Enabling previously denied rules?

Hi all

I had to reinstall CFP as when a alert come up about outlook i clicked deny (by mistake). This then resulted in not allowing any outlook connections (POP) to the internet.

To try resolve this problem I then deleted the application in Application monitor then added it etc etc. but nothing. So i reinstalled.

The log file did indicate that a pop connection was denied.

So my question is: Is there a way to view what you have presiouly denied and re-enable them?

regards,

Paul

Welcome to the forum paulm,

In Application Monitor it should show the app as being blocked. Next time try deleting all the entries for Outlook in Application Monitor again but this time don’t add them back and see if that helps. You should get a prompt for it then.

jasper

Hi Jasper

Thanks for the repy.

I have tested this with another application (statbar).

I tried to do an update through the application, CFP prompted to allow connectivity and i clicked “Deny”. No new entry has been added into Application Monitor indicating that it has been denied.

Does it take a while to refresh?

Here is the log entry:

Date/Time :2007-06-12 15:32:21
Severity :Medium
Reporter :Application Monitor
Description: Application Access Denied (StatBar.exe:196.43.1.11: :dns(53))
Application: C:\Program Files\Globe Software\StatBar\StatBar.exe
Parent: C:\WINDOWS\explorer.exe
Protocol: UDP Out
Destination: 196.43.1.11::dns(53)

Regards,

Paul

Hi Paul, welcome to the forum.

I deleted your other thread because it was a duplicate. Please don’t post the same question on different boards.

Outlook Express should be in the safelist. Security > Task > Wizards > Scan for known applications. It should be instant when you add/delete/edit an Application Monitor rule. Sometimes it’s necessary to restart the application or even reboot the computer to get it going.

Hi Soya

Sorry about the previous thread, I posted in the wrong section (FAQ) and not under help.

I tried but no success. Please verify that i am in fact looking in the right place for these denied application rules (Security → Application Monitor). In the Application Control Rules section, should the application that i" denied access to" be in here?

Sorry about the persistent questions…

Thanks

Paul

No probs, Paul.

That’s the right place. So you see no blocked (red x) in Application Monitor and even restarted the application and/or reboot without success? Do the logs still show that blocked entry? If so, the only thing I can think of is to reinstall with other programs disabled (safe mode is safest).

Have you checked Security>Component Monitor to see if there is anything blocked in there?

Unlikely, but possible.

jasper

On the subject of Component Monitor (CM), has anyone seen such entry in the log? I don’t think I ever have because most of the time mine’s on Learn mode, which auto allows almost every file.

Hi Soya

That is correct, no luck at all…

I’ll try and explain the senario is more detail (maybe i left something out)

I did a test with another application (Statbar) to see if it was just Outlook 2003 that had the problem. I tried to do an application update of the software (Statbar) and CPF prompted me to “Allow or Deny” the applications connectivity to the net. I clicked Deny (as a test).

No new entry was added into the Application Monitor section. It seems that only application that i allowed access are added into the Application Monitor section??

I know that the stabar is trying to connect and that Application Monitor is blocking it from the log entry:

Date/Time :2007-06-12 16:07:08
Severity :Medium
Reporter :Application Monitor
Description: Application Access Denied (StatBar.exe:196.25.1.11: :dns(53))
Application: C:\Program Files\Globe Software\StatBar\StatBar.exe
Parent: C:\WINDOWS\explorer.exeProtocol: UDP Out
Destination: 196.25.1.11::dns(53)

Really like this CFP, just wish i could get this section to work.

Thanks for the help

Regards,

Paul

Hi Jasper

The test application that i used does not use .dll’s or ocx files.

Nothing is refected in the Component Monitor.

Regards,

Paul

Hi Paul. I just remembered something (:SHY). A blocked Application Monitor rule (let’s call it AM for now) will only appear in the AM screen if the Remember option was enabled on the alert. Since you never mentioned that, that’s why it’s not appearing. Let me assume: the alert was something like x program tried to use y program to connect to the internet? It would greatly help if you can screenshot it, save it as a picture file, then upload it here in the Additional Options… at the bottom left corner that’s revealed when you’re about to post. It could simply be the parent check - if you deny on such alerts, the secondary program try to connect won’t work. This is a malware-preventative security feature (anti-leak, if you will). To get that alert again, you would close the program and restart it.

The CM is something else because that only refreshes itself like every 10 minutes, so you have to manually click on the Refresh button at top.

Hi Soya

In order to do this i will have to reinstall CPF go through everything all over again.

It just doesnt make sense ???

Why would there even be a remember option for a deny event? How does CPF know to block the application (access list file), is there no way to manually edit the access list?

I will try your recommendation later, as you are most probably right :slight_smile:

Regards,

Paul

I only suggested the clean reinstallation because I suspected a corrupt installation of CFP, but now that I remember the basic “remember” option you shouldn’t have to. The Remember option only appears on the AM alert/prompt when it asks you to Allow or Deny.

Maybe that alert can found here:
** FAQs/Threads - Read Me First **:

[b]Constantly Same Alerts / Doesn't Remember Rules[/b] https://forums.comodo.com/index.php/topic,6908.0.html

Hi Soya

I restarted CPF to see if it would prompt me again but nothing.

I will try the reinstallion option later :slight_smile:

Paul

Make sure it’s the same install file from the official download site:

If you have the XP firewall, make sure it’s really disabled and if there other firewalls to completely uninstall them.

Hi Soya

Im using this install file (CFP_Setup_English_2.4.18.184.exe) from Comodo’s site.

Thanks for all the help!!

Paul

Don’t thank me until the issue is resolved ;D

Hi Soya

I tested your methodology with another application. The remember my response section does come up and if i select it, it does in fact add it into the Application Monitor section!!! :slight_smile:

Ok, well ive learnt something new :slight_smile:

Is there a way to always have “Remember my response” always on?

Paul

I’m not sure what you mean - this is a bit self-contradictory because once you click on the Remember option, the alert (under the same conditions) won’t appear again because AM remembers your choice. Also, just to clarify something: when I posted about restarting the application to get the alert again, I meant the program trying to connect not CFP itself.

Hi Soya

  1. I am satified with CPF now and that i needed to know more about how the software operates.

Should there not be a way to edit CPF’s access list even if you didnt select “remember my response” prompt? The reason why im saying this is that i still have to try and fix the previuos application that i denied access to ???

Just a thought.

Paul