3.0.25.378 Incorrectly Identifies Applications, Resulting in Wrong Rules [Merged]

Did you try to remove the rules Firewall/D+ for the connect.exe and see what happens after a reboot ?
What kind of application is this, because it looks like some kind of intercepting proxy to sit between you browser/email and the outgoing connection ?! like a virus scanner would do, that way it’s just normal behavior to use the process and build the firewall rules based on the app making the call to the socket. if you do a telnet to a web server does it also prompt for connect.exe to connect to that site ? [cmd, telnet www.website.com 80] you should get a blinking cursor on the left top.

Yes, i removed the rules for connect.exe but CF start asking me again for the wrong application. But dont forget, CF dont ask me everytime for this application when i use a application that have defined rules. I dont know what CF makes confused to ask me sometimes for the wrong app…

What kind of application is this, ...

A tool of my router to reconnect the internet connection.

[cmd, telnet www.website.com 80]

CF ask me for a outgoing connection of telnet

That’s absolutely true, see also:

https://forums.comodo.com/

There is something wrong sometimes (can’t reproduce it…) with the recognition of the started program.

But the connect.exe sounded suspicious to me, being known to be used by malware and located in \program files\

You are not alone…

https://forums.comodo.com/

Maybe a mod can merge these ?

yes.

One minute ago i started “MS Internet Hearts” (have rules defined) and CF tell me that the app “avast.setup” want connect to the internet. After closing and restarting Hearts many times everything works correct and CF dont ask for the wrong application…nice bug :frowning:

Same problem here… occasionally I start Emule or utorrent and CFP identifies the process as “updater.exe” from my Avira AV Suite.

Any news from the developers about this bug? It still randomly occurs on both my machines about 1x or 2x a day. I don’t want to try another firewall, as I’ve really got used to Comodo.

Thanks,

Habanero

Well, i belive this happens because comodo don’t use hash values to associated the exe with the policy. I had a post in the feedback forum about that (in little bit different light thou). Let hope the developers get it that just using a filepath do associated exe to policy is not enough.

GPNX!! I bet you haven’t read any of this thread, just like you don’t read the help other members are trying to give you!.

Read read read read read

He is! He is! He is! He is! He is!

Please remember, forums members are allowed to express their opinion, even where it is opposed to the consensus. All software can be made better and the process of improvement starts with evaluation and examination.

Just because someone doesn’t see your viewpoint, doesn’t make them wrong. Doesn’t make them right, either. :wink:

Ewen :slight_smile:

Hello Ewen! He has a similar topic which other members and my self are trying to explain to him. That’s what i was referring too

I was posed here because i thought these issues maybe related.

I was trying to help you guys improve COMODO because i like it (it reminds me of Tiny Firewall which is the BEST firewall. period). If there is tiny firewall for vista i would not bother you with my sugestions , but there is none… :frowning: I would suggest the comodo develdopers to take a look at how the tiny firewall 6.xx.xx works (they have multiple hash per exe, you can assign multiple group of policies to exe, etc…)

As i pointed in the other threads, you NEED/HAVE TO make sure (via hash, crc or w/e) that the executable that uses a given policy (firewall, defence,…) is the one that the policy was made for. I pointed couple of examples (and the simplest one is the install mode, the other are diff kind of bugs, leaks, usage scenarios, driver installs etc…) in which this simple “file path” executable->policy assosiation of yours can be a point of weakness because you really only on the “defense file modification rules and the user response” to keep the exe->rule policy integrity intact.

The security products are used mostly by user who don’t know or don’t want to bother with too much security details. For example (in case comodo is not in install mode), you may say the comodo notified you for some exe accessing explorer/driver/etc… AS I USER THIS MEANS NOTHING FOR ME. It would been more meangfull if i see (after i install something for example) that i get a message from comodo saying: THE EXECUTABLE IEXPLORER/FIREFOX got modified… do you want it to PROCEED as BEFORE? Now, currently comodo can’t do that because you really on simple file path to associated exe → policy. Thats why i suggested hash, etc and got nearly “flamed” by the “patrons”.
thanks

As i pointed in the other threads, you NEED/HAVE TO make sure (via hash...) that the executable that uses a given policy is the one that the policy was made for.

Full Ack!

I can’t believe that cpf don’t use any hash values to identify a application. Before i come to CPF i used Tiny Firewall and later Sygate PF. Both are really good and fast but too old for new windows versions. i hope some developer read this thread and make the necessary changes…

If that bug gets fixed I will buy it! Promise :slight_smile:

However this error makes the FW completely unreliable. Is there are safe Workaround for it at the moment?

If that bug gets fixed...

Forget it, they dont care about this bug. The last posts are months ago and no statement from the developers. Nice company policy…

Is there are safe Workaround for it at the moment?

just uninstall comodo and use a other firewall software…

Guys,

This bug is related to Avast email scanning and CFP conflicting with each other. It is already being investigated.

I’m sorry Egemen, but i’m no longer running Avast since i have installed CIS Beta1.
Complete uninstall, nothing left (maybe some hidden stuff in the registry but no drivers/services etc).
And i still have this problem once in a while.

Then there is something else conflicting. Can you please give me a screenshots of all the loaded drivers in your system? Also a screesnshot of all of the processes?
Proces Explorer can be used for this.

Thx

I’ve send you the details, please let me know if you need more details.