CFP forgets my settings

Help for v2
#1

Hi all. I’ve been having this problem intermittently since I started using the firewall, and I hope someone can help.

Most of the time, everything works great. I have it set up the way I want it, it works perfectly for months…then it changes its settings out of nowhere.

Specifically, the component monitor switches from off to learn mode, and all the network monitor rules except one are deleted. These don’t both happen at once, but it always seems to be one of the two when it happens.

I’ve recently reformatted my HD and reinstalled Windows, and the problem has persisted.

This is very strange and a little disconcerting. Has anyone else had this problem, and does anyone know how to fix it?

#2

“Learn Mode” is the default setting. If you change it to “Off”, make sure you click the “Apply” button followed by “Refresh” afterwards, and then reboot.

#3

Do it or not, the firewall will still keep forgetting the things…

I have asked many times the builders of this soft to repair some minor but annoying flaws (like this one) in the existing version. Official viewpoint is that everything will be OK in the new version and users of the existing official version simply do not matter.

The new version is nowhere to near release, so you just have bad luck, guy.

#4

citizenphil wrote:

Specifically, the component monitor switches from off to learn mode, and all the network monitor rules except one are deleted. These don't both happen at once, but it always seems to be one of the two when it happens.

Hi, personally, I’ve never seen this happen, so it’s very difficult to know what to say. As far as you can tell, are there any specific events that occur prior to CFP ‘forgetting’ it’s settings?

JanPoko wrote:

Do it or not, the firewall will still keep forgetting the things...

Specifically?

#5

My understanding is that CFP settings are kept in the Windows registry. That the settings change would then seem to mean that something is changing the registry.

For CFP 2.4.18.184 (since 3.0 RC1 is now out, version details matter), have you checked the settings for Security → Advanced → Miscellaneous, Configure, and the checkbox at the bottom that says “Protect own registry keys”. If that checkbox is clear, then mark it, and probably reboot just to make sure the bits get set.

And it would probably also be a good idea to save configuration backups using the script that is in the pinned topic at the beginning of this forum. If you compare backups (size, checksums, eyeball, pick your method) and things are different from time to time, then something is definitely running around in the registry.

#6

Zito:

"Learn Mode" is the default setting. If you change it to "Off", make sure you click the "Apply" button followed by "Refresh" afterwards, and then reboot.

That’s the strange thing: I’ve done that, and I’ve had the same settings working fine for weeks or months, through several reboots, and then they change for, as far as I can tell, no reason.

Toggie:

As far as you can tell, are there any specific events that occur prior to CFP 'forgetting' it's settings?

I haven’t noticed anything; it seems to be pretty random. I do periodically clean up temp/junk files with products like CCleaner and clean the registry with CCleaner and Eusing Free Registry Cleaner. I know that could be attributed to the problem, but I don’t think that’s it. Usually when I do a full cleanup my CFP settings stay just as they should, and otherwise this is something that has happened even when I’ve done nothing with my computer other than opening Firefox.

grue155:

For CFP 2.4.18.184 (since 3.0 RC1 is now out, version details matter), have you checked the settings for Security -> Advanced -> Miscellaneous, Configure, and the checkbox at the bottom that says "Protect own registry keys".

I just looked and yes, the box is checked. I haven’t messed with those settings at all, so I’m assuming it has always been checked by default.

JanPoko:

The new version is nowhere to near release, so you just have bad luck, guy.

Well then maybe I’ll just have to wait and see. I’ve grown to really like CFP, other than this and a few other “minor but annoying flaws,” like you said, so I want to keep using it.

My biggest concern here is the change in network monitor rules. This I’m thinking could be a security risk. A week ago I opened that panel and the only rule there said basically ‘allow TCP/UDP out from anywhere to anywhere’ (you know, the first one). The others had disappeared. I was still getting popup alerts for new programs, so I know it hadn’t completely crippled the firewall. Should I be worried about this?

Okay, almost done. Sorry about the long-winded post. This is only semi-related, but it does have something to do with this program’s utter disrespect for my wishes (refuses to use emoticon to demonstrate lightheartedness). The application control setting ‘skip parent check’ doesn’t really work. If a program is going to have several parent applications (a web browser is a great example), I’d like to only have one rule for it. This is theoretically possible with ‘skip parent check’, but CFP will still issue alerts for what it deems suspicious behavior. This is a good thing, I think, except that when it does this it ought to remember that the parent application is still irrelevant. It doesn’t do this, and so whenever such an alert is issued and I select ‘remember’ and ‘allow’ it resets the parent application to the current one. This makes the ‘skip parent check’ option unusable to me. I doubt there’s a fix for this, but if anyone knows of one I’d be very grateful.

Thanks for the responses, everyone.

#7

Just an update.

It’s possible this forgetfulness happens when I have multiple users logged on at once. Now that I think about it, that’s something I did the last time this happened, and it just happened again. I had other users logged on while I was still logged on, then logged them off, went back to my desktop, and found the component monitor had reset to ‘learn mode.’ This is something I need to do sometimes, so it’s not as simple as ‘don’t do that any more.’

#8

CFP 2.4 has been working okay for a very long time, but now out of the blue the app monitor is malfunctioning. I’ll try un- and re-installing, safe mode and all, and see if that does the trick.

Certainly, it’s almost guaranteed that CFP will act funny when using several user accounts at the same time. Let’s hope it’s fixed in v3 because the concern has been raised here in the forums.

That’s so not true that v3 is already out of beta and into the release candidate stage.

#9
CFP 2.4 has been working okay for a very long time, but now out of the blue the app monitor is malfunctioning. I'll try un- and re-installing, safe mode and all, and see if that does the trick.

It always sends up a flag to me when something has been working for some time, and then just doesn’t anymore. It may be my dayjob paranoia, but have you run a HiJackThis scan to see if there is anything unusual? Or any other scans that are not part of your usual safety/security suite, like an on-line scan from kaspersky.com?

#10

OK thanks for the heads up, I’ll do at least the Kaspersky online scan, it’s good to do that stuff once in a while anyway. However it hasn’t been sudden really, it’s true that this particular glitch didn’t happen before and was critical, but even if CFP is the best firewall it’s not (yet) the most bug-free, not even the v2 release.

By the way, the un-re-install in safe mode did the trick. :slight_smile: I wonder if this was caused by RegSeeker, which I recently started to use, but I’d bet for the latest Windows update, specially since the glitch appeared in the svchost.exe app rule.