HIPS lock some installers in memory and doesn't ask for anything [v6]

Egemen referred me to here from FB.

A. THE BUG/ISSUE (Varies from issue to issue)
[ol]- Summary - Give a clear summary in the topic subject, NOT here.

  • Can U reproduce the problem & if so how reliably?:
    Random, depends of what kind of app I’m trying to install. Ej: Harddisk Sentinel and other diagnostics apps were the first giving me problems. There are many others I cannot remeber right now.
  • If U can, exact steps to reproduce. If not, exactly what U did & what happened:
    a. Tried to install “x” app. Nothing happens
    b. Opened Windows Task Manager and the process is there in 0% of activity.
    c. Tried to kill it, that was impossible. Tried installing again and the same above ocurred lefting 2 processes.
    d. Then I tried to restart, PC hangs restarting so I have to restart it “manually”.
    e. I Disabled HIPS after reboot and all installed normally. I have admin rights, and also executed all as admin by the way in the steps before.
  • If not obvious, what U expected to happen:
    I expected my apps installed normally and HIPS asked me if it needs to do so.
  • If a software compatibility problem have U tried the conflict FAQ?:
    No, it isn’t.
  • Any software except CIS/OS involved? If so - name, & exact version:
    Windows 8 64bit and the intallers I ran.
  • Any other information, eg your guess at the cause, how U tried to fix it etc:
    I think it’s related to the new admin rights and how Windows 8 manages it, I have UAC disabled and I still need to execute as admin some programs so they can write folders like %appdata%. HIPS doesn’t let me to install programs, sometimes executing them they do nothing but reside in memory.
  • Always attach - Diagnostics file, Watch Activity process list, dump if freeze/crash. (If complex - CIS logs & config, screenshots, video, zipped program - not m’ware)

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- Exact CIS version & configuration:
CIS 6.2.285401.2860 Build 2860, Internet security config

  • Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV: HIPS=clean pc, Auto Sandbox disabled Firewall=safe mode&creating rules for safe apps, AV=stateful, Cloud lookup=off.
  • Have U made any other changes to the default config? (egs here.):
    Yes, Firewall alerts set to very high and create rules for safe apps when there’s an option to select it.
  • Have U updated (without uninstall) from a CIS 5?:
    [li]if so, have U tried a a clean reinstall - if not please do?:
    Tried a clean reinstall also.
    [/li]- Have U imported a config from a previous version of CIS:
    Yes, the v6 before the advanced view update.
    [li]if so, have U tried a standard config - if not please do:
    Yes, internet security.
    [/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
    Windows 8, 64bit, UAC=off, admin rights.
  • Other security/s’box software a) currently installed b) installed since OS:
    a=None b=None

It’s my first time reporting a bug here, I hope I did it well enough to inform you with the necessary details. Also HIPS has a interface bug in tray menu, sometimes appears and sometime disappears, so I think I need to create another separated thread, right?


[attachment deleted by admin]

The formatting in your first post was mostly correct. However, for next time, please just copy in the code from here and just type your answer after the colons. The code will take care of the rest. I already edited your first post into the proper format, but I just wanted to let you know for future reference.

Also, please attach the KillSwitch process dump to your first post. If you are not sure how to do that please feel free to ask.

In addition, can you please answer B2. It’s possible I missed your response when editing your first post, but either way please edit the post to answer that question.

In addition, can you please find a single app which this works for every time. Then, edit your steps to reproduce the issue for those applicable to that particular app. That should be very helpful for reproducing this and thus getting it fixed.

As for the other bug about the disappearing menu, does what you are seeing match what is reported in this bug report?

Thank you.

Thanks for your replay Chiron. How do I attach the KillSwitch process dump? About reproducing the issue is difficult for me to create an specific and exact scenario for that, I used HD sentinel portable right now and it worked ??? I’ll try to find some app which I can reproduce the bug many times and post it back. Also, mounting and unmounting drives with apps like Daemon tools lite or UltraISO sometimes freezes the explorer when HIPS is enabled.

Please put it in a zip file and attach that zip file to your first post.

Okay, now I understand it better. It would be best if you could find an app which always reproduces this. However, if you cannot do this then the other option is to provide the devs with enough information to fully understand what’s going on at that time. For that please have KillSwitch open, right-click on any of the running processes, select “Create Dump”, and select “Create Full Dump”. Then, upload that dump to a file sharing site, such as this one and paste the download link in your first post.

Please let me know if you have any questions.


Okey, I think I didn’t express myself correctly. I figured out that I needed to install Comodo KillSwitch (I’ve never used it before). So, do you need a full process dump from that “x” app when it is giving me problems, right? About the post of the GUI HIPS menu, I did what I supposed could reproduce the bug right now and it didn’t happened, but is more or less the same from the post you mentioned. I’ll be trying to find out exactly how to reproduce each bug and I’ll report it back. Thank for your support.

Sorry, to get to KillSwitch first open the main CIS GUI. Then, click the green arrow in the upper-right-hand side to go to the tasks side. Then click on the section for “Advanced Tasks” and select “Watch Activity”. This will open KillSwitch, although if you have not yet run it, it will first have you download it.

Yes, a full dump from KillSwitch while it is acting up should provide the devs with enough information.

To help keep things easier to follow let’s restrict all discussion about the other bug to your other bug reporting topic. This will make it easier for the devs, and other users, to follow and understand the issue.

Thank you.

Have you been able to replicate this yet, so that you can get the full dump?

No, I’m still enabling and disabling things I usually do, but still doesn’t happen. It seems like posting here has fixed my issues. ??? I’m installing and uninstalling, executing all kind of stuff usually was giving me problems and nothing has happened yet. I’ll keep working to find and replicate the bug and once I’m able to get it I’ll report it back.

Okay, let me know if the problem returns. Also, as it may be an intermittent problem, be sure that if it does re-appear that you remember to create a full dump with KillSwitch while the installer is locked.


PM reminder sent.

Okay, as it appears that this issue has solved itself, or at least for whatever reason is no longer occurring, I will move this report to Resolved.

Please contact me via PM if the issue returns and you are able to complete the report.

Thank you.