Today CF picked up connections received by lsass.exe and app “system”. lsass.exe was trying to receive connection from 218.77.79.55, which is “CHINANET-HN Hengyang node network”, and “system” tried to connect via 93.94.139.2 and 95.104.22.32 ms-ds (445). first Ip belongs to Bulgartel (don’t know anything about it), second one is my ISP’s address, but port 445 makes me feel suspicious.
I remember CF asking similar about system and svchost.exe receiving connections 3 years ago, but since then such things hadn’t occurred. The changes I made today was reinstalling Avast and I also restored settings in CF from backup. Don’t know how these could be related, just for info. Also I did search about such connections and there are some similar threads in Comodo Forums and in other security suit forums, but they don’t give a certain answer.
Could anyone help me explain why these connections appeared suddenly? Thanks.
Is your computer directly connected to the internet without a router?
Yep, directly. I already solved this issue, you could lock this thread now. It appears that something happened to my backup settings and after importing there was no single rule in global rules section, I dont know why they dissapeared, maybe backup file has gotten damaged and thats why system and lssas.exe were receiving connections from outside.
I now created another topic in the “sandbox help” section because after importing settings, sandboxed applications don’t run as sandboxed, global rules are in place though. I was thinking that this might be due to incompatibility with newer Cf program version, but now I’m thinking that it may be as well my settings file is damaged, but can’t figure out why they could get damaged. I have 2 backup settings-for CIS and for CF, importing and activating either of one of them makes sandbox unusable-applications run in a normal way. Will take quite of time to write everything from the scratch now…
I figured it was something with Global Rules and indeed it was.
I now created another topic in the "sandbox help" section because after importing settings, sandboxed applications don't run as sandboxed, global rules are in place though. I was thinking that this might be due to incompatibility with newer Cf program version, but now I'm thinking that it may be as well my settings file is damaged, but can't figure out why they could get damaged. I have 2 backup settings-for CIS and for CF, importing and activating either of one of them makes sandbox unusable-applications run in a normal way. Will take quite of time to write everything from the scratch now...In that case I would suggest to import and activate a factory default configuration (they can be found in the CIS installation folder) and start from there. Sorry I don't have better news for you. :-\
I understand. Sandbox works fine if I switch to Comodo-Internet Security, Firewall security or Proactive security configurations. It doesn’t work only just with my backups. I also reinstalled Cf and restored backups but got the same result. I read somewhere on the forum someones having similar problem after new program version update, they say that after update and restoring their backups comp works slow, something hangs and so on. Well, for me it’s sandbox problem, also few chance that my both backup settings got damaged, mainly I think that it gives glitch with new program and if this is true, then it mitigates (imo) the purpose of making backups, because they might get unusable after new version update which happens 2 or 3 times in a year, if i remember correctly.