COMODO Internet Security 3.8.61948.459 BETA Bug Reports [CLOSED]

System fails to startup normally, i keep a black screen and a mouse cursor, can move the cursor though, after a few minutes the system reboots spontaneously. Eventlog shows it failed to load inspect.sys

  1. Vista, SP1, Enterprise, x32, Normal User, Fully Patched
  2. Windows Defender, VMWare 6.5.1 Workstation.
  3. I was just restarting my laptop.
  4. N/A
  5. N/A
  6. Done
  7. N/A

[attachment deleted by admin]

Hi burebista, sorry you’ve had problems.

Can you check your Windows Event log at around the time you installed CIS? Obviously, you’re looking for any errors relating to driver installations or Comodo? Have you had a BSODs (Blue Screen Of Death) recently? Did you have any trouble uninstalling the previous version of CIS?

At this very moment, I don’t know. You’ve blown my theory that it was Vista x32 with 4GB. Since you have 64bit. Anyway it depends on why inpsect.sys isn’t running or perhaps why it didn’t install correctly. For me, it took an embarrassingly long time to realise inspect.sys was not running. My Vista system isn’t on-line & thus I didn’t test the comms (the quickest way to find out I suspect).

1 Vista home basic 32bit
2 SpywareBlaster, WinPatrol Plus
3 Installed the beta with no problem. Two days later I did a virus scan. It found nothing. Rebooted and got as far as the Windows is starting window and that’s where it stops. Still running as the Vista wheel keeps spinning.
Let it spin for 45 minutes this last time. Put back the last non beta version by a snapshot and it started right up.
4 Tried restarting several times
5 n/a
6 n/a
7 none
8 no other info available.

Was running great until the reboot.
Thanks, Dan

Hiya…

  1. Windows XP Pro SP3 (32-bit).
  2. Avira AntiVir PersonalEdition Premium, SUPERAntiSpyware (Free), Malwarebytes’ AntiMalware (Free, On-Demand), Sandboxie (Free), Sophos Anti-Rootkit (Free, On-Demand) and for Utilities I use TuneUp Utilities 2009.
  3. ThreatCast just doesn’t work for ANY app.
  4. I’ve tried disabling, re-enabling, etc. TC – it just won’t work.




Hope the issue gets sorted out, best of luck, thanks for your time.

This is not a bug. The some apps TC does Alert, And it’s only a beta and the TC base will build over time as more people use it.

Cheers,
Josh

This issue still exists for me:

Heuristics set on High.

Cheers,
Josh

No errors regarding Comodo install/uninstall. Only inspect.sys at boot. Everything else works as it should (Firewall and D+, I don’t use AV at home). At least I think so. :slight_smile:
I have only one BSOD with previous beta, but after I just updated my NIC drivers with Microsoft Update. After that BSOD I went at Marvell site and took latest driver and everything is OK, no more BSOD’s.
No trouble/errors when installing/uninstalling Comodo. After uninstalling I ran Comodo Regcleaner (from Comodo System Cleaner beta). At a first glance (after uninstall/regcleaner) nothing strange happens, things looks OK.

Vista64 and 4GB RAM here. May I ask what inspect.sys should do and why things looks OK even it’s not started?

Thanks for your thorough response. :-TU

Automatically submit the files in the submission queue does not work, it keeps “sending” them and never finish. Is this disabled on BETA installations ? or is this a bug ?

  1. Vista, SP1, Enterprise, x32, Normal User, Fully Patched
  2. Windows Defender, VMWare 6.5.1 Workstation.
  3. Get some files in the submission queue and wait, you will see the systray pop once in a while sending the same files, check the submission queue, the files will not leave the queue.
  4. N/A
  5. N/A
  6. Done
  7. N/A
  8. Internet Security, Clean PC mode.

Edit:
Putting a packet trace under the “submit” button shows that the host is not running the HTTP daemon, i get TCP RST packets back on the Destination: 77.92.68.124 - lookup1.security.comodo.com

[attachment deleted by admin]

Hello there, it’s me again 88)

Today I dug deeper in the Event Logs and I found an error in regard to CIS’s Driver. It goes like this (I had to translate it): ‘It is not possible to run COMODO Internet Security Firewall Driver service due to the following error: It is not possible to create a file that already exists.’

It was registered about the time I installed the 2nd BETA. No mention about inspect.sys
I’m attaching a screenshot of the ‘Details’ section of this error.

I have also found another error in relation to CIS:
‘COMODO Internet Security Helper Service has unexpectedly stopped working. It has happened: 1 time(s) so far.’

I think it relates to the stable version (.439) as it comes from a good 1 hour before I installed the beta, but I MAY BE WRONG.
Attaching a screenshot.

There’s one more thing I have found - there are logs about Inspect (but I don’t think it’s the same as inspect.sys) not loading but, in my opinion, they pertain to SUPERAntiSpyware. See for youself:

The following boot-start or system-start driver(s) failed to load:
Inspect
pdqukley
SASDIFSV
SASKUTIL

Attaching a screenshot.

Thanks

[attachment deleted by admin]

  1. Win 7 x64 b7000
  2. Avira Free Antivirus, Malwarebytes, Clamwin (On demand only)
  3. Attach screenshots to your posts to clarify the issue further

CIS beta 3.8 installed fine on my machine (win7 x64 b7000), using compatibility mode (vista) & w/ administrator options configured on the installer. The screen shot attachments will say it all:


http://i73.photobucket.com/albums/i204/the_prefect/th_cisb2A.jpg

Antivirus engine not initialized


http://i73.photobucket.com/albums/i204/the_prefect/th_cisb2B.jpg

Virus database signature after a very long update


http://i73.photobucket.com/albums/i204/the_prefect/th_cisb2C.jpg

Could not initialize scanning engine. Run diagnostics


http://i73.photobucket.com/albums/i204/the_prefect/th_cisb2D.jpg

Slight hang


http://i73.photobucket.com/albums/i204/the_prefect/th_cisb2E.jpg

No problems on installation or conflicts with other applications

Also tried to it w/o UAC & unchecked the “detect shellcode injections” on image control execution settings & still no luck in updating & running the cavs engine. Uninstalled other security software & re-installed CIS beta 3.8, turn out is still the same.

One thing more to add, this 3.8beta keeps on disconnecting my net connection, randomly. troubleshooted my NIC driver (Realtek; update & downgrade). Unchecked the power-saver options of this NIC hardware but to no avail. I also disabled the threatcast option but no go for me. Still causes random disconnection every now & then.

Reverted back to CIS beta 3.5.61373.458, now works flawlessly (including my imported rules for firewall & d+).

Gonna try it (CIS beta 3.8 ) on my vista x64 machine later on, to see if it does produce the same results.

:THNK

add’l:

ran multiple reg cleaners & manually deleted comodo entries from install-uninstall procedure, using regedit.

Inspect.sys is CIS’ main packet inspection driver for the firewall. Things look OK without it, since inspecting packets is really all that it does. All the visible stuff doesn’t rely on inspect.sys directly. It’s also one of those components that just should not stop, ever (unless CIS is uninstalled).

I’m not sure about the timings… but, unfortunately, the Inspect referred to here is CIS’ inspect.sys & it is an active (primary) component of all recent versions of CIS, including the recent BETAs. You’re basically seeing what I have seen. Interestingly enough, I also had the same trouble with SAS initially myself, but I removed all of SAS & that did not seem to have any positive or negative impact on CIS. Not sure of the relevance of SAS at this point.

When it doesn’t run what does that mean with regards to protection? :o

I have the same thing logged for Inspect service as well and traced it back to both CIS beta 1 and 2 in Event viewer here on Vista. How can I determine that the driver is not working other than in Event viewer?

When for example I tell the client program to block traffic for a browser it will block traffic. Does that mean the Inspect service is running or not (or is this not a valid way of testing that the Inspect service runs or not?)

Obviously, this doesn’t happen in non-BETA’s & usually this is not a problem, since without inspect.sys running then nothing is going to happen anyway. AFAIK your Net connection will be non-operational in this situation. However, I’ve not tested either of these BETA’s in this specific situation.

Under Vista or XP, use the Device Manager & set the View to “Show hidden devices”. This should show a section called “Non-Plug and Play Drivers”. You should be able to find inspect.sys in there & find it current status (Properties).

Sort of answered above… with inspect.sys not actually running, although installed, everything is usually blocked.

I hope that helps.

edit

Thanks for the precise answer.

I looked under Non Plug and Play drivers and only found the Comodo Internet Security Helper Driver that was up and running. No sign of Inspect or inspect.sys.

You also said “with inspect.sys not actually running, although installed, everything is usually blocked.”. Event viewer says it is not running so logically speaking I should not be able to connect to the internet or my local network; which I can.

Then it looks like we may have a bug here. It looks like it is running but Windows reports differently. May be there is an error in how it registers with Windows and therefore gets reported to not have started and not being shown under Non Plug and Play drivers.

Can one of the devs comment on this? Now I am curious… (:NRD) (:KWL)

Hi EricJH

I’ve already PM’ed Egemen about this. I know from Egemen’s posts that there is something new about CIS’ driver deployment under Vista, so it’s possible that we can’t see it in the same way. But, to confirm… the Device Manager is telling you that inspect.sys is not running & that everything else says all systems are functioning correctly. Is that correct? Also have you checked your Windows Event logs?

I have checked the event logs and it says: “The following boot-start or system-start driver(s) failed to load:
inspect”. The event id is 7026. The same thing also happens on Win 7 beta build 7000 (I know Win 7 is not considered yet in the process but since it is Vista +…)

Inspect or inspect.sys does not show up under Non Plug and Play devices. The only Comodo related driver that shows up under Non Plug and Play drivers is Comodo Internet Security Helper Driver.

Let me know if more information is needed.

I have the same above in Vista SP1 64 bit. Will check Win7 later out of curiosity.
Also have CIS (D+ firewall and antivirus running), BOClean, Windows Defender and Safe Surf)
Kevin

OK, rollback to CIS stable no more inspect.sys error. Probably it’s not launched at startup.

100% cpu from cfp when antivirus update !

AV Scanner does not log/report inaccessible files, like system files and/or password protected archives.
This way you can never be sure there is not something nasty preventing the scanner from accessing it.
I really like to see a list of inaccessible files after a manual scan.

  1. Vista, SP1, Enterprise, x32, Normal User, Fully Patched
  2. Windows Defender, VMWare 6.5.1 Workstation.
  3. See above
  4. N/A
  5. N/A
  6. N/A
  7. N/A