Files drop off from My Own Safe Files list (CIS 3.8.65951.477)

Files drop off from My Own Safe Files list (CIS 3.8.65951.477).

Some files end up frequently in Proactive Defense’s “file(s) are waiting for your review” list.

These files end up there even when I have moved them to My Own Safe Files (countless times) either in Proactive Defense window (Move to My Own Safe Files), or in Defencse+ My Own Safe Files (Add - Browse Files).

Please note. The files do not change constantly, just occasionally, and changed file is not in this case the not reason for dropping off from My Own Safe Files list, and reappearing again in Proactive Defense’s “file(s) are waiting for your review” list.

It happens with these three files. User names and profile names are obfuscated (below):

G:\Documents and Settings\User_Name1\Application Data\Mozilla\Firefox\Profiles\ixbwyok1.default\FlashGot.exe

G:\Documents and Settings\User_Name2\Application Data\Mozilla\Firefox\Profiles\5u1hnnok.default\FlashGot.exe

G:\Documents and Settings\User_Name3\Application Data\Mozilla\Firefox\Profiles\tl32tfm1.default\FlashGot.exe

It would appear that CIS loses its integrity keeping these files in My Own Safe Files list.

Whenever I launch Mozilla Firefox (3.0.8. FI), CIS puts the files in Proactive Defense’s “file(s) are waiting for your review” list.

I frequently launch FF using the Run As option (with two different user names). (Login into Admin Account, and then use Run As limited user account.)

For one user, I launch FF straight (without the Run As option). It results in the same issue.

Have attempted to add these file names to My Own Safe Files also via Defense+, unluckily without much success. (Sometimes they appear to stay there a while, and then drop off the list of My Own Safe Files again and again.)

Firewall Safe Mode
Defense+ Clean PC Mode

WXP SP2 32 bit + all Hotfixes
Kaspersky Anti-Virus 2009 (8.0.0.506)
WinPatrol [PLUS] 16.0.2009.0 (FI)

Have an optional configuration of WXP SP2, where

  • System and [application] programs reside on drive D
  • Only the Documents and Settings directory reside on drive G
  • Only Windows Page (Swap) file resides on drive C

Thanks in advance for prompt response.

Peter

This is a very annoying bug in CIS.

Every time I launch the Firefox browser, CIS moves this file to pending files.

Happens frequently (please read every time, over and over again) with all these files (same file, but individual file paths):

User names and profile names are obfuscated (below):

G:\Documents and Settings\User_Name1\Application Data\Mozilla\Firefox\Profiles\ixbwyok1.default\FlashGot.exe

G:\Documents and Settings\User_Name2\Application Data\Mozilla\Firefox\Profiles\5u1hnnok.default\FlashGot.exe

G:\Documents and Settings\User_Name3\Application Data\Mozilla\Firefox\Profiles\tl32tfm1.default\FlashGot.exe

More info about the file (a FF extension) can be found here https://addons.mozilla.org/en-US/firefox/addon/220

It is a very popular FF extension, 62,111,155 downloads (by Sunday April, 19 2009).

Am I the only one using this combination of SW, and to report this deficiency in CIS?

Peter

Do you get many pop-ups if flash.exe is in “my pending files”. Once flashgot.exe had all the required rules there should be no more pop-ups.

tcarrbrion,

RE: ‘Do you get many pop-ups if flash.exe is in “my pending files”.’

In the above, I suppose you mean “flashgot.exe” by “flash.exe”.

No, after the first pop-up, I do not get any subsequent pop-ups if memory serves.

RE: “Once flashgot.exe had all the required rules there should be no more pop-ups.”

Agree. However, what happens, is that “flashgot.exe” gets listed in pending files all the time over and over again even when I (every time) review it and move it to My Own Safe Files.

That is annoying. I would prefer that there are no pending files at all (after having moved any pending file to My Own Safe Files). I would particularly prefer not having any CLEAN or Safe files in Pending Files, which are considered NOT clean.

It would appear that there is a deficiency in CIS moving the same file(s) over and over again to Pending Files even when they have been reviewed by the user and manually moved to My Own Safe Files.

A SAFE file (marked explicitly as such manually by the user) should not get listed to Pending Files, which are considered “NOT clean” (or “not Safe”).

The flashgot.exe file has not changed. It is not moved to Pending Files for such a reason. The behaviour would suggest there is a bug in CIS causing this annoying issue.

Peter

I have certain things that always go to my pending files. I leave them there as it does not matter. It may be that if an applications opens a file for writing but does does not write anything the file still goes to my pending files.

I do wish there was an easier way to manage my pending files so multiple entries can be selected and removed in one go. This would make it a lot easier to use.

tcarrbrion,

It may be that if an applications opens a file for writing but does does not write anything the file still goes to my pending files.

It would appear that is the case with flasgot.exe too. The modify date of the file is always the time when FF launches. Nevertheless, I would prefer having an option of having this particular file stay in My Own Safe Files.

I do wish there was an easier way to manage my pending files so multiple entries can be selected and removed in one go. This would make it a lot easier to use.

Agree. Would you like to report this option in the Whish list?

Peter

tcarrbrion, Quote I do wish there was an easier way to manage my pending files so multiple entries can be selected and removed in one go. This would make it a lot easier to use.

Agree. Would you like to report this option in the Whish list?

Peter

Noticed that this option is already in CIS Whishlist. Please see theread at

https://forums.comodo.com/defense_wishlist/multiple_file_selection_in_my_pending_files_list-t29100.0.html

About the “bug” I reported. Like you anticipated and I already confirmed, it is not actually a bug. The executable is modified every time FF launches, so the file belongs to Pending Files.

Nevertheless, I would appreciate having the option to have this particular file stay in My Own Safe Files and not reappearing constantly in Pending Files.

Peter

Nevertheless, I would appreciate having the option to have this particular file stay in My Own Safe Files and not reappearing constantly in Pending Files.

Added “Option of having specific file(s) stay in My Own Safe Files (even after modification of file)” to CIS Whishlist at

https://forums.comodo.com/defense_wishlist/option_of_having_specific_files_stay_in_my_own_safe_files_even_after_change-t38156.0.html

Peter

Rephrased the wish “CIS should distinguish between actual file change and file being merely opened in modify/write state” (at https://forums.comodo.com/defense_wishlist/cis_should_distinguish_actual_file_change_vs_file_just_being_opened_for_writing-t38167.0.html) in order to avoid further confusion.

Peter