firewall keeps asking for permissions [resolved]

I have tried uninstalling and reinstalling but Comodo Firewall keeps askiing permission for various programs even if I check the remember my answer box.

That is normal; Comodo allows/denies applications not only based on the applications’ name, but also the parent application.

If, for instance, you start Firefox by double-clicking an icon on the desktop – you get explorer.exe as the parent. Then, if you start Firefox by clicking a link in Thunderbird, you get thunderbird.exe as the parent. If you start Firefox from a launch toolbar such as Launchy, you’ll get that toolbar’s name as the parent.

Some processes, e.g. svchost.exe, acts as the main ‘switching point’ between several ‘services’; some of these ‘services’ may attempt to open a listening port. Each attempt at opening a listening port causes an alert.

If you want to reduce the number of alerts, first of all you must make sure that the application is trustworthy. Then you can go into Application Monitor and double-click the rule re: the application, and make sure to ignore the parent application.

the program isn’t listed under application monitor. every time i launch a game, internet explorer or incredimail. I have to check the box to remember my answer then allow it.

Hi plprivett
What’s the name of the program that isn’t listed in application monitor?

Internet Explorer and Incredimail are two. I’ll check for more. Thanks all.

Thats strange. Browser, email, antivirus etc are usually set up with correct rules on install. Did you run “Scan for known applications” in security-tasks.
In most setups there will be more than 1 rule in application monitor, as pepoluan pointed out, for some programs.
Take mine for example
Firefox has 3 rules
1 Launched from the desktop icon (windows explorer is the parent)
2 Where I,ve clicked email links ( the email prog is the parent)
3 Another one for my belarc advisor (rundll32 is the parent)

We might need you to post a screenshot of your app mon rules.

https://forums.comodo.com/index.php/topic,6770.msg49566.html#msg49566

I scanned for known applications and it added a few but it still keeps askiing for permission. Thanks for the help.
http://img264.imageshack.us/img264/3148/20070430093747rz9.th.png

Can you please check this thread:

Thanks everyone for your patience and help. I think that resolved the problem. My appologies for not finding that post.

Don’t sweat it. Just be sure to check the FAQ in this forum, for further issues.

Problem is back. I’ve tried just about everything I can think of. Thanks for all your help. Maybe I should switch back to ZoneAlarm?

What did you try? Alerts to very low?
Did you read the thread through? Comodo is alerting to different things, you should look at the ABA options (App Behavior Analysis) to see what Comodo is doing. Sometimes the alerts seem the same, when they are not.
You can even try to disable ABA, and put component monitor ON or Learning Mode. You’ll see the prompts disappear. Afterwards you can decide whether you want it or not.

i would say avoid ZA… ;D

plprivett
I don’t see much at all in application monitor from your screenshot.
Incredimail, outlook express and a couple of others. I’ve reinstalled cpf about 4 times now (due to problems caused by myself ;D) and the scan has never missed ie, firefox etc.
For a test, add a rule for internet explorer manually.
Appmon-add-browse to c:\program files\internet explorer
Skip parent check
allow all activities
We’ll see if it will hold that rule.

I’m with Pedro* an ex za user of many years and for myself I wouldn’t go near it again.
There are some issues with za uninstall that can cause problems when installing other firewalls
http://www.greenwood.iwarp.com/sgcomputer.html
http://forums.zonealarm.com/zonelabs/board/message?board.id=inst&message.id=63136
https://forums.comodo.com/index.php/topic,7369.msg55486.html#msg55486
The first one has a link on the right side of the page for zfix.zip, have not used it myself because za ■■■■■■■ my system that bad had to do a fresh install.

Regards
Sullo

Thanks again for all the help. I really like Comodo and have heard nothing but good things about it so I was disappointed when the problem arose. I did however run zfix and it seems to have helped. I’ll keep you posted.


http://img263.imageshack.us/img263/7813/20070501001706qc9.th.png
These are the only applications Comodo will remember.

Still doesn’t look right, it’s a bit difficult not knowing what apps you have.
No antivirus.
Can you browse without alerts with the rules as they are.
What’s the last one, the generic windows icon?
Maybe incredimail is not in the known apps and needs to be added manually :-\

I realise you must be getting a bit frustrated but, I would try one more clean install.
Use link 2 in my last post to make sure za is all gone, hopefully zfix got it all.
Uninstall cpf
If you are have trouble removing cpf see this
https://forums.comodo.com/index.php/topic,5326.msg39350.html#msg39350
I would at this stage run a registry cleaner. These apps can be very dangerous if you make the wrong move so due care needs to be taken and always have a backup, both of the progs below will make a backup.
Ccleaner is fairly light, have used it for quite some time without problems.
Regseeker is a bit deeper but does a better job (I only ever choose green ticked entries for deletion). If you use either of these just select entries for za.

www.hoverdesk.net/freeware.htm (regseeker)

Run anti malware and virus scan
Defragment the hdd
Install cpf in automatic mode and run scan for known apps
Your’ve probably seen these but I’ll stick em in anyway
https://forums.comodo.com/index.php/topic,4766.0.html
https://forums.comodo.com/index.php/topic,6653.msg48946.html#msg48946
https://forums.comodo.com/index.php/topic,4657.0.html

Don’t forget to let me know what that last entry is

Regards
Sullo

Followed the above steps and here are the results. I have no idea what that icon is. I hit the submit to Comodo button and it said there was trouble compressing the file.
http://img265.imageshack.us/img265/8181/20070501020426so6.th.png

Nothing seems to make sense.
The first screen shot shows cpfupdate.exe as it should. The second does not.
The rules for ie in the second shot look the way I would expect them to.
We need to find what that unnamed process is.
Use task manager (ctrl-alt-del) process tab and see if there are any unnamed process in there. Just make sure you don’t accidently hit the end process button.
Did you download a new copy of cpf or did you use one you already had on your system?
What apps do you have on your system that need net access? Need to check and see if cpf should have picked any others up.
What antivirus do you have?
What realtime scanning anti spyware, hips or registry monitor software?
Realtime scanning apps and antivirus progs can interfere with program installations.
You have win xp sp2, fully updated.

I really appreciate you sticking with this.
I’m going to pm some of the mods to get them to have a look.

Regards
Sullo

Your AM rules don’t look weird to me, except the last one that’s invisible. :o My first thought was: faulty installation. Even if this has already been pointed out, please ensure that no other (security) programs are running during the installation and that other firewalls are not installed (including disabling the Windows one). Actually, I think this is the 2nd reported case of something like this, though I don’t remember which thread it was.

Here’s what you can do to perhaps have a clue on what that blank program is: delete that AM rule and when it attempts to connect again, deny on the alerts with the Remember option enabled. Then export your log by right-clicking in the Log window to HTML. Edit it with MS Word, notepad or your text editor of preference to blank/mask any private IP addresses. Finally, upload it that log here as .txt or other document format by clicking on the Additional Options… at the bottom left corner when posting comments in this forum.

Edit: Reading back on your earlier posts and screenshots, I’m thinking that programs such as IE7 asked for a 2nd alert even after you enabled the remember option on the first alert is probably due to the TCP loopback check (“IE7 is trying to act as a server”). If you don’t run any proxy server then enable the skipping of this check in Security > Adv > Misc > Config…

I appreciate all of the help. I couldn’t access the internet if I blocked that app. and I couldn’t identify it either so I just reformatted and did a fresh install. Comodo first this time. So everything is working fine now. Sorry I didn’t stick it through till the end and find a solution for someone else but I was in over my head. Again, thanks for all the help and time. Paul.