BIG BUG: Firewall doens't filter ANY connection to internet!

Comodo Internet Security - CIS Firewall Help - CIS
1

v3.13 doesn’t filter any connection to the internet anymore!!!
Even I deinstalled completely and did a fresh install of v3.13 to be sure, every network adaptor is regognized.

I am using AVM WLAN N USB Stick / Windows 7 x64.

I set to “Own Rules” (I use a different language so I don’T know what it is called in english) and alarm settings to high.

Tested with 3.12 now and there exists the same problem.
Seems to be that comodo has a problem to work with the avm stick … PC Tools firewall works, but I will try comodo again maybe I can see something in adapter settings …

Example:

GuildWars Setup → Install isn’t detected by comodo:

http://www.guildwars.com/download

2

Do you have other security programs running in the background? Try disabling them and see if that helps. Try using this clean up tool after uninstalling CIS and rebooting. Then install CIS again.

Can you change the interface of CIS to English when doing the following?

What happens when you run Diagnostics (Miscellaneous)?

Can you show me screenshots of your Global Rules (Firewall → Advanced → Network Security Policy) and Firewall logs (Firewall → Common Tasks → View Firewall Alerts)?

3

Please check the following also:

Network and Sharing Center, Change Adapter Settings, Select the adapter in question, right mouse, Properties.

Now check if the Service “Comodo Internet Security Firewall Driver” is there, and if not try to install and point to the following .inf file c:\program files\comodo\comodo internet security\inspect.inf see if that is able to install the firewall service on the adapter, if it fails please post a screenshot of the error here.

4

I checked the Adapter Settings and that the “Comodo Internet Security Firewall Driver” was there and active, but it was and it only detects localhost activities, and Firewall Activity Viewer for active connections shows only a few processes and no firefox or something else.

Diagnostics found no problems.

And I used Comodo for a long time now and the only thing I changed was the WLAN USB Stick, had a Cisco Linksys WUSB600N v2 (RALINK) but this stick is not working correctly at all (I mean drivers and wakeup from standby etc, Comodo was working OK with it) so I changed it with an AVM Fritz WLAN N USB Stick and this one is working great, but Comodo wasn’t working anymore.

And so I deinstalled Comodo (which I updated from 3.0 to 3.1.2 … and finally 3.13 and it was working for long time) reinstalled with fresh 3.13, not working, de-installed and reinstalled 3.12, not working.

Now I used Windows own Firewall and set to block all and defined exeptions. This is working for now, until Comodo or something else will work OK for me again.

I used the cleanup tool, installed Comodo 3.13 and tested again.

Here are some Sysinfos.

Software I use:
Comodo Firewall 3.13 (No Defence++, no Antivir)
Comodo VPN
VMWare Server 2.02
GDATA AVK 2010 (no Firewall)

Infos to screenshots:

Device Manager View (with devmgr_show_nonpresent_devices=1) of Networkdevices BEFORE and AFTER Comdo Installation

  • FireFox browsing while Comodo sees no connections

http://www.imgbox.de/users/public/images/u15057v49.jpg

http://www.imgbox.de/users/public/images/h35263q49.jpg

http://www.imgbox.de/users/public/images/l53040r49.jpg

http://www.imgbox.de/users/public/images/j2260t49.jpg

http://www.imgbox.de/users/public/images/w49297k49.jpg

http://www.imgbox.de/users/public/images/j31763v49.jpg

http://www.imgbox.de/users/public/images/g4340h49.jpg

More Screenshots in attached zip-archive.

Netzwerkadapter || FRITZ!WLAN USB Stick N Top

FRITZ!WLAN USB Stick N
Device ID USB\VID_057C&PID_8401\001F3F…
Status 0x0180600a Started
Problem 0x00000000 (0)
Service fwlanusbn
Capabilities 0x00000094
Config Flags 0x00000000
Class Net
Manufacturer AVM Berlin
Hardware IDs USB\VID_057C&PID_8401&REV_0403
USB\VID_057C&PID_8401
Compatible IDs USB\Class_FF&SubClass_00&Prot_00
USB\Class_FF&SubClass_00
USB\Class_FF
Class GUID {4d36e972-e325-11ce-bfc1-08002be10318}
Location Port_#0002.Hub_#0008
Bus number 0x00000000
Enumerator name USB
Description FRITZ!WLAN USB Stick N
Driver {4d36e972-e325-11ce-bfc1-08002be10318}\0037
Physical Object Name \Device\USBPDO-8
Bustype GUID {45204342-2042-4437-2039-442035442043}
Legacy bus type 0x0000000f
Install State 0x00000000
Device Address 0x00000002

Netzwerkadapter || Marvell Yukon 88E8056 PCI-E-Gigabit-Ethernet-Controller - Virtual Machine Network Services Driver Top

Marvell Yukon 88E8056 PCI-E-Gigabit-Ethernet-Controller - Virtual Machine Network Services Driver
Device ID ROOT\CNTX_VPCNETS2_MP\0001
Status 0x4180200b Started
Problem 0x00000000 (0)
Service VPCNetS2
Capabilities 0x00000000
Config Flags 0x00000000
Class Net
Manufacturer Microsoft
Hardware IDs Cntx_VPCNetS2_MP
Class GUID {4d36e972-e325-11ce-bfc1-08002be10318}
Enumerator name ROOT
Description Virtual Machine Network Services Driver
Friendly name Marvell Yukon 88E8056 PCI-E-Gigabit-Ethernet-Controller - Virtual Machine Network Services Driver
Driver {4d36e972-e325-11ce-bfc1-08002be10318}\0017
Physical Object Name \Device\0000000b
Install State 0x00000000

Netzwerkadapter || Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller Top

Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller
Device ID PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_14\4&1B359D48&0&10F0
Status 0x01802400
Problem 0x00000016 (22) Disabled
Service yukonw7
Capabilities 0x00000000
Config Flags 0x00000001
Class Net
Manufacturer Marvell
Hardware IDs PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_14
PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043
PCI\VEN_11AB&DEV_4320&CC_020000
PCI\VEN_11AB&DEV_4320&CC_0200
Compatible IDs PCI\VEN_11AB&DEV_4320&REV_14
PCI\VEN_11AB&DEV_4320
PCI\VEN_11AB&CC_020000
PCI\VEN_11AB&CC_0200
PCI\VEN_11AB
PCI\CC_020000
PCI\CC_0200
Class GUID {4d36e972-e325-11ce-bfc1-08002be10318}
Location PCI-Bus 5, Gerät 2, Funktion 0
Bus number 0x00000005
Enumerator name PCI
Description Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller
Driver {4d36e972-e325-11ce-bfc1-08002be10318}\0007
Physical Object Name \Device\NTPNP_PCI0021
Bustype GUID {44203042-2046-4245-2043-382031302042}
Legacy bus type 0x00000005
Install State 0x00000000
Device Address 0x00020000

Motherboard
Manufacturer ASUSTeK Computer INC.
Model P5Q-E
Version Rev 1.xx

North Bridge Intel P45/P43/G45/G43 Revision A2
South Bridge Intel 82801JR (ICH10R) Revision A2

CPU Intel(R) Core™2 CPU 4300 [at] 1.80GHz
Cpu Socket Socket 775 LGA

System Slots 7 PCI

Memory Summary
Maximum Capacity 4096 MBytes
Maximum Memory Module Size 2048 MBytes
Memory Slots 4
Error Correction None

BIOS Vendor American Megatrends Inc.
BIOS Version 1406
BIOS Date 10/02/2008
BIOS Size 2048 KB
BIOS Starting Segment F000h
DMI Version 2.5

Number of CPU(s) One Physical Processor / 2 Cores / 2 Logical Processors / 64 bits
CPU Full Name Intel(R) Core™2 CPU 4300 [at] 1.80GHz
CPU Name Intel Core 2 Duo E4300
CPU Code Name Conroe
Platform Name Socket 775 LGA
Revision L2
Technology 65 nm
Instructions MMX, SSE, SSE2, SSE3, SSSE3, ET64, XD, EST
Original Clock 1800 MHz
Original System Clock 200 MHz
Original Multiplier 9.0
CPU Clock 2949 MHz
System Clock 327.7 MHz
FSB 1310.6 MHz
Core 0 Speed 1965.9 MHz
Core 0 Multiplier 6.0
Core 1 Speed 1965.9 MHz
Core 1 Multiplier 6.0
L1 Data Cache 2 x 32 KBytes
L1 Instructions Cache 2 x 32 KBytes
L2 Cache 2048 KBytes

[attachment deleted by admin]

5

Try disabling all other security and network related programs that run in the background.

We are gonna take a look to see if there are some old drivers of your previously uninstalled security programs are still around. Go to Device Manager → View → show hidden devices → now look under Non Plug and Play drivers → when you see a driver that belongs to your previous security programs click right → uninstall —> reboot your computer.

When the problem persists make sure there are no auto starts from your previous security programs. Download Autoruns and run it.

This program finds about all auto starts in Windows. This tool can therefore seriously damage Windows when not handled properly. After starting go to Options and choose to hide Windows and Microsoft entries, to include empty locations and then push F5 to refresh.

Now check all entries to see if there are references to your previous security program. When you find them untick them. After unticking reboot your computer and see what happens.

6

Same issue here.

How did you guys get the ‘active connections’ tab working with new 3.13?

As far I checked manually create rules to firewall the selection of ‘running processes’ doesn’t detect a single running app only shows the ‘Windows Operating System’ and that’s it.

???

-edit #01-

Seems only Traning mode & Disable allows internet no chance on Custom Mode + Very High. Connecting through basic Router direct connection.

O and system’s clean. No other security softwares installed I do use Autoruns no poo in system & I even reinstalled Comodo Firewall driver manually to see, if it’s same bug as some time ago on Firewall driver installation. Seems to have something to do with Running application detection or this stupid forced Defence+ feature.

-edit #02-

Hmm, there seems to also be after Windows Logon (straight after you’ve press enter on Windows Password) an 15-30 second lag like something would be jamming/freezing up. Might be an bad loading of something causing this. Happened only after v3.13.126709.581 update &/or clean installation.

-edit #03-

Same problem occures all v3.13 installations just tested every build ever made. Next gonna try the
Comodo Internet Security v3.12.111745.560 which I assume to be the last build of v3.12. (not downloading from comodo servers as someone clearly has ■■■■■■■ up some old builds there only giving me the latest inside the RAR/ZIP what ever idiotic packaging it’s on server anyway.

-edit #04-

Going backwards doesn’t seem to help. Did install every version since v3.11.108364.552. Now every single install/instance of installing or after uninstalling I cleanedup registry, drivers in device manager (with ‘set devmgr_show_nonpresent_devices=1’ > show hidden devices) & Autoruns checked drivers, services etc etc were correctly removed.

Now I most ask what else does comodo hide in system? (because earlier in same windows installation in exact same security updates COMODO did work.) Does comodo use rootkits in system to hide it’s actions or somekind of idiotic user based scheme? (Just wonder what I weill find when I start digging)

-edit #05 - Solutions…-

Well, seems the problem is in PCA and cert updates.

  1. Open gpedit.msc
  2. go to: Computer Configuration > Administrative Templates > Windows Components > Application Compatibility > make sure all on this section is disabled
  3. go to: Computer Configuration > Administrative Templates > System > Internet Communication management > make sure ‘Restrict Internet Communication’ is disabled or not setupped.
  4. Open Services.msc: make sure ‘Programk Compatibility Assistance service’ is ‘Automatic’ and running.
    NOTE: you might need reboot before continuing to step 5.
  5. Install Comodo as usual & Check ‘Always Trust’
  6. Reboot twice (Used first reboot to get rid of ridigulous Defence+).

After the install you may re-add all compatibility releated settings on Group Policy Manager & Internet restrictions.

Let me know if this worked on others. I am using Windows 7 x64 latest. Above is not available on ‘Home’ editions of system so on those I have absolutely no idea what might be the cause as those does not allow you to go to GPEDIT.

I also built small script for myself from someone elses source on net to work correctly on Windows x64 systems. As someone who builded the original ‘Comodo Cleaner’ doesn’t seem to understand system vars very well.

[at]echo off
title Comodo Internet Security File and Registry Cleaner
echo Welcome!
echo This is a batch file, created by Ragwing on the Comodo Forums, for removing
echo left-over files and registry entries. Thanks to USSS!
echo Before you continue, please make sure that:
echo * Comodo Internet Secyrity has been uninstalled (if possible)
echo * You have created a system restore point
echo * cmdagent.exe and cfp.exe aren't running
echo * You're logged in as an administrator

echo This batch file will now attempt to delete all left-over files and registry
echo entries created by Comodo Internet Security...
echo ******************************************
echo * This is genetix - x64 improved edition *
echo ******************************************
pause

[at]echo off
C:
cd "%appdata%\comodo\"
IF EXIST "Firewall Pro" RMDIR /S /Q "Firewall Pro"
IF EXIST "common" RMDIR /S /Q "common"

cd "%PUBLIC%\Desktop\"
IF EXIST "COMODO Firewall Pro.lnk" DEL "COMODO Firewall Pro.lnk"
IF EXIST "COMODO Internet Security.lnk" DEL "COMODO Internet Security.lnk"
cd "%HOMEPATH%\Desktop\"
IF EXIST "COMODO Firewall Pro.lnk" DEL "COMODO Firewall Pro.lnk"
IF EXIST "COMODO Internet Security.lnk" DEL "COMODO Internet Security.lnk"

cd "%PUBLIC%\Desktop\"
cd "%HOMEPATH%\Desktop\"
IF EXIST "COMODO Firewall Pro.lnk" DEL "COMODO Firewall Pro.lnk"
IF EXIST "COMODO Internet Security.lnk" DEL "COMODO Internet Security.lnk"


cd "%APPDATA%\Comodo\"
IF EXIST "Firewall Pro" RMDIR /S /Q "Firewall Pro"
IF EXIST "UserThemes" RMDIR /S /Q "UserThemes"

cd "%LOCALAPPDATA%\Comodo\"
IF EXIST "ComodoFireWall" RMDIR /S /Q "ComodoFireWall"

cd "%programfiles%"
IF EXIST "Comodo" RMDIR /S /Q "Comodo"
cd "%programfiles(x86)%"
IF EXIST "Comodo" RMDIR /S /Q "Comodo"

cd "%windir%\system32\"

IF EXIST "guard32.dll" DEL "guard32.dll"
IF EXIST "cssdll32.dll" DEL "cssdll32.dll"
IF EXIST "guard64.dll" DEL "guard64.dll"
IF EXIST "cssdll64.dll" DEL "cssdll64.dll"

cd "%windir%\system32\drivers\"
IF EXIST "cmdGuard.sys" DEL "cmdGuard.sys"
IF EXIST "cmdhlp.sys" DEL "cmdhlp.sys"
IF EXIST "inspect.sys" DEL "inspect.sys"

cd "%programfiles%\"
IF EXIST "AskSBar" RMDIR /S /Q "AskSBarDis"
IF EXIST "AskSearch" RMDIR /S /Q "AskSearch"
cd "%programfiles(x86)%\"
IF EXIST "AskSBar" RMDIR /S /Q "AskSBarDis"
IF EXIST "AskSearch" RMDIR /S /Q "AskSearch"

cd "%programfiles%\Mozilla Firefox\components"
IF EXIST "AskSearch.js" DEL "AskSearch.js"

cd "%APPDATA%\Mozilla\Extensions"
IF EXIST "{E9A1DEE0-C623-4439-8932-001E7D17607D}" DEL "{E9A1DEE0-C623-4439-8932-001E7D17607D}"

REG DELETE "HKCU\Software\CFP" /F
REG DELETE "HKCU\Software\ComodoGroup\CFP" /F
REG DELETE "HKCU\Software\ComodoGroup\CFPSkin" /F
REG DELETE "HKCU\Software\ComodoGroup\COMODO Internet Security" /F
REG DELETE "HKCU\Software\ComodoGroup" /F
REG DELETE "HKCU\Software\AppDataLow\AskBarDis" /F
REG DELETE "HKCU\Software\AskBarDis" /F
REG DELETE "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}" /F
REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\COMODO" /F
REG DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\COMODO" /F
REG DELETE "HKCU\Software\Local AppWizard-Generated Applications\HKCU\Software\Local AppWizard-Generated Applications\CFPLog" /F
REG DELETE "HKCU\Software\Local AppWizard-Generated Applications\CPFFileSubmission" /F
REG DELETE "HKLM\SYSTEM\Software\Comodo\Firewall Pro" /F
REG DELETE "HKLM\SYSTEM\Software\Comodo\SafeSurf" /F
REG DELETE "HKLM\SYSTEM\Software\SafeSurf" /F
REG DELETE "HKLM\SOFTWARE\ComodoGroup\CDI\1" /F
REG DELETE "HKLM\SOFTWARE\ComodoGroup\CDI\13" /F
REG DELETE "HKLM\SYSTEM\ControlSet001\Services\cmdAgent" /F
REG DELETE "HKLM\SYSTEM\ControlSet001\Services\cmdGuard" /F
REG DELETE "HKLM\SYSTEM\ControlSet001\Services\cmdHlp" /F
REG DELETE "HKLM\SYSTEM\ControlSet001\Services\Inspect" /F
REG DELETE "HKLM\SYSTEM\ControlSet002\Services\cmdAgent" /F
REG DELETE "HKLM\SYSTEM\ControlSet002\Services\cmdGuard" /F
REG DELETE "HKLM\SYSTEM\ControlSet002\Services\cmdHlp" /F
REG DELETE "HKLM\SYSTEM\ControlSet002\Services\Inspect" /F
REG DELETE "HKLM\SYSTEM\ControlSet003\Services\cmdAgent" /F
REG DELETE "HKLM\SYSTEM\ControlSet003\Services\cmdGuard" /F
REG DELETE "HKLM\SYSTEM\ControlSet003\Services\cmdHlp" /F
REG DELETE "HKLM\SYSTEM\ControlSet003\Services\Inspect" /F
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\cmdAgent" /F
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\cmdGuard" /F
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\cmdHlp" /F
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\Inspect" /F
REG DELETE "HKLM\SYSTEM\Software\Comodo\Firewall Pro" /F
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDGUARD" /F
REG DELETE "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_INSPECT" /F
REG DELETE "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDGUARD" /F
REG DELETE "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_INSPECT" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\COMODO Firewall Pro" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\COMODO Firewall Pro" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\COMODO SafeSurf" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AskSBar Uninstall" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ask Toolbar_is1" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\COMODO Internet Security" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\COMDOO SafeSurf" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Help Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Help Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskSBar.SettingsPlugin" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskSBar.SettingsPlugin.1" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskSBar.ToolbarPlugin" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskSBar.ToolbarPlugin.1" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterBarButton" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterBarButton\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterBarButton\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterBarButton.1" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterBarButton.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterSettingsControl" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterSettingsControl\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterSettingsControl\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterSettingsControl.1" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskIBar.PopSwatterSettingsControl.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskToolBar.SettingsPlugin" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskToolBar.SettingsPlugin\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskToolBar.SettingsPlugin\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskToolBar.SettingsPlugin.1" /F
REG DELETE "HKLM\SOFTWARE\Classes\AskToolBar.SettingsPlugin.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu.1" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu.1" /F
REG DELETE "HKLM\SOFTWARE\Classes\CavShell.CntMenu.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Comodo Antivirus" /F
REG DELETE "HKLM\SOFTWARE\Classes\AppID\CavShell.DLL" /F
REG DELETE "HKLM\SOFTWARE\Classes\AppID\{E11C8519-5595-4397-B515-AB036DEC467A}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{B15FD82E-85BC-430d-90CB-65DB1B030510}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{F0D4B238-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{528B5866-2BA6-42ce-8F74-39FB23B49767}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{571715D7-3395-4DF0-B43C-784836209E60}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{710DF252-2566-41d3-BAF9-CEFA5840BFD2}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{B004FD67-F058-49e6-96DA-99237A82133C}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{C94E154B-1459-4A47-966B-4B843BEFC7DB}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{D6267144-4B06-402a-808D-52D498387079}" /F
REG DELETE "HKLM\SOFTWARE\Classes\CLSID\{EC1D2C70-8CDE-4013-BE72-2B08A2C54B6B}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\ComodoGroup\CDI\1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\ComodoGroup\CDI\13" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\COMODO Firewall Pro" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Management\ARPCache\COMODO Firewall Pro" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\COMODO SafeSurf" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AskSBar Uninstall" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Ask Toolbar_is1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\COMODO Internet Security" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\COMDOO SafeSurf" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Help Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Help Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskSBar.SettingsPlugin" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskSBar.SettingsPlugin.1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskSBar.ToolbarPlugin" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskSBar.ToolbarPlugin.1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterBarButton" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterBarButton\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterBarButton\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterBarButton.1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterBarButton.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterSettingsControl" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterSettingsControl\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterSettingsControl\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterSettingsControl.1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskIBar.PopSwatterSettingsControl.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskToolBar.SettingsPlugin" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskToolBar.SettingsPlugin\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskToolBar.SettingsPlugin\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskToolBar.SettingsPlugin.1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AskToolBar.SettingsPlugin.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu.1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu\CurVer" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu.1" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CavShell.CntMenu.1\CLSID" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\*\shellex\ContextMenuHandlers\Comodo Antivirus" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AppID\CavShell.DLL" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\AppID\{E11C8519-5595-4397-B515-AB036DEC467A}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B15FD82E-85BC-430d-90CB-65DB1B030510}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F0D4B238-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{528B5866-2BA6-42ce-8F74-39FB23B49767}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{571715D7-3395-4DF0-B43C-784836209E60}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{710DF252-2566-41d3-BAF9-CEFA5840BFD2}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B004FD67-F058-49e6-96DA-99237A82133C}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C94E154B-1459-4A47-966B-4B843BEFC7DB}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D6267144-4B06-402a-808D-52D498387079}" /F
REG DELETE "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EC1D2C70-8CDE-4013-BE72-2B08A2C54B6B}" /F
REG DELETE "HKCR\AskSBar.SettingsPlugin" /F
REG DELETE "HKCR\AskSBar.SettingsPlugin.1" /F
REG DELETE "HKCR\AskSBar.ToolbarPlugin" /F
REG DELETE "HKCR\AskSBar.ToolbarPlugin.1" /F
REG DELETE "HKCR\AskIBar.PopSwatterBarButton" /F
REG DELETE "HKCR\AskIBar.PopSwatterBarButton\CLSID" /F
REG DELETE "HKCR\AskIBar.PopSwatterBarButton\CurVer" /F
REG DELETE "HKCR\AskIBar.PopSwatterBarButton.1" /F
REG DELETE "HKCR\AskIBar.PopSwatterBarButton.1\CLSID" /F
REG DELETE "HKCR\AskIBar.PopSwatterSettingsControl" /F
REG DELETE "HKCR\AskIBar.PopSwatterSettingsControl\CLSID" /F
REG DELETE "HKCR\AskIBar.PopSwatterSettingsControl\CurVer" /F
REG DELETE "HKCR\AskIBar.PopSwatterSettingsControl.1" /F
REG DELETE "HKCR\AskIBar.PopSwatterSettingsControl.1\CLSID" /F
REG DELETE "HKCR\AskToolBar.SettingsPlugin" /F
REG DELETE "HKCR\AskToolBar.SettingsPlugin\CLSID" /F
REG DELETE "HKCR\AskToolBar.SettingsPlugin\CurVer" /F
REG DELETE "HKCR\AskToolBar.SettingsPlugin.1" /F
REG DELETE "HKCR\AskToolBar.SettingsPlugin.1\CLSID" /F
REG DELETE "HKCR\*\shellex\ContextMenuHandlers\Comodo Antivirus" /F
REG DELETE "HKCR\AppID\CavShell.DLL" /F
REG DELETE "HKCR\AppID\{E11C8519-5595-4397-B515-AB036DEC467A}" /F
REG DELETE "HKCR\CLSID\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}" /F
REG DELETE "HKCR\CLSID\{B15FD82E-85BC-430d-90CB-65DB1B030510}" /F
REG DELETE "HKCR\CLSID\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKCR\CLSID\{F0D4B238-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKCR\CLSID\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}" /F
REG DELETE "HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}" /F
REG DELETE "HKCR\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2}" /F
REG DELETE "HKCR\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E}" /F
REG DELETE "HKCR\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}" /F
REG DELETE "HKCR\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}" /F
REG DELETE "HKCR\CLSID\{4255A182-CAD9-4214-A19B-7BA7FB633BBD}" /F
REG DELETE "HKCR\CLSID\{528B5866-2BA6-42ce-8F74-39FB23B49767}" /F
REG DELETE "HKCR\CLSID\{571715D7-3395-4DF0-B43C-784836209E60}" /F
REG DELETE "HKCR\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}" /F
REG DELETE "HKCR\CLSID\{710DF252-2566-41d3-BAF9-CEFA5840BFD2}" /F
REG DELETE "HKCR\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}" /F
REG DELETE "HKCR\CLSID\{B004FD67-F058-49e6-96DA-99237A82133C}" /F
REG DELETE "HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}" /F
REG DELETE "HKCR\CLSID\{C94E154B-1459-4A47-966B-4B843BEFC7DB}" /F
REG DELETE "HKCR\CLSID\{D6267144-4B06-402a-808D-52D498387079}" /F
REG DELETE "HKCR\CLSID\{EC1D2C70-8CDE-4013-BE72-2B08A2C54B6B}" /F
REG DELETE "HKCR\Drive\shellex\ContextMenuHandlers\Comodo Antivirus" /F
REG DELETE "HKCR\file\shellex\ContextMenuHandlers\Comodo Antivirus" /F
REG DELETE "HKCR\Folder\shellex\ContextMenuHandlers\Comodo Antivirus" /F
REG DELETE "HKU\S-1-5-21-1417001333-329068152-839522115-1003\Software\CFP" /F
REG DELETE "HKU\S-1-5-21-1960408961-839522115-1957994488-500\Software\AppDataLow\AskBarDis" /F
REG DELETE "HKU\S-1-5-21-1960408961-839522115-1957994488-500\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}" /F

> %TEMP%.\REGISTRY.REG ECHO REGEDIT4
>>%TEMP%.\REGISTRY.REG ECHO.
>>%TEMP%.\REGISTRY.REG ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
>>%TEMP%.\REGISTRY.REG ECHO "COMODO SafeSurf"=-
>>%TEMP%.\REGISTRY.REG ECHO.
>>%TEMP%.\REGISTRY.REG ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
>>%TEMP%.\REGISTRY.REG ECHO "COMODO Firewall Pro"=-
>>%TEMP%.\REGISTRY.REG ECHO.
>>%TEMP%.\REGISTRY.REG ECHO [HKEY_LOCAL MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
>>%TEMP%.\REGISTRY.REG ECHO "Comodo Firewall Pro"=-
>>%TEMP%.\REGISTRY.REG ECHO.
>>%TEMP%.\REGISTRY.REG ECHO [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
>>%TEMP%.\REGISTRY.REG ECHO "{CF739809-1C6C-47C0-85B9-569DBB141420}"=-
>>%TEMP%.\REGISTRY.REG ECHO.
>>%TEMP%.\REGISTRY.REG ECHO [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
>>%TEMP%.\REGISTRY.REG ECHO "http://www.comodo.com/search/"="about:blank"
>>%TEMP%.\REGISTRY.REG ECHO.
>>%TEMP%.\REGISTRY.REG ECHO [HKEY_USERS\S-1-5-21-1960408961-839522115-1957994488-500\Software\Microsoft\Internet Explorer\Main]
>>%TEMP%.\REGISTRY.REG ECHO "http://www.comodo.com/search/"="about:blank"
>>%TEMP%.\REGISTRY.REG ECHO.
START /WAIT REGEDIT /S "%TEMP%.\REGISTRY.REG"
cd "%TEMP%"
del "REGISTRY.REG"

sc delete cmdAgent

NET STOP WINMGMT /Y

cd "%windir%\system32\wbem\"
RMDIR /S /Q "Repository"
cd "%windir%\sysWOW64\wbem\"
RMDIR /S /Q "Repository"

NET START WINMGMT /Y
netsh winsock reset all
netsh int reset all

echo All remains of Comodo Internet Security should now be gone!

pause

EXIT

Ideally if you use that and you have installs of Comodo elsewhere than ‘program files’ switch these 2 lines and it’s ok:

cd "%programfiles%\Comodo\"
cd "%programfiles(x86)%\Comodo\"

general purpose would be to copy the script to .cmd file run this after comodo uninstall and then reboot to take effect. Also:

netsh int reset all

^ this line is ment for Vista only, but well doesn’t do any harm on Win7 enviroment, but in case you got some personal routing you might wanna remove both winsock & interface resets from the script.

O and just in case someone says it looks ■■■■■■. I wanna add it’s not my doings I just correlated the x64 part to it it indeed looks ■■■■■■, but works.

7

Hi,I am Rick ■■■■ of Comodo.

The problem seems a firewall bug, I tried to reproduce the issue, but now I don’t have the

related hardware(usb stick), so I can’t debug and find out essential reason, I added some

code to capture log about net connection changes, please download from attached and

test it based on readme.txt, if you have any question, please tell me ASAP, at the same time, we will

continue to research for fixing this issue.

[attachment deleted by admin]

8

Hi, how r u?
I notice that meshell is using VPN, it reminds me another big BUG about using VPN, they maybe not related, but the results are the same. This BUG has been posted more than once, as a comodo staff member, can you tell me when it will be fixed?
https://forums.comodo.com/firewall-bugs/firewalll-is-not-monitoring-after-diconnecting-vpn-t46078.0.html
https://forums.comodo.com/firewall-bugs/big-problem-using-vpn-t48410.0.html

9

Hi!
Today I wanted to take the time to try your “cmdhlp.sys”.
I downloaded Comodo (3.14) and wow, it was working for me :-TU
So whatever was fixed, it fixed my problems, too :slight_smile:
Now I will read the changelog.

10

I have same problem. Comodo does not detect my mobile broadband connection correctly. When I connect, CIS asks name of private (!) network. It shows IP as 169.xxx.xxx.xxx. Windows shows IP as 86.xx.xx.xx. Clearly there is a problem detecting network correctly. Then CIS is not able to control inbound/outbound connections to my mobile broadband. Only local connections are filtered.

This is a problem of most free firewalls and some paid versions. I have tried tallemu, outpost, zonealarm. None of them was able to detect network correctly and filter connections in my windows 7 machine. Only norton internet security was successfull!
Next i wil try fsecure trial version.

Edit by EricJH: converted all caps second paragraph to normal case

[attachment deleted by admin]

11

Please provide as much details about your Mobile Adapter as you can other wise dev’s won’t be able to test.

Make, Model, OEM supplier, Driver version(s) and also Your current OS version/language 32 or 64 bit and any other security software installed no matter real-time or on-demand…

12

Sorry, forgot that:

Laptop: Thinkpad T500, W7 32bit, model 2082BQG with integrated Bluetooth, WIFI, LAN etc…, 4GB memory
Mobile Broadband: Ericsson F3507g, integrated version 1.0.0.52, Connection is 384 kbit 3G.
Other security software: Avast free antivirus 5.0, Lavasoft adware (not running, but installed, service stopped)

I also attached output of Microsoft internet connection evaluation test.

[attachment deleted by admin]

13

Can you also provide the exact version of CIS you are using?

And if dev’s would like to do a remote debug session on your system to fix the issue are you willing to support them with it?

14

CIS 3.14 latest (released few weeks ago). I may help, if I just have time when devs can do that?

15

Can you follow the instruction from RickWang here and see what turns up?

https://forums.comodo.com/firewall-bugs/big-bug-firewall-doenst-filter-any-connection-to-internet-t49033.0.html;msg356467#msg356467

16

I did what you asked, but debug version of cmdhlp.sys did not seem to anything. My Active connection windows was empty. Not even local cnnection were listed there. Just empty. I took backup copy of original file and restarted system. Now Active Connections shows local connection. Something wrong with debug version of cmdhlp.sys . It did not produce .sys file to c:!! ???

What to do?

17

Wait till Rick returns, i guess that cmdhlp.sys is from a previous version…
I’ll drop him a notification if he can assist here.

18

I noticed something about behaviour of W7: When connecting my mobile broadband, W7 opens connections, sets IP to 169.xxx.xxx.xxx for very short period time (1 sec or less), then sets IP to correct one. Is it because of delay DHCP server, i do not know. That is one option.

I mean I suspect that when connecting, W7 does not get IP from DHCP before it notifies system about new connection. If W7 notifies that new connection is available before it gets IP, then firewalls may receive wrong IP. Somehow W7 own firewall works better in this matter.

Is there any sense what I wrote here?

19

169.254 is APIPA automatic assignment of IP in case DHCP is to slow or not available etc…

Once you have connection can you see those connections in the “View active connections” monitor on the GUI, Firewall menu?

And also if you put a global block rule on incoming traffic does it block all traffic after you are connected.
(Block IP in any any any + log) make it the top rule so it matches first

Are there other network interfaces active during this G3 connection for instance Wifi or cabled LAN?

20

Answer to all questions is NO. No active connection listed, Global Block rule has no effect, No other interface enabled or active.