Comodo detects AvastUI is trying to install global hook dwmapi.dll

[cska133]

hi,

I got this alarm and of course I asked in Avast Forum but the aswer is to ask in the Comodo forum (not logic for me) ?!? But I try…

Any expaination/idea?

[safemode]

This alert should not appear with HIPS on Safe Mode, have you enabled Paranoid Mode for HIPS?

If not, maybe your HIPS rules got auto-deleted due to a known Bug in the ‘Create rules for safe applications’ setting.

@EricJH post:2

Sometimes when one of the components of CIS has crashed it can damage the rules as they are stored in the registry. Easiest way out is to go back with system restore to a point before when the problem started to happen. Or restore a back up configuration in case you have one.

Otherwise perform a clean re-install of CIS using the Uninstaller Tool and make sure to not check ‘Create rules for safe applications’.

Although I don’t recommend Avast (there are better Free AV options), to avoid conflicts between Comodo Firewall and Third-Party AVs, it is recommended to do the following:

@safemode post:3

You will need to create mutual exceptions/trust rules between CFW and the chosen AV to avoid compatibility issues. Example, include the AV folder at Program Files as an exception at Don’t Detect shellcode injections in these applications and include Comodo’s folder at Program Files as an exception in all modules of the AV.

Also make sure all .exe and .dll files from the AV folder at Program Files are rated as Trusted by Comodo File Rating. Better to disable VirusScope as well since at the moment it is not on par with the Behavior Blocker module of those mentioned AVs.

This is not guaranteed it will solve all conflicts.

[cska133]

in the last day I got Firewall alerts saying Avast is trying to receive TCP connection from xxxx IP , I dont remember it, but I googled and there where many abuse reports in reletion to this IP, so i blocked it.
Question:
If i add Avast to the exceptions to not detect shesllcode injections, will that exclusion mean that such kind of IP attacs on Avast will be ignored/allowed?

[aim4it]

No the hook allows access to the processes memory. The Network connections are handled by the firewall. You’d have to make an allow rule for the application and a global rule to allow an inbound unsolicited traffic i.e port opening.