Problem with HIPS

[Guest]

[MJ1988]

When I go to my settings to manage my allow and block lists it automatically closes out. It will be fine for a second until it loads all the files I need to manage, then just closes all together.

Anyone have a problem with this?

[JJasper]

Hi mcjacobs1988

This is a known bug.  It will hopefully be fixed when the new version is released.  There is no date for that release yet but we are told it will be soon.  If you need to unblock a blocked app refer to this thread .

John

[MJ1988]

Thanks

[MJ1988]

This is a pretty serious bug, why haven't they fixed this already, or are they just fixing it on CAVS 3?

[andyman35]

I wouldn't expect there to be any major development of  CAVS2 since it's being completely  redesigned from the ground up with version 3.It seems that for now they're only providing signature updates.

[TechnoGeek]

I found that this issue is related to Windows XP SP2 DEP (Data Execution Provention) a new service from Microsoft.

The following is from Microsoft Help and Support Center (a part of Windows XP)

Understanding Data Execution Prevention

Data Execution Prevention (DEP) helps prevent damage from viruses and other security threats that attack by running (executing) malicious code from memory locations that only Windows and other programs should use. This type of threat causes damage by taking over one or more memory locations in use by a program. Then it spreads and harms other programs, files, and even your e-mail contacts.

Unlike a firewall or antivirus program, DEP does not help prevent harmful programs from being installed on your computer. Instead, it monitors your programs to determine if they use system memory safely. To do this, DEP software works alone or with compatible microprocessors to mark some memory locations as "non-executable". If a program tries to run code—malicious or not—from a protected location, DEP closes the program and notifies you.

DEP can take advantage of software and hardware support. To use DEP, your computer must be running Microsoft Windows XP Service Pack 2 (SP2) or later, or Windows Server 2003 Service Pack 1 or later. DEP software alone helps protect against certain types of malicious code attacks but to take full advantage of the protection that DEP can offer, your processor must support "execution protection". This is a hardware-based technology designed to mark memory locations as non-executable. If your processor does not support hardware-based DEP, it's a good idea to upgrade to a processor that offers execution protection features.

What I was able to discover is that HIPS tries to access a "non-executable" memory location and Windows shuts it down.

I tried setting DEP for essential windows programs and services only. This did not help.

I hope that Comodo will get this fixed soon.

[Tags:]