CIS seems to delay my network card startup for 2-3 minutes after the desktop appears at power on. Was using Zonealarm, and net connection was made either before zonealarm or a realively short time 20-30 seconds after.
Anyway around this? The CIS loads early into the system tray and seems to prevent the network card from loading up until the very last app. Anyway to delay loading of CIS or change settings so that network card loads before CIS? Using Win XP and latest version of CIS.
Can you take a look at the Firewall logs of around boot time and see if it is blocking programs and post a screenshot of them? The logs can be found under Firewall → Common Tasks → View Firewall Events.
Also make sure you are using the latest drivers of your network card.
I appear to be experiencing the same problem. After I log in, when the system tries to connect to the network (i.e. the blue spinning ring is on the WLAN system tray icon), the system locks up for about 2 minutes. I can move the mouse cursor, but no new tasks can be started (or even any windows opened). If I disable the network card before logging in, the locking up does not occur.
The problem appears to have started when I upgraded to CPF v4.
As for your question about blocking firewall events, no significant amount of blocking appears to occur (click for full res):
http://img844.imageshack.us/img844/6341/fwevt.th.png
Network card drivers are up to date, according to both Windows Update and HP Support Assistant (this is a HP laptop).
Software used:
Windows 7 Home Premium x64
Comodo Firewall Free 4.1.150349.920
Avast! Antivirus Free 5.0.594
Windows Firewall on or off does not appear to make a difference
Software used: Windows 7 Home Premium x64 Comodo Firewall Free 4.1.150349.920 Avast! Antivirus Free 5.0.594 Windows Firewall on or off does not appear to make a difference
using the same configuration…
Is your network card from Realtek???
No, I think it’s Intel… (I’m on another computer right now, I’ll double check later).
Can you guys make sure you are using the latest version of your NIC’s drivers?
My NIC is an Intel WiFi Link 1000 BGN. I just downloaded and installed a driver update from Intel’s site, going from 13.2.0.30 to 13.2.1.5. (Neither Microsoft nor HP distribute this update, by the way.)
Alas, the delay in being able to start any programs has not disappeared, although the WLAN system tray icon now says an internet connection is available at the start of the delay. I do get messages such as this one during these locked minutes:
http://a.imageshack.us/img401/6906/serverfail.png
And when it’s done doing whatever it’s doing during the delay, all program I’ve tried to start start at once…
Can all please verify the Windows Event Log to see what else fails during that time?
Application and System logs could give possible answers here…
Other option on Win7 is the Diagnostics logging;
>Applications and Services Logs, Microsoft, Windows, Diagnostics Performance, Operational
This log holds all kinds of boot up/shutdown performance logging.
Please verify that also for things like cfp.exe / cmdagent.exe or network driver issues.
These logs contain a lot of information… What exactly am I supposed to be looking for? Anyway, here are a few entries that may or may not be of interest to you:
Log Name: Microsoft-Windows-Diagnostics-Performance/Operational
Source: Microsoft-Windows-Diagnostics-Performance
Date: 24-7-2010 17:20:32
Event ID: 100
Task Category: Boot Performance Monitoring
Level: Warning
Keywords: Event Log
User: LOCAL SERVICE
Computer: TRIBYTE
Description:
Windows has started up:
Boot Duration : 54548ms
IsDegradation : false
Incident Time (UTC) : ?2010?-?07?-?24T15:16:45.217601300Z
-------------------------------------
Log Name: Microsoft-Windows-Diagnostics-Performance/Operational
Source: Microsoft-Windows-Diagnostics-Performance
Date: 24-7-2010 18:36:46
Event ID: 100
Task Category: Boot Performance Monitoring
Level: Warning
Keywords: Event Log
User: LOCAL SERVICE
Computer: TRIBYTE
Description:
Windows has started up:
Boot Duration : 64024ms
IsDegradation : false
Incident Time (UTC) : ?2010?-?07?-?24T16:32:51.280001400Z
-------------------------------------
Log Name: System
Source: Service Control Manager
Date: 24-7-2010 18:36:05
Event ID: 7001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: TRIBYTE
Description:
The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
After starting, the service hung in a start-pending state.
The first two tell you that startup performance is OK, IsDegraded : false
But the last one shows a service that fails to start in time, this service should also show up in the system log and probably more before or after this one, depending on the first service after boot that fails…
So you have to look at the system and application log to see more details.
could you please give me the path to find the Logs on Win7 (x64)
Start Menu > Control Panel > System and Security > View event logs
Well, I did examine the logs again, this time armed with more precise timestamps for delay start/end, but there are still no obvious culprits or way forward… I did notice a few odd things:
There was a “Server execution failed” dialog again, but this one refers to an Explorer folder window I was trying to open during the delay:
http://img340.imageshack.us/img340/5886/serverfailfolder.png
Here’s something that’s shown after the delay about a program that I was trying to start (click to view). Similar errors are sometimes shown at boot about automatic startup items (e.g. Logitech driver parts/utilities):
http://img245.imageshack.us/img245/4231/comodompcblock.th.png
Around the time of the end of the delay, there are some log entries about PNRP (which, again, may or may not have anything to do with it, I don’t have enough information to tell):
Log Name: Application
Source: Windows Error Reporting
Date: 25-7-2010 15:19:36
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: TRIBYTE
Description:
Fault bucket 650009561, type 5
Event Name: ServiceHang
Response: Not available
Cab Id: 0
Problem signature:
P1: PNRPsvc
P2: pnrpsvc.dll
P3: 6.1.7600.16385
P4: 20
P5: 3
P6:
P7:
P8:
P9:
P10:
Attached files:
C:\Windows\Temp\WER8094.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER864F.tmp.hdmp
C:\Windows\Temp\WER982B.tmp.mdmp
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppHang_PNRPsvc_68f69ba26d6e013eb36df3c41ea105fd4968bb8_12c7c061
Analysis symbol:
Rechecking for solution: 0
Report Id: 02a7ed5a-97ef-11df-b2b1-00247ef28316
Report Status: 0
After the boot delay, everything seems to work normally, but having 3 minutes added to the boot sequence of what is otherwise a decently fast computer is inconvenient enough in itself, IMO…
Do these go away when you set, Defense+, Advanced, Settings “Disable D+ permanent, requires restart”?
O few pictures above you show a screen show where explorer.exe is trying to access the other .exe and when you don’t answer that alert, CIS will default to “block” that’s where the Windows Error message on the center screen arises from “explorer.exe can’t access the …exe”…
I’m just wondering what mode you have D+ running and which policy is active, and if you did manual changes to the D+ policy?
I disabled Defense+ per your instructions, and the delay disappears. Right after login, tasks start in seconds rather than minutes. Seems like I’m barking up the right tree after all.
I understand that the Comodo dialog is supposed to block access to the file, but it does not appear during the delay. I can’t hit an OK button that isn’t there, so I cannot unblock in time.
Defense+ was running in Clean PC Mode. I have not made any manual changes to the Defense+ configuration, other than adding Trusted Software Vendors and Own Safe Files.
So something in your Defense+ settings is causing a “block” probably, a bug or a policy rule.
Can you tell me how your Defense+ is setup, did you start with a clean install on v4.1. or did you import an “older” configuration?
Is it “Internet Security” or “Proactive”?
Do you have “block requests if application is closed” active?
Some answers to your questions:
I installed Comodo Firewall before v4.0 was out, and subsequent updates were applied. I might try a clean install later, I’ve had problems with the Comodo updater in the past. (I’d probably have to re-train it then, though.)
Proactive (I don’t mind pop-ups as long as things work.)
No.
Completely uninstalling Comodo Firewall 4.1 and installing Comodo Firewall 5.0 seems to have solved my problem.
Well whatever it caused, It solved 