Can't disable auto-containment on Trusted applications

[CISfan]

@CinderBH post:20

I picked the “I’m going to reinstall” option, though some settings did switch back to default. But I only changed things like the theme, or switching off firewall animations and sound notifications.

My gut feeling is that your CIS registry config settings might be damaged or corrupt.
If I were you I would fully uninstall and install CIS again the recommended way.
That is:

1. Uninstall CIS via Windows Remove Programs.
2. Next and importantly run CIS cleanuptool to remove any remnants of previous CIS installation including any config settings in the registry.
3. Finally install CIS again and use a new fresh config setting (no import of older config setting as it may also be corrupt).

[CinderBH]

@CISfan post:21

My gut feeling is that your CIS registry config settings might be damaged or corrupt.
If I were you I would fully uninstall and install CIS again the recommended way.
That is:

1. Uninstall CIS via Windows Remove Programs.
2. Next and importantly run CIS cleanuptool to remove any remnants of previous CIS installation including any config settings in the registry.
3. Finally install CIS again and use a new fresh config setting (no import of older config setting as it may also be corrupt).

sighs That’s the third time already, is there no other way…?

[CISfan]

@CinderBH post:22

sighs That’s the third time already, is there no other way…?

I understand the sigh, unfortunately the number of possible root causes is shrinking.
Maybe devs or mods can assist or help you resolving the issue in another way.

[CinderBH]

@CISfan post:23

I understand the sigh, unfortunately the number of possible root causes is shrinking.
Maybe devs or mods can assist or help you resolving the issue in another way.

I guess I’ll just wait until then, it’s not time-sensitive.

[C.O.M.O.D.O_RT]

@CinderBH post:1

As the title says. For example, I’m using a video editor, and Container asked me to allow a script run by it, but now whenever I try to save the output the file keeps winding up in VTRoot instead of where I want it to. The application isn’t blocked or anything either.
Any way I can make it stop doing that short of disabling Auto-Containment entirely?

Hi CinderBH,

Thank you for reporting.
May i know your:

1. CIS version ?
2. Win version along with system bit type ?
3. Video editor name and version and download link ?
4. Is there anyother security product installed on your machine ?
5. If possible, any related screenshots.
6. What are the modules enabled in CIS ?

Thanks
C.O.M.O.D.O RT

[CinderBH]

@C.O.M.O.D.O RT post:25

Hi CinderBH,

Thank you for reporting.
May i know your:

1. CIS version ?
2. Win version along with system bit type ?
3. Video editor name and version and download link ?
4. Is there anyother security product installed on your machine ?
5. If possible, any related screenshots.
6. What are the modules enabled in CIS ?

Thanks
C.O.M.O.D.O RT

1: Version 12.2.4.8032
2: Win 10 Home 64 bit
3: Shotcut version 22.06.23 Shotcut - Download
4: Just MalwareBytes, but I don’t have it running and only use it as a “second opinion” scanner
5: Nothing I haven’t already shared here
6: If you mean other CIS features, I think it’s just the basic CIS with Secure DNS enabled

[DecimaTech]

Really need to see the containment log as that will show what is being contained and why, also what containment alert did you get and how did you answer it? All you needed to do was choose don’t isolate again assuming its the same script that is getting auto-contained. FInally you can try switiching to a different config like the proactive configuration.

[CinderBH]

@futuretech post:27

Really need to see the containment log as that will show what is being contained and why, also what containment alert did you get and how did you answer it? All you needed to do was choose don’t isolate again assuming its the same script that is getting auto-contained. FInally you can try switiching to a different config like the proactive configuration.

I manually added everything involved as Trusted, so not sure what else I could do. But here’s the log if you want to look.

[CISfan]

Is that melt.exe thing also trusted and not running contained?

[CinderBH]

@CISfan post:29

Is that melt.exe thing also trusted and not running contained?

That’s Shotcut’s background video exporter. Yes, I manually added it as Trusted, and yet it still gets auto-contained.

[CinderBH]

Yeah, I can confirm that auto-contained applications (the ones surrounded by a green frame) aren’t added to the “Unblock” list. So, what now?

[CISfan]

Import one of the new fresh config files (which were created by CIS during install time) found in the directory given below and see if that resolves the issue. (Do not export to, save to or overwrite the config files in this directory.)

C:\Program Files\COMODO\COMODO Internet Security\

COMODO - Firewall Security.cfgx
COMODO - Internet Security.cfgx
COMODO - Proactive Security.cfgx

[CinderBH]

@CISfan post:32

Import one of the new fresh config files (which were created by CIS during install time) found in the directory given below and see if that resolves the issue. (Do not export to, save to or overwrite the config files in this directory.)

C:\Program Files\COMODO\COMODO Internet Security\

COMODO - Firewall Security.cfgx
COMODO - Internet Security.cfgx
COMODO - Proactive Security.cfgx

Well, this is weird. Shotcut seems to work now, but the problem remains that I can’t run unknown status applications anymore without them getting auto-contained. And I can’t unblock them because they won’t show up on the list.

[CISfan]

@CinderBH post:33

Well, this is weird. Shotcut seems to work now, but the problem remains that I can’t run unknown status applications anymore without them getting auto-contained. And I can’t unblock them because they won’t show up on the list.

Maybe still advisable to import a new fresh config file to resolve this too and before Shotcut stops working again.

[CinderBH]

@CISfan post:34

Maybe still advisable to import a new fresh config file to resolve this too and before Shotcut stops working again.

Didn’t I just do that though? I tested that after importing the config file.

[CISfan]

@CinderBH post:35

Didn’t I just do that though? I tested that after importing the config file.

Ah ok, my misunderstanding.

[CISfan]

Either File Rate those untrusted files as Trusted or add an Ignore auto-containment rule for those untrusted files.

[CinderBH]

@CISfan post:37

Either File Rate those untrusted files as Trusted or add an Ignore auto-containment rule for those untrusted files.

Are you kidding me… I created the rule and manually added the application as Trusted, and it still will contain it and show it as “Evaluation: Unknown” in the contained applications window.
What the hell is wrong with this thing…

[CISfan]

@CinderBH post:38

What the hell is wrong with this thing…

It must have a bad day so it seems, does Shotcut still work?

[CinderBH]

@CISfan post:39

It must have a bad day so it seems, does Shotcut still work?

Apparently it does now, but another thing I noticed checking the HIPS event list is WerFault also was blocked along with the application I tested. Either this CIS version needs some bugs fixed or I need to reinstall. AGAIN.

(Also, figure I’m going to change this topic’s title to better describe the situation if I can)