CIS .6420/.6474 will create NEW/Duplicate BFE filter rule after restart [M2336]

CIS v10.0.2.6420/10.1.0.6474 will create NEW/Duplicate BFE filter rule after restart, My Registry NOT Recycle Bin!!!

see ana.mp4

Registry file output is First-In First-Out
Old
^

v
New ← new subkeys

Rollback 10.0.1.6294

How to correct Un/installation the CIS? see green.mp4

[attachment deleted by admin]

[attachment deleted by admin]

Video’s don’t work even VLC won’t play them.

They do here futuretech with VLC . . but they’re ‘beyond me’!

Video encode from avidemux… MPC-HC and Windows thumbnail no problem.

CRC
ana.mp4 E89E5ACE
green.mp4 362F3400

For some reason every time I try to download the video it keeps getting corrupted by not downloading all the way.

mirror file
https://www.sendspace.com/file/n340qy

Could you describe in more detail what is going on? What do you mean with Registry file output is First-In First-Out?

I see that after each boot more and more entries get created in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Filter . I have a long list of entries in my own registry on Win 8.1 x64.

As far as I understand the problem it means that CIS keeps on adding entries to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Filter with each Windows session. Does the count go up further during the Windows session?

With versions beofre 6420 CIS would only create one set of rules? Or would it create new rules deleting previous rules? Do you know?

Edit: CIS does not depend on BFE service. Windows Firewall Service does depend on BFE; I checked the dependencies of the services. May be we’re looking at BFE entries generated by Windows Firewall Service or Windows Firewall? CIS has a bad reputation of not disabling Windows Firewall so we could be looking at entries generated by Windows Firewall.

I did a clean install of 6474 and before I installed it I had my two favorite registry scanner, Auslogics and Eusing, deleting unneeded registry entries. There were no entries removed in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Filter . So I cannot deny nor confirm the plethora of entries are caused by CIS.

In the video it did not happen with version 10.0.1.6294 but started to happen on v10.0.2.6420 and it also happens with the latest version. If you double-click any of the values you will see references to Comodo, e.g. comodo connect v4, comodo resource release v6, comodo closure v4. You have to scroll down some to see them with a dot separating each letter witch represent a null byte.

Also it can’t be said that CIS does not depend on the BFE service as on Windows 10 it can not be stopped or disabled. So you can’t know how CIS will react when the service is not running.

I checked 6 of 100+ entries and found like you stated references to Comodo in the data field.

Out of curiosity I exported the entries under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Filter and removed them. I may report back about it later.

Also it can't be said that CIS does not depend on the BFE service as on Windows 10 it can not be stopped or disabled. So you can't know how CIS will react when the service is not running.
I am fully trusting the dependencies Windows provides in the dependency tab of the properties of the involved services. :-\

I reported the issue. Bug 2336

After each reboot it will add entries in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Filter.

Hi Guys,
Thanks for identifying.

We have fixed the bug and will be available in Feb release, expect a Beta soon.

Thanks
-umesh

Thank you. Why is it that there is no sign of dependencies with BFE and Comodo Internet Security Helper Service when checking them in Services? I would expect to see a dependency there.

Will the fix also clean up the big amount of registry entries made by CIS?

I will get back on this.

Should be fixed with Comodo Internet Security v10.2.0.6504 - BETA. Please check thank you.

Please verify this fix in latest released version v10.2.0.6514