Author Topic: How to stop CIS service  (Read 3626 times)

Offline Conrad.TDI

  • Newbie
  • *
  • Posts: 8
How to stop CIS service
« on: October 26, 2008, 08:02:56 PM »
When I play games, music, work with graphics I often go off-line and shut off everything possible, both resident programs and services.  This is a safe state working only with local, known, previously screened programs and files.

Between the tray icon items, MMC Services snap-in, and Process Explorer, there's *almost* nothing I can't shut down while creating a truly minimal configuration.........except CMDAGENT.EXE service.

I *know* this is a protection to prevent trojan/virus/script from shutting down protection.  I assume this is some form of elevated rights, but I don't feel like working this through if there's an easier answer.

Thoughts?

3xist

  • Guest
Re: How to stop CIS service
« Reply #1 on: October 27, 2008, 03:20:39 AM »
Set Defense+ To Training Mode in Defense>Advanced>Defense+ Settings After you finished your games & work, set it back to Safe Mode.

Josh

Offline Conrad.TDI

  • Newbie
  • *
  • Posts: 8
Re: How to stop CIS service
« Reply #2 on: October 27, 2008, 05:33:08 PM »
thanks for the answer, but I want to actually disable the service.

I already kill the tray (and all) operations of CIS when I run stripped down (which also includes killing network service, printers, etc).

The service itself seems to be running at some kind of elevated permission level, and I cannot stop the service, even with special permissions fully checked in the services access portion of the MMC.

I wonder if it is internal to the .exe??

Offline doktornotor

  • Comodo's Hero
  • *****
  • Posts: 222
Re: How to stop CIS service
« Reply #3 on: October 27, 2008, 05:38:47 PM »
The service itself seems to be running at some kind of elevated permission level, and I cannot stop the service, even with special permissions fully checked in the services access portion of the MMC.

That's a feature. If you could disable it via MMC, then any stupid malware could disable all your protection with a simple "sc stop" or "net stop" command.  :-La

Offline Conrad.TDI

  • Newbie
  • *
  • Posts: 8
Re: How to stop CIS service
« Reply #4 on: October 27, 2008, 08:25:41 PM »
Oh, you can do one slightly better than shut the service down, as I just discovered!!!

This is an incomplete safety feature:

I *was* able to disable the service, and after a reboot have no core service running.  Even more odd was the tray .exe would load resident, then show a null sign on the tray icon.  In fact, I am typing this with cfp.exe running, but the core disabled, and the firewall not running.  Many users would fail to notice this.

My point is that a virus/script/etc could disable the firewall by first disabling, then rebooting the machine.

For my uses, I will set up a second system configuration with the firewall service disabled for the uses I originally posited.  Take a look with Process Explorer or similar if you doubt system slowdown with it enabled......again, only for the uses I originally stated.

 

Free Endpoint Protection
Seo4Smf 2.0 © SmfMod.Com Smf Destek