Maybe I’m just running across bugs and not knowing it, but I’m running the latest CIS (3.8.64263.468) on vista ultimate 64bit sp1 and seeing some weird stuff that makes the antivirus module seem not ready.
I have the antivirus realtime option enabled, but the quarantine checkbox unchecked. Comodo seems to be mysteriously quarantining detected items anyway, but not listing them in the quarantine. So what you end up with is random files on disk that are no longer accessible (permission denied). There’s a running detection history log, but that’s it. There’s no list of files that are actively being quarantined when in fact, comodo is doing just that. Turning off comodo av makes those files accessible again.
I was all excited about this release and was about to tell all my friends to start using it. Maybe it really was released too early.
Am I missing something?
Thanks.
Please report this in the Antivirus bug reports forum
https://forums.comodo.com/anti_virus_bugs-b150.0/
Have you tried a clean uninstall and reinstall? I recommend Revo Uninstaller:
Have you looked in your Defense+ list of files you may have blocked?
It’s not D+, because I can disable the av module and then I immediately have access to the files that were strangely quarantined. They don’t show up as blacklisted by D+ either.
Also, I’ve never previously installed the AV module before. I completely uninstalled the older version of comodo before installing this one.
OK, I’ll file a bug report.
Thanks for the help guys.
Could be you are running in to some sharing violations i have also seen this on the x32 version.
Are you perhaps running a manual scan on the “locked” files ?
Could it be that you have “Show alerts/notification messages” unchecked?
Nope, it’s checked. Thanks for the suggestion though.
If I enable comodo av, then it now re-detects the suspect files and asks what it should do.
This all started when I came home from work and found that comodo had detected a few things, but didn’t quarantine (per my configuration) but left them in some weird state where they seemed to be quarantined, but never listed in quarantine. Maybe a timeout bug in the AV dialog box? (They are FP’s by the way. I have heuristics cranked on high. )
Either that, or there was some odd sharing violation issue as Ronny suggests. I believe I did have SAS Pro realtime protections turned on. But I played around with that a bit, disabling SAS Pro realtime and had trouble accessing some files only until I disabled comodo AV. But that could be related.
How exactly can I determine if I’m observing a sharing violation? There’s nothing obvious in the event viewer that uses the term “sharing”.
I had some sharing violations that i tested as following:
Make a manual scan from folder X, start a scan on that folder and try to rename a file that is not scanned at that moment, it won’t let you, windows will complain it’s in use.
Open a word document and try to save it, it will complain about a sharing violation.