CISV3 defense+ hanging windows from screen capture

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
#1

Windows CISV3, xp prof sp3.
CISV3 only firewall and defense+, proactive mode (AV not installed).
Concerning defense+, mode is set to paranoia, no trusted vendor, all parameters checked, image control set to normal.

Let us now suppose that i have ponctual picture conversion and extraction needs (i.e., i don’t want, altough i have several, to use whatever full picture processing software for this).

The choice is Faststone FS Viewer (3.9), as it allows from a single gui to easily both view and convert all the pictures in a said folder.

Executing FSViewer prompt for svchost, denied (it has something to do with mailing the pictures, i don’t want it).
Every following alert is allowed, not mattering if it is remembered or not.

If now i want to use not only picture conversion, but screen capture for partial picture selection (don’t do that, it is lousy in FsViewer, the best no money/quality ratio is probably PrintKey2000), new alerts pop up, notably for desktop and keyboard privileges.

Windows hangs on the keyboard alert (nothing works anymore, everything is freezed including ps2 mice and keyboard), making it impossible to check the allowing box, the only remaining solution being to shut the ac power.

This behavior has already been observed with other applications taking desktop/keyboard privileges.
The “solution”, concerning FsViewer, is to set it as a trusted application, but when running it thereafter, it shall still ask for the desktop/keyboard privileges, but now, they can be allowed, resulting in FsViewer being at the end of it set not as a trusted application, but as custom, where svchost is still denied, but desktop/keyboard allowed.

Really a lousy “solution”, and probably definitely a cis bug.

#2

Works in V4 as a safe file.

Best wishes

Mouse

#3

OS Windows XP32 32bit SP3 and latest patches
CF 4.0.141842.828
D+: Proactive config, Sandbox disabled

EDIT:
Keyboard/mouse (both PS/2) driver: Windows generic
Videocard driver nvidia 196.21 WHQL certified

Tested multiple times using FastStone Image Viewer 4.2 (2010-04-29) portable version and its “Capture Rectangle Region” and the mouse cursor disappeared briefly on D+ Keboard alerts but it was possible to move the mouse around, get the cursor back and click the alert.

With early V3 version I experienced simiar issues in some cases and found it to be related to 3rd party Mouse/Keyboard software/drivers.

Just in case please confirm if similar software (along with maker/version) is installed on your system.

Uninstalling eventual 3rd party mouse/keyboard software/driver might help narrow down the issue further.

It might be another issue as well. Uninstalling eventual 3rd party mouse/keyboard software/driver might yeld different results.

#4

All of the drivers (monitor, keyboard, mouse) are generic, the keyboard is no-software ps2 (i had and hate logitech-like “clever” keyboards, true enough often responsible of some failures); the mouse is usb, and thus the driver relates to the usb controllers of the motherboard, i could plug it to ps2 through an adapter, but not sure it would change anything.

From “finer analysis”, the culprit in defense+ is not the mouse but the keyboard.
In the initial “test”, the system completely hanged with the defense+ keyboard alert, and i couldn’t get further control of the mouse.
Now, i have custom defense+ settings for Faststone: if i disable the allowing rule for the keyboard, i get a lag with the keyboard alert, but i am indeed able to get the mouse back some seconds later (the mouse is not responsible, it is a general temporary or permanent system hang), but that doesn’t prove anything: the only task is to enable a existing rule, not to create it from scratch as before and maybe leading to permanent hang maybe due to larger system ressources needs.

The “safe file theory” might be partially relevant a posteriori, but not as a general rule: one won’t of course set as safe whatever software he installs, and waiting for crash to do it is somewhat late.
Moreover, “safe” is not safe at all, e.g. i have no reason to allow a screen capture to use svchost to allegedly being able to mail the picture, but as well for who knows what.
I have thus not made of FsViewer a safe file, but i previously tried it with other kind of softwares and, not even speaking of the fact that i don’t like it, i could never have it work.

Last, and curiously enough, this same issue does not exist with the other screen capture softwares i tried (Namo web 6, PrintKey2000).

#5

Well of course even the last time I checked there was no D+ “mouse” activity monitor and your OP was clear the issue occurred on D+ keyboard alert ???

Thanks for confirming. I have generic driver for keyboard/mouse (both PS/2) as well. My videocard driver is nvidia 196.21 WHQL certified

Just to be sure I tested also spare usb mouse with the same result: There was no permanent hang but the mouse cursor disappeared briefly. As before I was able to click the alert as soon the mouse cursor appeared.

I did test also by disabling Keyboard monitoring (D+ settings >monitor settings): This time the mouse cursor did not disappear and it was immediately possible to get “Capture Rectangle Region” magnifying glass dialog on screen.

I did not pay attention to this before but while testing with Keyboard monitoring disabled there was no white-screen effect/glitch (see below).

So I did test with Keyboard monitoring enabled again:

As soon the mouse cursor appeared again the entire screen/display area around the alert was was filled by a monochrome white color (no wallpaper, no icons, no taskbar: all white).

It was possible to keep the screen in that condition for as long the alert was left unanswered whereas either allowing or blocking the keyboard alert had the white-screen effect disappear.

While the mouse cursor disappear (as soon the keyboard alert appears) the screen is not affected by the previously decribed whiteout effect.