CFP winlogon.exe broken OS (Windows XP)

[Guest]

[Cash]

First of all, hello to everyone, this is my first post here, and I hope that I chose the right forum for it.

I heard a lot of good reviews and comments regarding Comodo, so I decided to install it on my new system today. Installation went fine and CFP asked me to do a system scan. I agreed and it showed several system files infested with some kind of trojan. I was obviously skeptical seeing system files like winlogon.exe listed in the CFP results but I trusted the software. The next step was to reboot the system and that's where the problem occured.

My computer tried several times to boot up but without success. It booted up till the Windows XP logo with the black background but shut down, fired up again, the same procedure till I shut it off manually.

I guess that it's not a big suprise (or?) that I was extremely shocked. It took around two hours to repair my Windows installation and deinstalling CFP in Windows safe mode, so I could finally get to the desktop. I could go on telling you how much trouble CFP caused me today but apart from beeing angry, I'm seriously wondering how something like this could happen with CFP?

I see that a lot of effort and work is beeing put into the development of this software, and we are talking about a well known firewall. I could find about a few other users who experienced the same problem like me but I still have no idea how this could happen. CFP also seemed to be blocking the Windows activation system so I couldn't get to the desktop even after repairing Windows. (That's where I had to deinstall it in Windows safe mode.)

Apart from beeing angry (since it cost me a lot of time fixing this problem where I desperately need it to work on a project with its deadline beeing very soon..), I would really like to see the firewall working properly on my system. I was actually thinking about never touching CFP again but since I ended up looking for answers all day long, I wanted to ask my question at the "source" of CFP.

Thanks in advance for reading my post and eventually coming up with solutions.

[Vettetech]

I assume you did a scan with Comodo for malware. Well never trust any program at first that tells you something is a virus till you can prove it is. Its called a false positive and several malware scanners suffer from this. You must have deleted and removed what Comodo found as a trojan which was a false positive. All you had to do was boot into safe mode and do a System Restore.

[Cash]

I thought about the restore option but couldn't remember setting a restore point recently. (I guess I learned it the hard way to set one before installing new software or changing any important settings.) However, is this something hard and complicated to fix in the CFP code? It doesn't make much sense to me to put everything in question when it's supposed to be a security program, and I mean not just some unknown security program but one which got rewards and a lot of positive feedback.

I suppose that I should avoid using CFP's malware scan option since it doesn't work properly but can be assured that the rest of CFP is fine? (Btw, thanks for the fast reply.)

[sded]

Since you are running XP, see http://forums.comodo.com/feedbackcommentsannouncementsnews/free_legal_copy_of_acronis_true_image_v8-t22728.0.html .  Don't Comodo without it!

[Vettetech]

Comodo is a firewall with HIPS foremost. The malware scanner is new. ALWAYS do a System Checkpoint before installing anything.

[PiCo]

Perhaps they weren't false positives, trojan code could have been injected to many system files. Comodo's anti-malware isn't able to cure, only delete as far as I know, so it deleted everything.

I suggest you run an AV scan before trying to install Comodo again! What AV are you using now?

[Cash]

Thanks for both of your advices. I guess I was in a bit hurry and didn't think properly before acting.

My main goal was to block selected software to use the internet connection without my permission, and I hope that CFP is more than capable to do that. Still, I won't reinstall it again before my project is finished since I cannot risk any more down time. When I was in safe mode, it was quite amazing to see how many options CFP offers to the user, and I'm sure it will take some time to find the right settings to run my system without slowing it down.

Edit:

PiCo - I'm using Avira AntiVir Personal (free edition) and just scanned winlogon.exe and nothing found.

[Vettetech]

Perhaps they weren't false positives, trojan code could have been injected to many system files. Comodo's anti-malware isn't able to cure, only delete as far as I know, so it deleted everything.

I suggest you run an AV scan before trying to install Comodo again! What AV are you using now?

It is a false positive cause there are several posts about it the right section. Look under Comodo 3.0 help.

[Cash]

I did a search on winlogon.exe before posting but didn't even get a single result. Maybe it was because I wasn't registered or I just used the wrong key words.

[sded]

Only Advanced Search is working on the forums these days.  You can find several threads on this false positive and others that way.

[PiCo]

Strange, I run Comodo's antimalware regularly and never got any false positives on system files , only on some silly files most of them where even my own programs (I do a lot of C/C++ exercises for my school) Lol.

Anyway, good luck on your project Cash and I hope you don't reject Comodo

[Cash]

Only Advanced Search is working on the forums these days.  You can find several threads on this false positive and others that way.

Yah, you are right. I found some other threads describing exactly the same problem I had today, using advanced search that is.

PiCo - Thanks! Nah I won't. I actually feel a bit ashamed for acting so naively and letting CFP remove winlogon.exe. I will definitely give CFP another go when I get some free time again.

[Tags:]