We’ve been running into an issue with Comodo that doesn’t make any sense.
All seems to be well… I’ve left the program running with it’s default settings, and the monitors are all on, however, now with our computer, Comodo seems to be having a bout with amnesia. I have to tell the firewall what to do with each program over and over again. Just about every time I use them. No matter how many times I check “remember” and “allow” or “deny”, when I go to use said program again, I have to check those settings again.
If you’re referring to CFP V2.4, the firewall monitors for ANY change in the parent-application relationship, component make up, application cryptograhic signature and IP requirements. If any of these change, you’ll get a new alert.
Please double check that there isn’t a small cahnge in the alerts to when you first remembered them.
If you’re referring to CFP V3 alpha, this intermittent forgetfulness is a known bug and will be addressed in a future release.
You people always think of the best thread titles
;D, and I can’t beat them.
Anyway, perhaps some screenshots might reveal the rest of the picture:
** FAQs/Threads - Read Me First **:
[b]Constantly Same Alerts / Doesn't Remember Rules[/b]
Thanks for the quick replies…
No changes in the programs that I know of…or can see from the popup window.
This is the best example I have… this occurs every time I open Thunderbird, even if I close it and immediately reopen the program:
I checked into the other thread you posted…and set the frequency to the lowest level (seems to have done the trick for now)…and ya know, come to think of it now that I’ve read it, we switched ISP providers. We used to have a static IP address, and now we’re using a dynamic IP. Would that be causing the issue?
I also have dynamic IP. Guess what? It means it doesn’t have any relevance.
Both your pictures refer to the same IP: 127.0.0.1. That’s the loopback address. I’ll just quote myself from the thread I linked above:
So you don’t have to set it to the Lowest level. Low by default is sufficient.
Every program that needs access Comodo asks again and again as to what to do. Even just after you close an app and re-open it.
Any ideas? Are there some kind of logs, or temp settings/files/■■■■ that I can delete to start the application monitor fresh?
Are you sure each alert is exactly the same? Perhaps a few screenshots uploaded here will provide us with more clues.
As for ideas, if they truly are the same alerts (which I’ve yet to see), then it’s possible the CFP installation is corrupted/imperfect. You should then clean uninstall CFP and install it in safe mode.
One could only assume that they are exactly the same. It really doesn’t seem to matter what program I open…if it wants or needs access, Comodo has forgotten about it. Even right after I’ve already given the program full access.
I’ll give it yet another uninstall and reinstall to see if the problem has been solved.
Make sure when installing CFP that no other programs are opened to avoid conflicts. Hence, the safe mode suggestion. If it persists, we would prefer at least 2 screenshots: the 1st alert and the 2nd alert after allowing the first alert. Sometimes they may look alike but there could be some small details in there…
This is a known issue. Known to other users, anyway. I’m not sure if the developers have officially acknowledged it.
The problem you’re having (based on what I’ve read) is with the parent check, which doesn’t work correctly. There are three options. “Skip parent check”, “Learn Parent”, and “Specify a parent”. The problem is, the “skip parent check” option doesn’t work. Everytime the application changes its parent (the process that started the application in question), you get a rule pop-up regardless of what you have this set to. Presumably, if you asked the rule to skip the parent check, you shouldn’t get the pop-up at all since there is already a rule for it.
There is another insufficiently documented feature, which allows you to ignore “invisible connections”. I’m not sure what Comodo’s definition of “invisible” is, since the documentation provided does little more than paraphrase the name of the checkbox into sentence form. From my experience, applications occasionally change status from invisible to non-invisible, depending on the day of the week, the cycle of the moon, the price of crude oil, the stock market, and numerous other unpredictable variables. I generally check this option in all of my application rules. You’ll find it on the Miscellaneous tab.
Comodo Firewall 2.4 has lots of annoying little quirks (don’t even get me started on application rule hierarchy). Hopefully they’ll clear some of it up in the next version.
Instead of taking up the grueling task of creating multiple screens… I did try to take notice of anything similar to all app popups.
They all say “dns (53) UDP”
I am supplying two screens. One a parent program we all know, Internet Explorer 7, and BubbleShooter… which has a parent and invisible program. Reflexive’s games are well known for constantly wanting access to the internet… for reasons they won’t explain. Most of their games don’t have any update features, nor do they require a connection to put in your purchased key…yet it still calls out each time you open the program.
Hopefully this sheds more light on the subject… but there’s really no information I can add. The pop ups are all like these shown here.
Uninstalled. Wiped out all registry and leftover Program Files folders…
Reinstalled via Safe Mode… seems to have woken out of it’s coma. I’ll post back to this thread if it re-occurs.
A couple things, quickly…
Chances are good that each application is trying to utilize port 53 to verify DNS, due to svchost.exe having been blocked from this purpose. Normally svchost (a Windows process) handles such things. If it has been blocked from that, each application will have to do it themselves.
As to invisible connections, you might want to read this