3.0.25.378 Incorrectly Identifies Applications, Resulting in Wrong Rules [Merged]

[habanero]

Hi everyone.  I've been using Comodo for about a month now, reading this forum, and learning how to write my own rules.  So far, Comodo does everything I want and works much better than ZA.  I only have one problem I can't seem to solve or find the answer in this forum.

Occasionally, maybe once every few days, it seems the wrong app rule is used by Comodo.  For example, I will open Outlook and try to check POP3 server, and it will not connect.  A look at the log shows that it blocked "iexplore.exe" on port 110.  If I close outlook and restart it, my email works no problem.  Why does Comodo use the rules for "iexplore.exe" instead of "outlook.exe"?  I have noticed other apps getting mixed up too (Microsoft Word and Explorer for one).  This same thing occurs on both my home computers.  I really doubt it is a bug, since nobody else has reported this behavior.

Anyone have any ideas?

Regards,

Habanero

[panic]

If you open Outlook from the Mail menu with Internet Explorer, then you would get the alert you have described, as Internet Explorer (iexplore.exe) is the "parent" application of Outlook, in this instance. Similarly, if you click a link to a Word doc from within internet Explorer, then iexplore.exe would be the parent of winword.exe.

It depends how you "open" Outlook each time.

Ewen :-)

[habanero]

Thanks for the comments Panic.  However, I open Outlook the exact same way every time, from an icon in the quick launch bar.  I will pay attention to how the apps are opened when I see this issue and maybe it will shed some light on it.

Thanks,

Habanero

[Ronny]

Yep i have seen this before !!
I had my Checkpoint Firewall Dashboard trying to connect to the email server ;-) and i'm very sure it has nothing to do overthere. I had to cancel the request and restarted the Checkpoint Dashboard and then it when't normal again.
In all the time 3.0.25 is out i've seen this maybe 3 times, and if my memory is correct i had this with a previous version also.... very hard to reproduce...

[habanero]

Same thing just happened again.  Opened Outlook and iexplore.exe was blocked on port 110.  I used Process Explorer and there is no iexplorer.exe process running, just OUTLOOK.EXE.  I open outlook the same every time, with a shortcut in my quick lanuch.  IE is not even open.  Has anyone else noticed this?  It is difficult to reproduce and who knows how many others are getting mixed up and not noticed.

Should this be reported as a bug?  I'm not sure I can trust Comodo to protect me.  It happens on both my computers, and with several of the previous versions of Comodo.

Box1:  WinXP Pro SP3 desktop, Comodo 3.0.24.368.
Box2:  WinXP MCE SP2 notebook, Comodo 3.0.24.368.

Thanks for any additional input,

Habanero

[Ronny]

I had this again and made a screenshot of it.
Thunderbird had the focus, i try to start Smartdashboard using Launchy and the firewall asks if thunderbird may connect to the Smartcenter server. I had to close the SmartDashboard, cancel all firewall requests. Restart Smartdashboard again with Thunderbird in focus using Lauchy and now i can connect to the Smartcenter server.

Maybe a Mod can move this to Bug ?

[attachment deleted by admin]

[Ronny]

Bad day today   
I started a dig (DNS Query) in a command box, and the firewall prompts for FWpolicy.exe to connect to the DNS Server on port 53 ? But FWPolicy.exe process isn't even running.

[boombaard]

i've over the past few weeks noticed a very odd behavior (most often while using remote desktop, but in other cases as well).. sometimes when i start a program while using remote desktop, the process will be recognized as another one, and the rules for that other program will be applied to it.
an example: i've seen it happen that uTorrent was started, but the running process, when looked up in the Active Connections list was called "outlook.exe", with the connections you would expect from utorrent running under those rules (comodo will also start asking for new rules for the outlook.exe entry if necessary for utorrent to work normally)
has anyone else noticed this behavior?

[Ronny]

Hello Boombaard,

Yep see this one...

https://forums.comodo.com/empty-t23793.0.html

[habanero]

Problem:  CFP gets confused and applies the wrong application rules occasionally.  Problem occurs at least 2-3 times per week with outlook.  Sometimes when I open outlook, it errors out and says it cannot connect to my POP3 server.  A look in the firewall log shows that iexplore.exe was blocked on destination port 110.  A quick check in the view active connections shows that outlook.exe is running and iexplore.exe is not.  If I close outlook and restart, it will work fine again.  This happens on both my machines listed below.  Also saw the problem with winword.exe and explorer.exe once several weeks back.  I'm concerned that other apps are getting confused and I'm just not noticing.  I posted in the forum a few weeks ago and another user reported this same behavior with other apps.  I am very happy with Comodo with the exception of this issue.


Dell e1705 notebook running Windows XP MCE 2005 SP2 using administrator account
CFP versions 3.0.21.329 - 3.0.24.368 x32-bit (problem noted on all indicated versions)
Dual core centrino T7200 2.0 GHz with 2 GB RAM
Avast 4.8 Professional
Firewall mode:  Custom Policy Mode, no advanced section changes
Defense+ mode:  Clean PC mode, no advanced section changes

Gateway desktop running Windows XP Professional SP3 using administrator account
CFP versions 3.0.21.329 - 3.0.24.368 x32-bit (problem noted on all indicated versions)
P4 2.4 GHz with 512 MB RAM
Avast 4.8 Professional
Firewall mode:  Custom Policy Mode, no advanced section changes
Defense+ mode:  Clean PC mode, no advanced section changes

Please let me know if I can provide any other useful information.

Regards,

Habanero

[Micc]

Anything new about this annoying bug?

I use cf 3.0.25.378 under WinXP SP2 with Custom Policy Mode. Many times cf identify a application wrong.

Example: i start firefox and cf ask me if a other appliation (with no defined rules) could connect to the internet. At the "Active Connections" window cf shows the wrong application too!

The strange thing is that cf always identify the same wrong application for all other software i start. I start firefox at "C:\Programme\Mozilla Firefox\firefox.exe" and cf ask me for "C:\Program Files\Connect.exe". I run my email proggie from "C:\Programme\Email\emailer.exe" and he also ask me for "C:\Program Files\Connect.exe"!?

Sometimes it helps to restart cf to avoid this problem.

How to trust a firewall that ask for outgoing connections of the wrong application? I really like cf but this annoying bug must be fixed soon!

[habanero]

Not to my knowledge, but thanks for your input.  I'm beginning to think it's not something with my system.  I submitted a bug report a few weeks ago, so we'll see.  I'm in the same boat as you...who knows what else is being screwed up and not being caught.

Habanero

[3xist]

Anything new about this annoying bug?

I use cf 3.0.25.378 under WinXP SP2 with Custom Policy Mode. Many times cf identify a application wrong.

Example: i start firefox and cf ask me if a other appliation (with no defined rules) could connect to the internet. At the "Active Connections" window cf shows the wrong application too!

The strange thing is that cf always identify the same wrong application for all other software i start. I start firefox at "C:\Programme\Mozilla Firefox\firefox.exe" and cf ask me for "C:\Program Files\Connect.exe". I run my email proggie from "C:\Programme\Email\emailer.exe" and he also ask me for "C:\Program Files\Connect.exe"!?

Sometimes it helps to restart cf to avoid this problem.

How to trust a firewall that ask for outgoing connections of the wrong application? I really like cf but this annoying bug must be fixed soon!

I would advise you to post this bug in the "bug reports", So we can collect the bugs and submit them to the developers.

Josh

[Micc]

CF 3.0.25.378: Defense+ is disabled, Firewall+ mode: Custom Policy Mode
OS: Windows XP SP2 + all hot fixes available via MS online update
CPU: 32 bit
Viruscanner: Avast 4.8.1201 Home Edition (only "Standard Protection" acitvated)
User: Administrator account

Problem:

Many times CF identify a application wrong.

Examples:

1. I start "C:\Programme\Mozilla Firefox\firefox.exe" (with existing rules) and CF show me that the application "C:\Program Files\Connect.exe" (with no defined rules) would like to connect to the internet.

2. I start my Emailer at "C:\Programme\Email\emailer.exe" and CF show me that the application "C:\Program Files\Connect.exe" would like to connect to the internet.

3. I start firefox and get a message about a new update. I run the update and after automaticcaly restarting firefox CF ask me if "C:\Program Files\Connect.exe" could connect to the internet!

4. and so on...

my observations:

1. every time when CF identify a application wrong, CF tells me "C:\Program Files\Connect.exe" wants to connect to the internet. It doenst matter if i delete or move "C:\Program Files\Connect.exe"
2. at the "Active Connections" window and the traffic info frame CF shows the wrong application ("C:\Program Files\Connect.exe") too
3. the tool "C:\Program Files\Connect.exe" get started sometimes by an other application with defined rules
4. sometimes it helps to restart CF once or many times to get rid of this problem

Sorry, but i dont know how to reproduce this problem, because it happens to randomly but every day many times...

Pls also read the messages of other users with the same problem: https://forums.comodo.com/help_for_v3/wrong_app_rule_used-t23793.0.html

IMHO:

It looks like that CF have some problems with the Hash-Table that stores the unique values for every application CF knows.

[Kyle]

Hello and Welcome to the forums!


Very clear and informative post from your side!

Just a question, Have you tried restarting your computer and seeing if the problem persists?