behavior blocker shows alert in spite of checked "trust this application"

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
#1

hi,
everytime i start that application the behavior blocker shows an alert and everytime i check “trust this application” and i choose “run unlimited”. the next time i start that application again the same story…
i tried to add the file to trusted files but it doesn’t help. ??? 88)

update: ok… i finally found it. i added it under advanced settings/security settings/defence +/behavior blocker/exeptions
well hidden and not user friendly at all. then again a alert window showed up the next time. there i confirmed that the application is ok. now it seems not to bother me anymore. why i have to state so many times that the app is trusted? 88) ???

#2

I had the same problem with a program. I would open it, click “Don’t isolate next time”…close the program, re-open it and the program would be sand boxed again.

#3

and how did you fix it?

#4

Can you describe your problem in more detail? What program is causing what alert? What version of CIS are you using? Does the program create new siblings each time it starts? And other details you think may be helpful.

#5

I have the same problem on windows 7 Sp1 with a fresh install of comodo anti virus.
The program is SAP Business One client and it does have a sibling process.
I can see the files in the trusted files list but that does not help.
The only way I could avoid this is by adding it to the exceptions - seems wrong to me.
Anyway the Behavior watch seems buggy to me.

#6

One more thing that might help - the windows 7 is in Hebrew GUI and I had just another program giving me the same problem so its not just the SAP program.

#7

Does SAP business create siblings? In that case give SAP the Installer/Updater policy in Active HIPS rules. That way those created sisblings will get started without alerting the user.

#8

Yes SAP process creates a sibling but:

[ol]- HIPS is not enabled at all on these machines

  • On another machine it works well (Windows 7 SP1 English) and I get a popup for the main process and the sibling only once. Then they are added to the trusted list and everything works.
  • On 2 other machines (windows 7 SP1 Hebrew) I get problems for SAP and other process that do not have siblings. It seems that on these machines the list of trusted files are not read well or ignored.
  • the only way to get around this was to add the folders to the exception list[/ol]
#9

Ahhhhhhhhhhh - I take it back now it began to pop up on the single machine it was working fine.
I’m begining to really dislike this feature.
Itamar

#10

When dealing with a lot of sibling processes enabling the HIPS and using the Installer/Updater policy can be helpful; you won’t have to click as much.

- On 2 other machines (windows 7 SP1 Hebrew) I get problems for SAP and other process that do not have siblings. It seems that on these machines the list of trusted files are not read well or ignored. - the only way to get around this was to add the folders to the exception list
Can you check whether the digital signatures of these executables are intact and whether they are on the Trusted Vendor List?[/ol]
#11

How do I check digital signatures of an executable?

#12

Look up the file, select it and right click. Then choose the Signatures tab and see if it is OK.

#13

The signature tab does not exist for this file.
Does this mean that comodo can’t handle it properly?

#14

I forgot to tell that you need to look up the file with Explorer to be able to check a signature if present.

Does this mean that comodo can't handle it properly?
When a file is not on the white list you can always add it to Trusted Files yourself when know it to be trustworthy.

It is also possible to ask Comodo to add executables to the white list in Submit Applications Here To Be Whitelisted - 2014. In this topic you can also ask to get a publisher added to the Trusted Vendor List.