Defense+ locking my system when trying to start games, CIS 4.1.150349.920

[Agent24]

I have CIS 4.1.150349.920 installed on Windows 7 Ulitmate 32 bit.

Before that I was using Avast! and PCTools firewall (to test them out)

Once installed CIS 4.1.150349.920, I had problems when launching games. At the point where Defense+ would popup a message and I would normally Alt+Tab to the message and allow the action or set the program as trusted etc.

Instead, the screen goes blank, and keyboard\mouse won’t respond to input.

If I set Defense+ level to Disabled, there are no problems.

I have never had this issue before, on XP, Vista or Windows 7, but I was also running older versions of CIS then, too.

[Agent24]

I am still getting this problem and it’s really annoying.

Can someone please help?

[Citizen_K]

The problem is caused because you get a D+ alert but the full screen is blocking view. When you know your system is free from malware try the following:

@Vettetech post:1

If your a gamer like me and I play them all. Simply put Comodo Firewall in Training Mode and D+ in Training Mode. Then launch the game and play for a min or two. Do this with all your games and presto. Comodo will learn all the rules for firewall and D+. This works for PB also. After all games are learned then simple put the firewall and D+ setting back to where you had them before.

Notice that the brand new v5 has a Game Mode.

[Agent24]

I think you may be getting this confused with the problem I usually had.

What used to happen:
If the popup appeared behind a full-screen game, sometimes the game could not minimise (for whatever reason), and I could not allow the game on the D+ alert.

In this case, all I had to do was press the sleep button and force my PC into standby mode.

Then, I just had to resume from standby, login, and the D+ window would be on top, and I could allow the game, and it would work.

(This method worked 99% of the time) Sometimes I would have to just restart the machine blindly (Press Windows key, then U, then R which will tell windows to restart, requires different key combination in Vista\Win7)

In all cases, Windows would respond and either go into Standby or Restart as I told it to.

What happens now:
Game launches and goes fullscreen, D+ tries to pop up an alert, Windows completely locks up and won’t respond to Standby button or any other method as shown in the other scenario.

Only option is to force a hard reset with the reset button (can’t do soft restart in Windows as it’s locked up)

[Citizen_K]

Did you try temporarily switching to training mode? Or adding the game’s executables to My Own Safe Files? Does the problem persist after having tried these two methods?

[Agent24]

Did not try learning mode but if I manually put the game as a trusted application then it works just fine.
It seems only the problem happens when the alert pops up behind the game.

Since this did not happen before I am thinking it’s a bug.

[Citizen_K]

In the new v5 Comodo finally introduced Game Mode.

Over the last couple of months the list of trusted game makers has been increased tremendously. There is a sticky topic in the news/feedback/anouncement board where people can submit games they want to be made trusted The new list and the cloud look up of trusted vendors and white list is but one of the new strong points of v5.

[Agent24]

A “Game Mode” is a nice idea but that is not the point.

I do not want anything to automatically allow any program. I only wish to only allow programs I choose, and customize their access. I may want the program to run but not be able to go on the internet. Or, I may want that it does not add a startup entry for some ‘registration reminder’ program every time I run it.

That is why I use Comodo, it gives me full control over what a program can and can’t access.

The only things I automatically allow are Windows updates and that’s about it.

And, as I said before, there used to be no problem, only recently have I experienced the system lockup problem, which is the issue here.

[Citizen_K]

Try adding the game where it happens to the Exclusions of Image Execution Settings (Defense + → Advanced → Defense + Settings).

Do the D+ logs give us a clue about what is happening? Can you post a screenshot of them?

[Agent24]

It happens in pretty much all games, as long as Comodo tries to pop up an alert after they go full screen.

I don’t think the problem is that Defense+ is working, it’s the fact that the popup comes while the game is full screen. It’s like some kind of incompatibility with the fact that the game is full screen or something.

Any popups which come BEFORE the game goes fullscreen DON’T cause the lockup problem.

Upgraded to CIS 5.0.162636.1135 and still the problem is here.

Where do I find the logs?

[Citizen_K]

I just replied to another post of you. In that post you are talking about problems with a game installed on a network. Are your games on a fixed drive or on some sort external drive?

The logs are in Defense + → View Defense + Events.

[Agent24]

It happens with games both on local and network shares.

However it’s worse on a network share because the settings are not saved. If they were saved, I could eventually get them how I wanted them resulting in no more popups and thus no more crashes.

However, since it doesn’t remember the settings, it always pops up and always crashes when running games on a network drive.

I have just upgraded my video card drivers in the hope that perhaps they were causing the problem somehow (as it seems only related to full screen games + a popup window)

[Citizen_K]

With the games on the network drive you are out of luck.

You could consider updating to v5 and use Game Mode. Or when sticking to v4 put D+ in training mode when you run a game. Then either run the whole time you are playing a game in Training Mode or stop the game after a couple of minutes and put D+ back where it was (CIS will remember until you reboot).

[game21a]

I have the same problem, BUT if i manually add an entry for the game.exe and allow the access to the

Interproces Memory Accesses = no freezeing , game working fine.

But if i leave it deafult (ask) Interproces Memory Accesses = freezing my pc , hard reset necessary.

I seems there is an bug whit programs that are trying to access the memory. This has never happenend
in v3.14.

The same thing happened whit Rapidshare Manager. The weird thing was there was no pop up asking for the memory access.

Deafult (ask) Interproces Memory Accesses = freezing my pc , hard reset necessary.

Manually allowing access to Interproces Memory Accesses = no freezeing

v5.0
Defens+ - Safe Mod
Sandbox - disabled

[Agent24]

Interesting, another person with a similar problem…

@EricJH post:13

You could consider updating to v5 and use Game Mode. Or when sticking to v4 put D+ in training mode when you run a game. Then either run the whole time you are playing a game in Training Mode or stop the game after a couple of minutes and put D+ back where it was (CIS will remember until you reboot).

As I said before I tried updating to CIS v5 but that did not help.

And as I also said before I don’t want anything to have rules automatically created for it. That is the reason is use Comodo, so I can personally choose what I want, not what anyone else wants.

Clearly this IS some kind of bug or problem, as this other person also is having the same issue, and as I said before, this never used to happen before.

Interestingly I have also noticed something else, it does not seem to fully lock the computer.

Today I was also playing music in the background, and the music kept playing even though the keyboard wouldn’t respond and the monitors were blank.

[Citizen_K]

Does the following FAQ bring any solace to your problem?

@mouse1

There are a number of possible causes. Please run through these in order, as those later in the list may be more inconvenient or have greater effects on your security.

[ol]- The application maybe sandboxed, possibly without your knowledge. When processor load is high, some sandboxed applications may be sandboxed without alerts or log entries. However they will normally appear either in Unrecognised Files or, if still running, show as sandboxed in the Active Processes List. Just remove these files from the sandbox by making them trusted or other methods as described here.

• You may have made an application trusted but not fully re-started it. Sometimes a computer reboot is required.
• The application may be an early loading application, which CIS has not sandboxed but has not been able to make trusted. To identify such files look on the Active Processes List in Defense plus for files with status=unknown and sandbox=disabled. Use the right click menu to make these trusted and reboot.
• The application may hook into the operating system in ways that conflict with CIS. The problems with many such applications can be resolved by making them exceptions on the Defense+ ~ Defense+ settings ~ Image execution control ~ Exclusions (from buffer overflow protection) list. This works with Daemon Tools for example.
• The program may require greater permissions that those held by trusted files, but be unable to ask for them. To get round this apply the installer updater predefined policy to all executable files in the program’s directory, and any other executable files you know it uses, using Computer Security Policy ~ Defense Plus Rules ~Add. Remove the same files from trusted files, and any other entries for these files in the computer security policy ~ Defense plus rules. Then reboot. For security reasons do not do this for applications that you will use to run other unknown files.
• If the program uses cmd.exe in some way (as for example terminal programs may) you may be able to solve problems by excluding cmd.exe from buffer overflow protection as described above. This works for WINSSHD for example.
• Use ‘Run the program in the sandbox’ (not ‘Always sandbox’). You may need to experiment with the sandbox security level - start with partially restricted if you trust the app. And virtualisation level - start with unvirtualised (in sandbox settings) if you trust the app. You may be able to make this more convenient by creating a specific directory containing just a short cut to the main program file concerned, but try it without this first.
• Disable guard32.dll or guard64.dll which you will find in c:\windows\System32 or System64 by renaming it guard32.disabled and rebooting. N.B. Disabling guard32.dll removes some of D+'s ability to protect you from security risks. So this should be a last resort. [/ol]

Please note that the following program(s) are known not to work with the current version of CIS without disabling whole modules: Alcohol 120, Virtual Box.

Many thanks to all who have discovered, helped discover or confirmed these fixes work-arounds, especially Rickrev, Endymion, SwissSteph, and Sderevyanko.

[game21a]

I don’t see what could help me from this faq.

I don’t use Sandbox, and Rapidshare Manager Or The Witcher they don’t need greater permissions that those
held by trusted files.

I tested it on another game Dragon Age: Origins , and the same thing happened.

Interprocess memory Access - aks = frezze

Interprocess memory Access - allow = no freezing

This is something that never happened in the v3.14

I really think you should investigate this a little bit.

[Agent24]

game21a:

When your game freezes, does the audio keep playing OK as mine does?
Or does the sound stop or loop?

[game21a]

@Agent24 post:18

game21a:

When your game freezes, does the audio keep playing OK as mine does?
Or does the sound stop or loop?

There is no sound.

[Agent24]

This is interesting. I have just found out that this problem doesn’t happen on XP, but it happens on Windows 7.