Windows 10 Pro 22H2 x64 / Comodo Free Firewall 12.2.2.8012
CCleaner’s notorious auto-update function is bedeviling my firewall in a weird way. In the past I’ve disabled the CC function by renaming the updater exe to CCUPDATE_go_away and that’s worked. I think it still works, except that after manually updating CC recently the firewall flagged a connection attempt before I was able to do so – so at least once the original file CCUPDATE.EXE tried to get through (and was denied).
Since then, after renaming the file, it keeps popping up a firewall connection alert – even though the alert reveals that the file / process ID itself does not exist / cannot be found. I’ve retained BLOCK/TERMINATE/REVERSE as a response but the hits keep on coming.
I’ve scanned all Firewall / HIPS file entry lists, purged them, and cannot find a reference to CCUPDATE.EXE; I’ve scanned my system and registry and found nothing either. Nevertheless Comodo keep responding to… something. So there must be some retained reference somewhere.
I don’t know if that reference is within Comodo or my Windows system / profile, does anyone have a clue as to where it could be lurking – so I can delete it too?
THX, but this method allows blocking of the CCUPDATE executable when it is present with its original name – I’ve renamed the file to a nonstandard / meaningless thing (ccupdate_go_away) so the question is really not how to block it but where is the reference to the original ccupdate.exe located now that the file does not exist?
Yes, as noted in my OP I scanned Comodo’s settings and logs as thoroughly as I could and the updater is not present – as Comodo itself indicates when the alert says process not found.
It is possible – unlikely as it makes little sense, but still – that another CCleaner executable(s) is responsible for the weird re-firing of the update alerts: CCleanerreactivator and/or CCleanerPerformanceOptimizerService. Both are supposed to be active only in the paid version of CC, which I do not have, but playing the rename game with those files seems to have stopped the updater activity, at least over the last day or so. Will see what happens over the next few and report back
