CIS warning about programs already registered

Occassionally I have this problem where CIS will start asking me about programs that have been running without problem for months. It’s as though for these programs it has lost the information. The other odd thing is that for one program it will offer the full set of options, i.e. system app, trusted app etc but for another it only offers installer or limited app.

I’m running Windows 7 Pro 64-bit.

I can’t help you with the first issue but when you open the “Treat as” option in an alert, you will only be shown rulesets that deals with the action in question, for example if application a is trying to launch application b, you can only choose installer/updater;Limited and some other, but you can’t choose “Allowed Application” because “Allow Application” doesn’t deal with the action in question (Running another application)

I can see that to some extent one application trying to launch another may be like an installer but the one I get this prompt about is actually a startup launcher. The odd thing is that the prompt appears about one of the apps it is trying to launch, not all of them so is the question about the launcher or the one being launched. In either case, they are neither installers or need to be limited.

If the alert says that the launcher is trying to launch an application then the alert is for the launcher, my point is that the ruleset “Allowed Application” can’t answer that action and hence you can’t choose it in the Treat As option, why? Because “Allowed Application” ruleset has “Run an application” set to “Ask” so if you get an alert where an application is trying to run another application then choosing “Treat as > Allowed Application” would be telling it to ask… which is silly, if someone asks you “Yes or no?” You don’t answer with “Ask” and in the same way Comodo will not accept it as an answer and hence doesn’t show the ruleset as a possible answer in the “Treat as” option, if you want to allow the launcher to run the applications then tick “Remember my answer” and then simply click “Allow” for those alerts.

One of the problems is that when you click on Treat As you can’t go back to Allow, or at least I can’t see how to do it. So once you’ve gone into the Treat As dialogue you can only provide an answer to the question that Comodo is now asking.

Click “Treat As” again to close it.

Does the program with its lanucher get updated automatically? If that’s the case and the executables are not whitelisted (yet) you might get such alerts.

For the past few days, Thunderbird (which is launched when booting) is automatically sandboxed. This didn’t happen before. It also doesn’t happen when launching it manually at a later time. Odd.

Was it recently updated? May be it is not white listed yet?

Can you see if TB is digitally signed and whether it is in the Trusted Software Vendor list?