Anti-virus suspicious behaviour alert during installation

[3muk]

Hi.

I've just downloaded the most recent build of BullzipPDFPrinter (BullzipPDFPrinter_6_0_0_766.exe) and installed it on a Windows XP SP3. During the installation however I've got 13 alert messages from Sophos Anti-virus which worried me sligtly. All alerts were similar to this one:

=====
Process 'c:\Documents and Settings\<username>\Local Settings\Temp\is-RG6MI.tmp\bullzippdfprinter_6_0_0_766.tmp' exhibiting suspicious behavior pattern 'HIPS/ProcMod-004'.
Access denied.
Please send a sample to Sophos.
=====

Has anyone else experienced the same problem? I suppose it's nothing to worry about but I just waned to be reassured.
Many thanks!

[tugo0ew02]

This is normal - the installer stops and starts Spooler service many times.

See at Sophos:
http://www.sophos.com/security/analyses/suspicious-behavior-and-files/hipsprocmod004.html
(esp. "More Information")

[3muk]

Many thanks! Always good to learn something new...

[quote="tugo0ew02"]This is normal - the installer stops and starts Spooler service many times.

See at Sophos:
http://www.sophos.com/security/analyses ... od004.html
(esp. "More Information")[/quote]