Comodo Firewall: inspect.sys Continues to Consume High CPU When the Firewall Is Disabled
Description
During heavy network activity, particularly when transferring files between computers over the local network, the inspect.sys kernel-mode driver continues to consume significant CPU resources even after Comodo Firewall has been disabled.
I monitored the activity using Process Explorer. The CPU usage is attributed to a thread within the Windows System process (the kernel process associated with ntoskrnl.exe), with the execution activity involving Comodo’s inspect.sys driver. This is not a separate user-mode process.
Expected behaviour
When Comodo Firewall is disabled, I would expect its network inspection driver, inspect.sys, to stop inspecting network traffic or at least significantly reduce its CPU activity.
Actual behaviour
Even with Comodo Firewall disabled, inspect.sys continues to be associated with high CPU usage during heavy network traffic, especially when transferring files between computers on the local network.
Question
Is this expected behaviour, or does inspect.sys continue processing or inspecting network traffic even when Comodo Firewall is disabled?