Here is another leak test for our BETA testers - CPIL2

Hi guys,

We have just created a simple leak test, CPIL v.2. CPIL2 is an example leak test whose bypassing techniques are actively being used by many trojans in the wild. This is not a new technique that we found. It was there in the wild. So we wanted to give the community a chance to see how strong their firewalls are, and allow them take an immediate action if necessary.

CPIL2 is still in its early BETA stage and will be developed more in the future. So feel free to share your opinions.

Good luck,


[attachment deleted by admin]

You need OSMODE=3 for this to pass the test, right?

No that does not matter. CPF should pass it both modes.

CPF 2.2 does not pass this test I tried it, or am I doing something wrong?

Well I tried but test failed to run.

[attachment deleted by admin]

The instructions state:

If the test succeeds, you will see your data on the Comodo website

However when I get to your site with the data I entered it says I failed the test.

Which way is it?

This means you passed the test.No problems.

Thanks egemen for the reply. Running CPL 2.3 beta with os 3 enabled. Love it. ;D

If the test suceeds, internet explorer will be opened and you will be redirected to comodo site which should show you the data you entered.

If program fails to start or CPF shows you a popup, this means test fails. CPF 2.0-2.3 should be passing this test with no problems. It may be a case that with OSMode = 3, CPF may not detect this because it is problematic. But i dont think this will be a case.



For me:

OSMODE=0 The test succeeds.

OSMODE=3 The test fails.

btw… Shouldn’t ‘succeed’ mean CPF stopped the threat and ‘failed’ means it did not?

To pass the test,

You should see either of the screenshots in the attachment. The test may say it suceeded, but if you see an alert from CPF like the attachment, you pass the test. If you see “can not initiate the instance” message, it also means you passed the test.


[attachment deleted by admin]

With OSMODE=0 the threat is not blocked. I get to your website with the text I entered.

Using OSMODE=3 the threat is blocked. I get the message in the DOS box that the ‘Test Failed’. I do NOT go to your website. In fact my browser doesn’t even open.

An earlier post of mine questioned whether I needed to set OSMODE=3 for the threat to be blocked. You said it didn’t make a difference whether I used OSMODE=0 or 3.

In my case I had to set it to 3. OSMODE=0 did not block the threat.

Interessting, it missed the first letter from the sentence. Right now, i’ve tried with another firewall, which may come in hand when you wanna compare: Rising Personal Firewall.


Something must be wrong with your CPF. Can you test your CPF with OSMode = 0 against all other leak tests? Lets see what is wrong.


I rebooted with OSMODE=0 and everything seems to be working now!

I ran CPIL2, leaktest1.2, tooleaky, firehole, and yalta. All were blocked by CPF via popups where I replied DENY.

One thing of note was that when I was using OSMODE=3 I did not get any popups from CPF at all. However the threat was blocked as indicated by the ‘test failed’ message in the DOS box and the fact that no browser window came up.

When I ran CPIL2 using OSMODE=0 I got 2 popups when the test started to which I replied DENY to both of them.

All the other tests resulted in popups no matter if I used OSMODE=0 or 3. It was only CPIL2 that behaved a little differently depending on the OSMODE I chose.

I would imagine that there is still cause to be concerned. OSMODE=0 was letting the threats get by yesterday when I reported the problem. Why they cleared up today is a mystery.

hi egemen,

I wonder if this is just a cached data or a failed leek test:
I’ve opened HyperSnap;
i let it to search for updated version;
i’ve close it;
i’ve reopen it and told to search again for updates: i didn’t click allow/deny (it remained active);
i’ve opened another HyperSnap instance which was able to show that there’s a new version over the Internet;

I strongly belive that this is just a HyperSnap solution (fe. from the first check it stored that data somewhere) but i also wonder if you could ensure me :). Anyway, this data will be good for the FAQ at least (V)

(Also, there was a - couldn’t reproduce - bug with the specified “parent” (setup.exe).)

This may be because of a couple of reasons:

1- Hypersnap may be recognized as safe and automatically approve safe apps are selected,
2- Hypersnap may be showing the cached data(this is more probable)
3- Parents of the instances are different and one is recognized as safe



every once in a while, I like to go back and redo different leaktests. Today I tried CPIL2 and it no longer works at all. I get the following even though I’m running as admin. Any ideas what might cause this?

Do you want to proceed (Y/N)? : y

Enter the text to be transmitted : cccccccccccccccccc
Could not initiate an instance. Make sure you are running as Administrator.

Test failed.

Thanks, Al

With CPF beta versions, this is an expected behavior. It blocks the harmful activity.

Not only Comodo stop CPIL2. Proactive module form KAV6 also stop it.