Application Rule issue

First, just got your software and am digging it.

But I accidently said “deny” on one of those pop ups and now that program is blocked.

No, I’m not a total idiot, I went into the application monitor to look for where that decision would have been recorded but it’s not there. I checked the component monitor as well and it makes no mention of the program in question. I then looked at the network monitor and found that nothing had changed.

So effectively my issue is that I hit the deny button, the firewall is now blocking that program… but seems to have not made any entry into any of the rule sets that I can interact with…

How do I get comodo to remove this block?

The only thing I can think to do now is reinstall the firewall and then be very very very careful what I press in the future.

Instead of reinstalling the firewall, try exiting and re-enter. When it was blocked, even if the remember option wasn’t enabled, depending on certain conditions it may be like this until CFP is restarted.

no, I did press the remember button… I did it automatically…

It was a stupid mistake but I can’t believe the program won’t let me change the rules back. This is really frustrating.

Have you restarted the firewall?

Yes, I’ve restarted the firewall. So far as I can tell that didn’t change anything.

Shouldn’t the application I blocked be mentioned in the application control rules… because it isn’t. I deleted all references to it. Logically I would assume that the firewall should then ask me again when that program tries to access the internet. But it doesn’t… it just totally blocks it.

Is this a bug, the way the firewall normally works, or am I missing something?

Karmashock, you are right. It should be in the App Monitor. I’ve never seen reports of this being a bug. Hopefully someone else might know short of a reinstall or reboot.

the most annoying thing is that the program works fine if I turn “application control rules” off but won’t work… doesn’t matter if there is a rule in there explicitly allowing the program to do whatever it wants or nothing at all.

Its like being told you’ve done something illegal but no one knows what… and you’re still going to jail for it… bah!

Hmm…since you’ve narrowed it down to the Application Monitor module being the culprit, then it does seem like you need try a reinstall or reboot your system. If that still doesn’t work, it could be a bug unless someone else has other ideas.

found how to fix it… I had to turn the program that was trying to access the internet off.

It’s my email client so I never turn it off typically… I tried turning it off and when it reloaded FINALLY comodo asked if it should be able to access the internet.

Everything is fine now… but comodo shouldn’t do something unless there is a listed rule for it. Blocking an application that isn’t listed in it’s rule set is annoying.

Oh! Great. Now I know what you mean. Yes. This is actually by design to prevent malware and other things (I’m sure lots of other users can explain this better). If internet explorer was used as an example, I would’ve seen this from the start. Here’s a related e.g.: Let’s say x program tried to launch explorer. I don’t want this so I clicked deny. Then when I try to browse the internet, IE won’t work until it’s restarted. But what I don’t understand is how it didn’t appear in the App Monitor even though you clicked remember…

maybe I was wrong about that… I am pretty sure I did click remember… but then again perhaps I’m wrong.

What I don’t get is how/why comodo kept blocking it even after comodo had been restarted. It must have remembered to block it even though it was restarted… which I wouldn’t expect…

I asked a moderator a similar question for the Component Monitor and it’s believed to be kept in the computer’s memory. But I’m not sure if that’s the correct answer. One way to confirm that is to reboot your system.

Kept in ram AFTER the program terminates… and retrieved from ram when it is loaded again?

Perhaps I don’t know what I’m talking about and that’s common… but that sounds extremely strange to me.

When the firewall (cpf.exe) is exited, its driver (cmdagent.exe) is still running. It could be related to that. These are merely my guesses :smiley:

that sounds right… can that be terminated and restarted without having to reboot the whole computer?

cmdagent is tricky because it’s the core of the firewall (self-defense against malware and termination methods). I’ve read that someone was able to end it in Task Manager, but other than that there is no known method unless you set it to not start in automatic mode in the Windows Services. Doing so will basically be the equivalent of CFP not running at all.