Investigating changed programs and components

When you receive a Changed Program alert , a Program Component alert, or a Component Loading alert, you may want to investigate to see if there is a known hacker exploit or other problem associated with the program or component that caused the alert.

Investigating changed programs

Use virus scanning/Trojan scanning software and technical support resources to determine if a changed program is dangerous or not.

Tip In order to investigate the program, you will need the file name, version number, and location of the file on your computer. You can get this information from the Changed Program alert box.

Follow these steps to investigate the program:

1. Make sure your virus scanner/Trojan scanner is up to date
2. Scan the program file.
3. If your scanner does not indicate a virus or other problem, contact the technical support staff of the manufacturer of the changed program. They may be able to give a reason why the program changed, such as an automatic update.

Investigating changed components

When you receive a Program Component alert or Component Loading alert, It can be difficult to determine if the component is dangerous or not.

Tip In order to investigate the component, you will need the file name, version number, and location of the file on your computer. You can get this information from the Program Component alert box, and from the Program Component Details box.

Follow these steps to investigate the component:

1. Go to the Microsoft support site (http://support.microsoft.com), and search the knowledgebase using the file name and description of the component as search terms.
2. Contact the technical support staff of the manufacturer of the program that loaded the changed component. They may be able to tell you why the component changed.
3. Perform an Internet search, using the file name of the component as a search term. We suggest using the Google search engine.