Comodo Firewall and multi user [RESOLVED]

Hello

I Comodo Firewall build version 3.0.14.276, Windows XP pro with 4 accounts ( 1 as administrator and the others are limited accounts ).

When I start my PC using the administrator account, all is OK. But when I log off from this account to change account, I have two icons in the systray.

If I hit Ctrl/Alt/Del , 2 tasks cfp.exe are running. I’m not sure I won’t have conflicts.

Can you tell me where the problem comes from ?

Sincerely.

[Topic Closed: If issue returns PM an online mod to open]

[attachment deleted by admin]

Hello

I think I’ve found where the problem comes from.
In Defense+ Computer security policy, I’ve modified the group “Comodo Firewall Pro” like this :

  • in protection settings, I’ve checked “Yes” for Process Termination.

I wanted to protect de Firewall against malware that wanted to terminate cfp.exe.

I’ve added one exception : c:\windows\system32\csrss.exe. I’ve seen in Defense+ Events that c:\windows\system32\csrss.exe have tried several times to terminate cfp.exe.

Am I right ?

Most likely you have 2 autorun entries for CFP. Use this utility (or similar) to check this: http://download.sysinternals.com/Files/Autoruns.zip

If there will be 2 entries of Comodo Firewall for one user account, leave only one entry (located in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run section) and delete another.

Hello

I’m not sure I have 2 entries.
Like I’ve written, I’ve modified the Group “Comodo Firewall Pro” in Defense+ Computer Security Policy so that the tasks in this group could not be terminated : protection settings - process terminations set to Yes.
When I used Ctrl/alt/del to terminate cfp.exe, I got an error message ==> acces refused.
When logging off from my session to word under another, 2 tasks cfp.exe were running ( not good … )
I’ve looked at the Defense+ events, and several entries like that

  • Application c:\windows\system32\csrss.exe
  • Action Terminate process
  • Target e:\Program Files\Comodo\Firewall\cfp.exe

I’ve understood that csrss couldn’t terminate cfp.exe when I logoff.
In the policy group, in terminate process, I have entered exceptions the file group “Windows System Application”.

Now, when I logoff and log under another account, all is OK ( just one cfp.exe in memory ).

Sorry, I thought the problem was in autorun configuration :THNK