Comodo leeching data without permission / Huge Privacy Risk

Comodo Internet Security - CIS Install / Setup / Configuration Help - CIS
#1

have been a CIS user for more than a decade - wonderful product.

But of late - have been seeing some strange issues

  1. Internet Security Essentials - when will we get a 64 bit version?

ISE is taking up way too much ram/resources.
Sometimes starts scanning HD without initiation for hours.

  1. cmdagent.exe sharing data to outside IPS - even when I’ve disabled data sharing/meta data sharing with Comodo.

partial list of Receiving IPs- 104.21.80.250, 52.85.128.100, 199.66.201.17, 69.4.89.246, 162.255.24.195

The repeated pings and data sharing - sometimes 100mb+ at one go is creating havoc at my end.
Average 200-300 mb being shared every week.

NEED TO STOP THIS ASAP - please help.
NEED clarification too - why is this data leak happening?

Thanks in advance.

#2

Hi bitspirit,

Thank you for reporting, we will reach you through private message to get required information for investigation.

Thanks
C.O.M.O.D.O RT

#3

Hi bitspirit,

Could you please check your inbox for pm and respond ?

Thanks
C.O.M.O.D.O RT

#4

[at]bitspirit,

Use “Process Hacker” or SysInternals “Process Explorer” to find out which applications have active internet connections and which applications produce this heavy data traffic.
Only IP 199.66.201.17 relates directly to Comodo the other IP do not, maybe you have some other background applications running that consume so much traffic (torrent client perhaps?).

#5

@CISfan

Wouldn’t it be sooner the IP address 199.66.201.16 ?

#6

Comodo owns more IP addresses.
According to https://whatismyipaddress.com/ip/199.66.201.17 the IP belongs to Comodo.

IP Details For: 199.66.201.17

Decimal: 3343042833
Hostname: cima.security.comodo.com
ASN: 35838
ISP: Comodo Group Inc.
Services: Datacenter
Assignment: Likely Static IP
Country: United States
State/Region: New Jersey
City: Clifton

#7

@CISfan

Comodo has of course many @ Ip.

This is the case for the @ 199.66.201.16:
IP Details For: 199.66.201.16
Decimal: 3343042832
Hostname: no-dns-yet.ccanet.co.uk
ASN: 35838
ISP: Comodo Group Inc.
Services: Datacenter
Assignment: Likely Static IP
Country: United States
State/Region: New Jersey
City: Clifton

In the document referenced above only the @ 199.66.201.16 is mentioned.

#8

All data being shared by Comodo Only - cmdagent.exe - all IP’s being shown are from Comodo Logs (Outbound Connections)

#9

This is definitely a Comodo thing - did some research of my own

  1. With Telemetry and Cloud lookup disabled - why is there a need for Comodo telemetry in Scheduled tasks?
    You can delete it - but it comes back on every boot.

Can anybody enlighten me on this?
This is not honest behaviour.

There are many threads across the web - even I’m getting doubts on Comodo now after more than a decade of use.

  1. User Peerblock to check Comodo behaviour - its pinging 199.66.201.16 every few seconds?
    Why the need to ping Comodo DataCenter even when Telemetry is disabled?

  2. Why are there so many malware with Comodo certificates?
    would like a comment from the CEO on this?

#10

Hi bitspirit,

Thank you for reporting. In order to investigate on this issue kindly provide us the below detail so that we will check and update you

  1. Windows Version & CIS version.
  2. Can you reproduce the problem & if so how reliably?
  3. If you can, exact steps to reproduce. If not, exactly what you did & what happened.
  4. Any software except CIS/OS involved? If so - name, & exact version.
  5. Is there any other security product installed on your machine?
  6. Any other information, eg your guess at the cause, how you tried to fix it etc.
  7. If possible, any related screenshots.

Thanks
C.O.M.O.D.O RT

#11

Hi Comodo RT,

I appreciate your interest, which I feel is just hogwash - this issue has been posted by others too, even as far back as 2019.
Still no solution from your end.

Excluding 3rd party forums, even here there are similar threads older than mine - no one received a solution till date.
Which points to this being deliberate…!

I’m yet to receive any answers to my queries - this thing about OS version / CIS version is another hogwash.
Task scheduler is deliberate and has nothing to do with os /cis versions.

#12

Hi bitspirit,

Thank you for reporting, kindly provide us exactly what you did and what heppened or provide us steps to reproduce so that we will check and report this to the team.

Thanks
C.O.M.O.D.O RT

#13

What are you on about? If you actually did search the forums you would notice this thread that explains the telemtry task: https://forums.comodo.com/waiting-area-please-cast-your-votes-cis/comodo-telemetry-task-t120918.0.html;msg868345#msg868345 and if you are really worried about it you can disable the task and then set the task to read only in the windows task folder.

#14

The post linked to explains that no data should be sent by the scheduled task if data collection is disabled in the settings. This doesn’t answer the OP’s question as to why CIS connects to several server IPs when telemetry is set to disabled.

#15

On my laptop (see attachment) the 3 sites on which cmdagent.exe has connected since this morning.
The setting “Send anonymous program usage statistics to COMODO” is unchecked on my laptop.

One question: do you ask yourself the same type of questions about your AV?

#16

Not all IPs are for telemtry so there is no proof that contacting different IPs has to do with telemtry when it is turned off.

#17

I agree, but still the post linked to is unfit to explain away the OP’s concerns.