Comprehensive Instructions for Completely Removing Comodo Firewall Pro 3 [INFO]

[Guest]

[Yuriy]

Boy, I know you wrote "latest" in all previous posts about issue. The reason i ask is to provide exact version number in report for devs even if it is evident that the matter concerns 3.0.22.349. So there is no concept "latest". 

[Searinox]

The issue has occurred to me with both 3.0.21 and 3.0.22, so yes it is happening in 3.0.22.349, trust me I know what I'm talking about. The people who reported on the other forums however, posted since long before this "latest" version so I do believe it is not an issue concerning only 3.0.22 but rather CFP generally on certain Vista configurations.

[Yuriy]

Thanks for info. Issue may be connected to installer's behavior described here (my speculation).
Issue was raised and dev team would be aware of it shortly. Hopefully they'll investigate it (and provide some workaround here). At the meantime i suggest you to raise support ticket: support guys know a lot and hopefully they'll provide you some useful instructions.

[Searinox]

CAUSE OF PROBLEM DISCOVERED! WORKAROUND POSSIBLE!

Comodo Firewall Pro 3 on Vista x32 is apparently IN CONFLICT WITH NOD32'S IMON - IMON is the antivirus' module for checking online traffic for viruses. Uninstall of either NOD32(I use version 2.70.39) or CFP returns functionality back to Windows and cures the list of 5-minute ill-effects mentioned earlier. A note that IMON does NOT have to be active in order to cause conflict.

NOD32 allows disabling of IMON to the level at which CFP allows disabling of D+, that is - it can unload the driver. However, it still leaves it registered in Windows and that alone still causes problems. Fortunately, NOD32 is built on an extremely modular model, so it is easy to "rip out" the module from the AV without stability issues or errors. Note that files are STILL scanned upon download - even before the user accepts said download - so the IMON module is not all that important, but rather an alternative for those who believe their computer is clean and only want to scan what gets into their computers without a real-time scanner - it is redundant.

To rip IMON out of NOD32:

-boot into safe mode
-go into c:\windows\system32 find imon.dll and delete it
-delete pu_imon.dll pu_imon.chm ps_imon.dll from the antivirus folder, and from the \setup\ folder that are located within the AV folder
-restart

The antivirus will appear without said module in the UI and function perfectly normal, including updates.

Uninstall of NOD32's IMON is necessary on problematic systems before the install of CFP in order to prevent:

-the install of CFP Miniport(s) after the install has completed and the system has been restarted
-leaving unremovable phantom CFP Miniports during uninstall

I have NOT however tested to see if removal of IMON makes the removal of the infamous CFP Miniports possible, but it certainly prevents them from being created. I don't intend to test it either. It's fixed, GOOD RIDDANCE!

I have additionally, removed DMON(document monitor) and EMON(email monitor) from NOD32 in the same manner. Again NOD32 scans these files when they are created or modified in the first place, so these modules are all but redundantly useless unless the realtime scanner AMON is disabled.

[gapintheclouds]

I'm not sure if this is of any help.

I had trouble uninstalling Comodo after trying to do an update. It was coming up with a framework error during the uninstall and error 112 during the update. Then I remembered that Windows Update had installed some stuff recently, mainly: Security Update for Microsoft .NET Framework, Version 2.0 (KB928365).

Interestingly enough Windows installed this for me, but when I look I only had .NET 1.1 installed, so I uninstalled the above update and suddenly the uninstall program worked again. Microsoft are great.

Hope this helps.

[tednor]

.NET in general is complete farce and I have had MANY problems with 2.0 in particular resulting in the need to reformat (now MS says I have used up my validations - THE NERVE!).  I advise everyone to steer clear of .NET completely as it will probably be the worst PR nightmare in MS history when all is said and done.  Thanks for the above as I am about to uninstall CPF and know what to look for....

[noemoetz]

Well, for my self,
Using revo uninstaller is great....

But you need to install revo uninstaller first, before install the comodo Firewall...

Revo just a great and easy freeware for uninstall program/aplication ...

[Searinox]

I've recently upgraded to ESET Antivirus 3.0(NOT ESET Smart Security) and I must say it causes the exact same conflict as 2.7. The exact same symptoms are triggered after a while and the network monitor driver has to be removed manually.

This is done from windows:

-open Device Manager and select "Show hidden devices" and look for "epfwtdir", uninstall and restart
-look for the .sys file with the same name under C:\Windows\System32\Drivers and delete it
-look for the folder with the same name under the AV's install folder in \Drivers\ and delete it
-open regedit and go to HKLM\SYSTEM\CurrentControlSet\Services for the key with the same name and delete it
-restart

EAV will constantly report that analysis of network protocols is not functioning. EAV will continue to function normally in every other aspect.

I would like for either Comodo or ESET to look into this driver conflict and work out a solution...

[Vettetech]

I have used NOD32 2.7 and 3.0 and never had any problems uninstalling Comodo. I simply use Revo in advanced mode.

[Searinox]

Both 2.7 and 3.0 have caused me issues in uninstalling COMODO(leaves unremovable miniports), installing COMODO(installs miniport AFTER restart, freezes desktop seconds after startup, network firewall not functioning alerts), and operating my computer as-is(http://forums.comodo.com/help_for_v3/comprehensive_instructions_for_completely_removing_comodo_firewall_pro_3_info-t17220.0.html;msg157406#msg157406). Also I seem to not be the only one.

[bazald]

Unremovable miniports are no more:

If you have no Comodo software installed, it is as simple as searching with regedit for any keys containing Comodo and deleting the deepest folder containing those keys.  One catch:  you need to run regedit under the System account.

1. Grab the PsTools here:  http://technet.microsoft.com/en-us/sysinternals/bb896649.aspx
2. Unzip them wherever you like (but be warned it won't automatically make a folder for you).
3. Create a batch (.bat) file with the following in it:

Start "" psexec.exe -i -d -s c:\windows\regedit.exe

4. Kill any instances of regedit.

BE CAREFUL FROM NOW ON, YOU MIGHT WANT A REGISTRY BACKUP

5. Run the batch file and watch a new god mode regedit appear.
6. Start your hunt for Comodo (and LEGACY) registry entries to delete.

I think the most important ones for me were:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\NT_INSPECTMP
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\NT_INSPECTMP

[Tags:]