svchost.exe modifying explorer.exe ?

Sat 29 - 16:09:53 [MODIFY] c:\windows\system32\svchost.exe [1020] was blocked from modifying c:\windows\explorer.exe [1760]


even i assume this is ok ...
any idea why this event happen (if svchost already got predefined rules?)

PG 3.150 and Windows XP Pro SP2 English

 

Hi Dwarden, svchosts,exe in the system32 folder and is a system .exe
C:\WINDOWS\System32\svchost.exe 2nd Generic Host process used to load services that use DLL's.

In processGuard svchosts should be set as follows:

Protect from Modification and Termination
Allow Modify & Read + Access to Physical memory.

If you have Port Exploer you will see that there are usually several instances of SVCHOST's running.

HTH Pilli

 

Thank You, wasn't sure