft Windows Operating System and manages the operation of starting and stopping of services.

    services.exe also deals with the automatic starting of services during the computers boot up, and the stopping of services during the computers shutdown.


    BITS in regards to the Microsoft Windows Registry stands for: 'Background Intelligent Transfer Service'

    BITS is an LegacyDriver Service and the ServiceDll is: 'gmgr.dll' located in C:\Windows\System32\

    BITS transfers data between clients and servers in the background using the unused bandwidth. If BITS is disabled, features such as Windows Update will not work correctly.

    BITS is dependent on the "RpcSs Service" 'Remote Procedure Call Service (RPC)' and the ImagePath leads to scvhost.exe

    Background Intelligent Transfer Service:

    About BITS:

    services.exe wants to modify the Registry Key: HKLM\SYSTEM\ControlSet001\Services\BITS\ /Start because services.exe is trying to start or stop an BITS data transfer.
    This BITS data Transfer is most likely Microsoft Windows Automatic Updates. (as an test only, try disabling Microsoft Windows Automatic Updates to see if the blocking stops, do not reboot)

    If COMODO still reports blocking of the \BITS\ /Start Registry Key every ten minutes, then there is another application requesting an BITS file transfer, there is nothing wrong with this.
    BITS never severs an file transfer when the Network connection is lost, it only suspends the connection in an queued state until the Network connection is available again.
    BITS always uses the idle, or unused bandwidth of an Network connection, giving access to applications in an first come first served approach.

    The Firewall MUST ALLOW services.exe to change the Registry Setting for \BITS\ /Start.

Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.