Can't Install Comodo Firewall

[Guest]

[Alan Borer]

Perhaps it is Windows Security Centre which will stop Comodo from installing if it believes you still have protection from your previous Security software.

The "final solution" may be to rebuild the repository so that Windows corrects its mistake

You seem to have ignored the PURPOSE of my information.

Windows Security Centre is NOT specifically designed to aggravate Comodo.

Instead it aggravates every-one ! !

Perhaps it thinks you still have "AVG Free " installed, and it will not let Comodo in because it objects to have different security products that conflict.  It may also prevent Norton or many other things.

Perhaps you need to rebuild the repository.

The normal cure is to rebuild the repository, and this should cause Windows Security Centre to realise that it is legitimate to permit new security software.
Sometimes it causes a problem and it may be easier to recover if the original repository is renamed and NOT deleted.

I merely gave you a reference to show you how to rebuild the repository by use a couple of simple DOS console commands - NOT BY RUNNING THE ENTIRE SCRIPT.  That reference also gives pros and cons for reasons and methods of repository rebuild.

Alan

[Vanchatron]

You seem to have ignored the PURPOSE of my information.

Windows Security Centre is NOT specifically designed to aggravate Comodo.

Instead it aggravates every-one ! !

Perhaps it thinks you still have "AVG Free " installed, and it will not let Comodo in because it objects to have different security products that conflict.  It may also prevent Norton or many other things.

Perhaps you need to rebuild the repository.

The normal cure is to rebuild the repository, and this should cause Windows Security Centre to realise that it is legitimate to permit new security software.
Sometimes it causes a problem and it may be easier to recover if the original repository is renamed and NOT deleted.

I merely gave you a reference to show you how to rebuild the repository by use a couple of simple DOS console commands - NOT BY RUNNING THE ENTIRE SCRIPT.  That reference also gives pros and cons for reasons and methods of repository rebuild.

Alan

OK thanks, but what exactly am I meant to do with those commands?  All I see is the following and I've no idea what it means or what to do with it:

"NET STOP WINMGMT /Y
cd "%windir%\system32\wbem\"
RD /S /Q "Repository"
NET START WINMGMT /Y"

Am I meant to paste all this into CMD or something?

[Alan Borer]

You can run CMD.EXE and at the DOS prompt give it four commands,
one at a time and waiting after each one for DOS to execute and prompt for the next command.
The NET ??? command may take some seconds.

NET STOP WINMGMT /Y
cd "%windir%\system32\wbem\"
RD /S /Q "Repository"
NET START WINMGMT /Y

Please note that you need the quotes exactly as shown,
you posted one to many in each of
"NET STOP WINMGMT /Y
and
NET START WINMGMT /Y"

If you need more information I again suggest you read the posts I designated on page 2 in the other topic devoted to the cleanup tool.

Alan

[Vanchatron]

You can run CMD.EXE and at the DOS prompt give it four commands,
one at a time and waiting after each one for DOS to execute and prompt for the next command.
The NET command may take some seconds.

NET STOP WINMGMT /Y
cd "%windir%\system32\wbem\"
RD /S /Q "Repository"
NET START WINMGMT /Y

Please note that you need the quotes exactly as shown,
you posted one to many in each of
"NET STOP WINMGMT /Y
and
NET START WINMGMT /Y"

If you need more information I again suggest you read the posts I designated on page 2 in the other topic devoted to the cleanup tool.

Alan

So I enter each line into CMD.exe one at a time, for example "NET STOP WINMGMT /Y" then press Enter, then "cd "%windir%\system32\wbem\"" then press Enter etc etc?

If so, I tried this but the 3rd line (RD /S /Q "Repository") didn't do anything, except for displaying an error message which read "The system can not find the file specified".

I tried installing Comodo again after all this, yet once again it didn't install.

I contacted Comodo technical support and all they did was tell me to get help on the forums... Well that's exactly what I've been doing but nothing seems to be working.

[Alan Borer]

Three possibilities spring to mind :-

FIRST POSSIBILITY
You were issuing commands with the wrong drive in use.
This is cured in my bullet proof ZapBeta.txt posted many months ago
it requires CD to include the /D option.
I show below my DOS screen after the CD and DIR commands
First without /D

D:\##>
D:\##>CD "%windir%\system32\wbem\"

D:\##>DIR R* /A:D
 Volume in drive D is D_new
 Volume Serial Number is 6C85-C340

 Directory of D:\##

File Not Found
D:\##>

And now with the /D option

D:\##>
D:\##>CD /D "%windir%\system32\wbem\"

C:\WINDOWS\system32\wbem>DIR R* /A:D
 Volume in drive C is ACER
 Volume Serial Number is EC16-8702

 Directory of C:\WINDOWS\system32\wbem

01/08/2009  16:48    <DIR>          Repository
               0 File(s)              0 bytes
               1 Dir(s)   8,246,095,872 bytes free

C:\WINDOWS\system32\wbem>

SECOND POSSIBILITY
You may have run these commands in a previous attempt,
or you may have run the Cleanup-Tool which includes these commands,
in which case the Repository was already removed so it cannot now be found,
but with luck the repository should be rebuilt within a few minutes of rebooting the P.C.

THIRD POSSIBILITY
There is no Repository because Windows is corrupt and has lost the ability to rebuild the repository.
This is unlikely but possible, hence I pointed you to my posts in the Cleanup-Tool topic.
If Windows is broken an expert may be able to mend it for you, but I am not in that league.

I have no experience of fixing this problem, but have a guaranteed fix if it hits me,
I will restore C:\ from an Acronis Disc partition image I made earlier.
A more painful solution is to re-install Windows (pity it came pre-installed without installation discs).

Alan

[elGeminy]

Hi Vanchatron, please do following:
1. Download DebugView from Microsoft site: http://technet.microsoft.com/en-us/sysinternals/bb896647.aspx
2. Run it with administrator privileges
3. In the DebugView menu please select:
   a) menu File -> Log to file as... -> Log file edit box -> select a file (or type a filename) which you will be able to find later
   b) menu Capture -> Capture Win32
   c) menu Capture -> Capture Global Win32 (dont worry if this submenu item does not exist)
4. Using cmd.exe, run firewall installer with the following parameter: "-log log.txt". This command will create log.txt file near the firewall installer.
5. After your installer shows an error message, close it, and wait for a few seconds to let all processes finish, then look for another log file:
    a) go to the your TEMP directory. Fastest way to do this is to write the following command in the cmd.exe: "explorer %temp%" (+ press enter). Alternatively you can write %temp% in the Windows explorer's address bar.
    b) in the TEMP directory you will find a file called approx like this: "cis_10-07-19 20.23.46.log", where "10-07-19 20.23.46" is the installation date and time (of course, your actual date and time will be different)
6. As a result you will have 3 log files avaulable:
    - from point 3-a
    - from point 4
    - from point 5-b
Please zip these files and attach to the your message. I will check these files and try to assist you.
Please do not hesitate to ask questions should you find above explanation not clear.

[Vanchatron]

Hi Vanchatron, please do following:
1. Download DebugView from Microsoft site: http://technet.microsoft.com/en-us/sysinternals/bb896647.aspx
2. Run it with administrator privileges
3. In the DebugView menu please select:
   a) menu File -> Log to file as... -> Log file edit box -> select a file (or type a filename) which you will be able to find later
   b) menu Capture -> Capture Win32
   c) menu Capture -> Capture Global Win32 (dont worry if this submenu item does not exist)
4. Using cmd.exe, run firewall installer with the following parameter: "-log log.txt". This command will create log.txt file near the firewall installer.
5. After your installer shows an error message, close it, and wait for a few seconds to let all processes finish, then look for another log file:
    a) go to the your TEMP directory. Fastest way to do this is to write the following command in the cmd.exe: "explorer %temp%" (+ press enter). Alternatively you can write %temp% in the Windows explorer's address bar.
    b) in the TEMP directory you will find a file called approx like this: "cis_10-07-19 20.23.46.log", where "10-07-19 20.23.46" is the installation date and time (of course, your actual date and time will be different)
6. As a result you will have 3 log files avaulable:
    - from point 3-a
    - from point 4
    - from point 5-b
Please zip these files and attach to the your message. I will check these files and try to assist you.
Please do not hesitate to ask questions should you find above explanation not clear.

Regards,
Sergei Kalenchuk
COMODO developer

Apologies for not replying to you sooner.  Anyway, I've done what you've asked and have uploaded 3 logs for you to look at, thank you very much.

[elGeminy]

OK, I think I can see the problem. Something in your system blocks installation of one of the firewall drivers. In the case you have any system utilities or security programs for register monitoring, please
turn them off. (Please advise: during the installation process, are you shown any information messages or alerts telling you that something is trying to write itself to autorun? To be precise into this registry key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows)?

If you are sure you don't have/use any such utilities, then ...

2) ... you need to check access rights for this key. To do it, in the regedit.exe application go to the key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows. Hover the mouse over the key, right click and select 'Permissions...' from the context menu. You will need to learn what
access rights are available for the group of the administrators (marked with red on the image).




Most probable is the case no.1) and you do have a program blocking writing into this thread. If not, and the problem is with access rights (case no.2), then you somehow lost the rights for this register key -
let me know and together we will try to improve the situation.

3) It might also be the case that your system is infected with a virus blocking writing access to the registry.

Please send me autorun log. You can do it as follows:

a) download Autoruns utility (however you should already have it from here: http://forums.comodo.com/install-setup-configuration-help-cis/cant-install-comodo-firewall-t58939.0.html;msg413602#msg413602)

b) in the downloaded archive you have two utilities: autoruns.exe and autorunsc.exe. You'll need the 1st one (autoruns.exe), run it in the command line as follows:
     autoruns.exe -v -a autoruns.arn

d) wait till the utility finishes scanning of the system and closes. After it closes, next to the utility you will find autoruns.arn file. Zip it and send it to me via e-mail skalenchuk[at]comodo.com (please do not post it as an attachment on the the forum).

PS: If the installation continues to fail, please try to keep installations log as I described it in my previous post. As I can see the situation, so far we need only the log described in the item 3) (the one created with DebugView) which you could also attach to your e-mail.

[Vanchatron]

I have sent you an email containing the items you require.

[elGeminy]

Vanchatron, i've got your email and analyzed your autoruns logs....
I am sorry, but your PC is seriously infected with at least four dangerous viruses. They blocks your registry and fully controls your Windows.
For example:
C:\windows\fonts\fonts.exe - see http://www.auditmypc.com/process/fonts.asp
System32\appmgmts.dll - see http://www.greatis.com/appdata/d/a/appmgmts.dll.htm
si.exe - see http://www.processlibrary.com/directory/files/si/ - most dangerous, it loads under explorer (maybe even replaces it)
Also I've found few suspicious and unknown drivers in your system.

Of course, you can try to cleanup your PC, but it is not any guarranty you clear your OS completely.
So, I recommend you to reinstall Windows and after reinstalling defend your new OS with CIS - antivirus,  firewall. After CIS installing I strongly recommend you to scan ALL your harddisks.

Good luck
Please do not hesitate to ask me your questions if any. You can mail me directly if you need.

[Vanchatron]

Vanchatron, i've got your email and analyzed your autoruns logs....
I am sorry, but your PC is seriously infected with at least four dangerous viruses. They blocks your registry and fully controls your Windows.
For example:
C:\windows\fonts\fonts.exe - see http://www.auditmypc.com/process/fonts.asp
System32\appmgmts.dll - see http://www.greatis.com/appdata/d/a/appmgmts.dll.htm
si.exe - see http://www.processlibrary.com/directory/files/si/ - most dangerous, it loads under explorer (maybe even replaces it)
Also I've found few suspicious and unknown drivers in your system.

Of course, you can try to cleanup your PC, but it is not any guarranty you clear your OS completely.
So, I recommend you to reinstall Windows and after reinstalling defend your new OS with CIS - antivirus,  firewall. After CIS installing I strongly recommend you to scan ALL your harddisks.

Good luck
Please do not hesitate to ask me your questions if any. You can mail me directly if you need.

Regards,
Sergei Kalenchuk
COMODO developer

This is very unfortunate, but I appreciate the fact that you've spotted this problem.  I've posted this on a virus removal forum, and so hopefully they'll help me clear up the problem.

I don't particularly want to have to do a full reinstall of Windows XP, as I have so many programs installed, but if I can't remove the malware I may have to.

Thanks again.

[Chiron]

Try using a boot cd.

Dr. Web may be the best choice as it is one of the few that has the ability to cure infections instead of merely deleting files.

[Vanchatron]

Hi there, I'd just like to say that I removed my viruses/trojans and was able to install Comodo Firewall with no problems whatsoever.

Many thanks for spotting the problem, I appreciate it!

[WhyWhyWhy]

So, I recommend you to reinstall Windows and after reinstalling defend your new OS with CIS - antivirus,  firewall. After CIS installing I strongly recommend you to scan ALL your harddisks.

No let me get this straight...

This person can't load an antivirus package because they have a virus? I used to recommend CIS to loads of people but you guys are getting as sucky as Symantec, and they REALLY suck.

[Alan Borer]

No let me get this straight...

This person can't load an antivirus package because they have a virus? I used to recommend CIS to loads of people but you guys are getting as sucky as Symantec, and they REALLY suck.

I pity the fool who takes notice of your recommendations.

CIS is good, I prefer it, I expect it to keep out the bad stuff,
but when the bad stuff has taken over it is too late to keep it out.

Only a fool would insist upon using ANY antivirus to remove a rootkit.

Over one month ago Vanchatron posted thanks that following advice given him 2 days earlier he had sought and removed malware.

You seem to be a troll with a very poor sense of timing.

[Tags:]