AvastUI is trying to install global hook dwmapi.dll

[cska133]

hi,

I got following message
What should it be and why?

[igor]

I believe you'll have to ask Comodo what they mean by that.
Btw, dwmapi.dll is a system (Microsoft's) module.

[cska133]

but Avast is trying to install and Comodo is just reporting. So Avast is making the action, why to ask Comodo?

[igor]

But what exactly is Comodo actually reporting? Personally I believe it's some kind of false alarm - but in any case, it's not clear what it's supposed to mean. So there's no answer to your question as the question is rather vague/unknown.

[McMcBrad]

hi,

I got following message
What should it be and why?

Hooks are modules that extend program functionality.
A global keyboard hook from an app will allow you to set shortcuts e.g ctrl+alt+F2 to bring a main window, and then regardless of the current app you are using, pressing these keys will perform the action.
In that case the hook serves as a key capturer.
Other hooks AVs install is for their behavioural blocker - they hook all apps so they can capture events.

This hook in particular looks like Windows, not Avast hook, that manages the transparency in the title bar, as well as its colour. It’s also responsible for hardware acceleration and rendering and is linked to the dwm.exe (Desktop Window Manager) process.
I believe Comodo hasn’t captured the information accurately.

This might be helpful:
https://en.m.wikipedia.org/wiki/Desktop_Window_Manager

Comodo is alerting you on hooks installation as they can be used by keyloggers, to inject code in trusted processes, to access process memory and for privilege escalation.
If the prompt is from a trusted app, you should allow it, not to limit its functionality.
If it’s an app not trusted and not digitally signed, you should not allow global hooks installation.

[cska133]

ok, but in my case if it was not Avast but - maybe - Windows... so it is not for sure which app it trying to do it

[McMcBrad]

ok, but in my case if it was not Avast but - maybe - Windows... so it is not for sure which app it trying to do it

It's been the dwm.exe, but Comodo hasn't traced the event properly.

[cska133]

but why dwm.exe will want to install this dll?

[McMcBrad]

but why dwm.exe will want to install this dll?

It needs to install this dll in every app, so hardware acceleration can be used and transparency on the title bar can be achieved.