Comodo blocking something when it is shut down?

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
1

After shutting down Comodo Internet Security (right click on icon in system tray, select exit, and then click on the Ok/Yes button, open up task manager and confirm its not running) 2 of the 3 games I have installed on my machine behave weirdly (no keyboard/mouse input in certain areas). Reloading CIS and setting the Defense+ to Training mode and rerunning the games fixes all of the problems. Removing the game entries from the Defense+ lists and setting the mode back to Safe Mode and THEN shutting down CIS and rerunning the games reproduces the errors.

The 3 games on my machine are Rome: Total War, Medieval: Total War and Mount&Blade and it is Mount&Blade and Rome: Total War have has the issue. The issue is that once you get past the main menu screen of both games (start new game, load game etc) the game stops responding to mouse clicks and keyboard presses, I can move the mouse cursor and scrolling the cursor to the edge of the screen scrolls the map, but it is impossible to click on anything or use the keyboard to scroll etc (However Alt-Tab will still get me back to my desktop - which is the only way I can exit the game, Ctrl-Shift-Esc also responds). Once back in Windows the mouse and keyboard are working fine, Alt-Tab back to the game and then are not responding again

What I cannot understand is why this issue happens when CIS is shutdown? My guessing that CIS is still monitoring/blocking the direct keyboard access ?? Maybe? (both keyboard and mouse are USB by the way).

The games were installed when I originally had CIS v3.8 on my machine, I have since uninstalled 3.8 (where I never saw this issue) and installed 3.9.

Now the solution is obviously to run the games once in Training Mode and then all is good, but that doesn’t explain why it appears that CIS seems to be blocking things while it is shutdown. Surely if I shutdown CIS I should have nothing restricting anything access to any part of my computer.

Shouldn’t I?

(Other info: My machine has Windows XP SP3, Athlon 2800+ CPU, 1 GB Ram, if that makes any difference).

If anyone can shed any light on this I would be grateful.

2

I think it is a safety thing, if some malware actually gets to shutdown comodo it goes into blocking mode so that it cannot do much damage. But this is just a guess, why do you want to shut it down anyway? Just have it learn everything and keep it running in the background .

3

I don’t particularily have a issue with it learning and running in the background. Its just that if I shut down a program, I would expect it to be shut down, not running in the background without a GUI.

I can understand the safety aspect and if that is actually what is going on here then that is excellent from a safety point of view, but I would still like the option to shutdown CIS if I choose to, not just the GUI which is what appears to be happening here.

Basically the option to shutdown CIS is not really an option at all, it just closes the GUI and then keeps running in the background in Blocking Mode, if your assertion is correct.

However I also understand that how you differenciate a user shutting down a program and a malicious piece of code shutting down a program is a tricky problem.

4

Shutting down CIS by selecting Exit from the systray icon, merely closes the front-end. In short, CIS stops issuing alerts & takes default action (as if an alert wasn’t answered) & blocks it. The business end of CIS, cmdagent.exe (the service) & the drivers, are still running & filtering. You need to disable all the components (firewall & Defense+ at least) to “stop” CIS. :slight_smile:

Using the training modes for games (to learn what the game needs) & subsequently running the game with CIS fully active seems to have worked for many.

5

Also take a look if “Block all unknown requests if the application is closed” is enabled under Defense + → Advanced → Defense + Settings.