Hello.
I really don’t believe that killing the process will make a log that shows the real cause of this issue. The issue has occurred and gflags didn’t created a dump about a crash…
This is making me really sad.
I always used Comodo, since version 5.x and this never happened before.
If it was a crash, the Windows Logs should show me in their logs. I don’t think it is a crash. My program doesn’t hangs up or anything.
I don’t use any troublesome applications.
I’m losing my hope here.
What I meant – if it gets killed by another process.
Additionally, you could add other rules.
If you’re not getting any dumps then it’s not a crash. It’s something else.
You could use KillSwitch to create full dumps if you get unusual CPU usage and other suspicious behavior. Multiple (full) dumps are recommended.
If you want in-depth analysis then you might have to monitor each process for first-chance exceptions. It’s most likely related to one (due to injected drivers, etc).
OR it might be related to insufficient rights (certain limits, software, etc). I’m guessing.
I suppose that isn’t a crash. It is a bug. But I don’t know what causes it. It’s completely random.
Hello Ericjh!
First of all thank you for your answer.
After the last post i did a windows 7 clean installation and of course i did a clean installation of comodo firewall too, but this time i installed the latest version 8.2.0.4674.
As soon as i install the firewall i configure firewall and defense+ hips with the same parameters as i mentioned in the previous post.
In oder words in advanced tasks>open advanced settings in safety configurations both the firewall and the defense +, i select the options “create rules for safe applications”.
I select the “safe mode” for hips and “set of custom rules” for firewall rules. After that i change the level of firewall alerts to “medium”.
As soon as i install all the other applications that i use i will give or blocking permission according my preferences.
Despite this, the problem with comodo hips rules still persists.
Sometimes comodo hips asks me again permission for the same application that i had previously accept or decline permission.
I should mention that in the past i made a backup of comodo configurations and import later to the new installation, but later it seems to me that is not the best policy to apply in the new installation. Am i right!?
So this situation is a little bit annoying.
What can i do besides format and reinstall windows 7 and all updates?
Because this is a daunting task
Thank you again for your help
Importing a saved configuration is a workaround in your situation. The problem is that cmdagent.exe or cis.exe is crashing which may in turn sometimes cause loss of rules.
Key is now to see if we can get the crash logged as preparation for a bug report. Can you check in :\ProgramData\Comodo\CisDumps if there are crash logs? Can you also check the Windows logs to see if it logged crashing of Comodo Internet Security Helper Service?
Hello Ericjh.
I researched the logs you mentioned in post in the c:\ProgramData\Comodo\CisDumps, and i found an empty file with 0kb.
I opened the file with notepad to see if it as something there, but i couldn’t found nothing in this file.
I don’t know if the method I used is the most appropriate to open the file.
If the file contained something was supposed to be able to view the content even using Notepad. right!?
In the windows event viewer i navigate through the tab “windows registry” and “services and applications registry”, in this tab i found “comodo internet security CEF” and “Comodo Internet Security Trace”.
On the “comodo internet security CEF” i couldn’t found anything and in the “Comodo Internet Security Trace” i found one information message not a warning message or error message.
What can i do more to discover the problem!?
By the way this problem also occurs in two machines, one is mine and the other is a friend of mine lent to me.
Both computers have the same windows 7 ultimate 32bits and all the antivirus “avast”, antispyware “spybot” and "antimalaware-bytes"and “advanced system care” all latest versions available.
When the file is empty then we will it be.
In the windows event viewer i navigate through the tab "windows registry" and "services and applications registry", in this tab i found "comodo internet security CEF" and "Comodo Internet Security Trace". On the "comodo internet security CEF" i couldn't found anything and in the "Comodo Internet Security Trace" i found one information message not a warning message or error message.Could you also check under Windows Logs\System\ in Event Viewer and see if there are logs of Comodo Internet Security Helper Service having crashed?
What can i do more to discover the problem!?What version of Spybot do you have in stalled? Does it run on demand or in the background. Are malwarebytes and Advanced System Care running on demand or in the background?By the way this problem also occurs in two machines, one is mine and the other is a friend of mine lent to me.
Both computers have the same windows 7 ultimate 32bits and all the antivirus “avast”, antispyware “spybot” and "antimalaware-bytes"and “advanced system care” all latest versions available.
Can you post a screenshot of the Defense + Logs?
I´m having this problem too, however i´m not using any additional antivirus besides comodo. And i´m not gettin dumps or cmdagent crashes in the event logs.
[attachment deleted by admin]
A. THE BUG/ISSUE (Varies from issue to issue)
HIPS rules disappear randomly, most of the time under SAFE mode. I´m changing to Paranoid to see if it fixes the problem.
Can you reproduce the problem & if so how reliably?:
It happens randomly, so i can´t reproduce it reliably. It think it mostly happens if HIPS is in safe mode.
If you can, exact steps to reproduce. If not, exactly what you did & what happened:
1:Set HIPS to safe mode
2:Reboot
3:Randomly HIPS rules disappear.
One or two sentences explaining what actually happened:
HIPS rules disappear, sometimes.
One or two sentences explaining what you expected to happen:
Not disappear?
If a software compatibility problem have you tried the advice to make programs work with CIS?:
No advice has been given.
Any software except CIS/OS involved? If so - name, & exact version:
No other security/antivirus running in the background.
Any other information, eg your guess at the cause, how you tried to fix it etc:
No idea.
B. YOUR SETUP
Exact CIS version & configuration:
CIS 8.2.0.4703, Proactive Security.
Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
HIPS: Paranoid, AV: stateful, FW: Custom Ruleset, Autosandbox: active
Have you made any other changes to the default config? (egs here.):
Nope.
Have you updated (without uninstall) from CIS 5, 6 or 7?:
Yes
if so, have you tried a a a clean reinstall - if not please do?:
Yes
Have you imported a config from a previous version of CIS:
Yes
if so, have you tried a standard config - if not please do:
Yes
OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 7 Ultimate, SP1, 64bit, UAC: disabled, admin, no vm machine.
Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
No other security sw is running in the background besides comodo.
[attachment deleted by admin]
Hello everyone.
I had similar problems with my comodo firewall hips.
This situation is occurring randomly both during the time that I was working normally with the PC, such as during system restart or shut down process.
I noticed that something is wrong with the comodo firewall software because from time to time the hips asks me again and again to allow or deny permission for the software that i previously answer before.
So it’s annoying to had to answer again and again for the same programs that i previously allow or deny.
Even before i shutdown the hips functionality i tried to export and import the configurations but didn’t work because as soon as i import the configurations and went to the hips rules, there was no one rule there.
Given this scenario, I had to completely shutdown this functionality.
What could we comodo users can do for the developers team to solve the problem?
I used this software since version 5 or 6, and i love it because the software gives you the power to control all incoming and outgoing connections plus the ability to protect your windows registry from any attempt of some software make changes to them.
Any help would be much appreciated.
I am experiencing the same issue since recently. I am using Windows 10 Pro 64bit, COMODO Firewall 8.2.0.4703.
Recently, I restarted my computer. After logging in, I was greeted with a black screen and only my white mouse cursor. HIPS alerts started showing up, asking me permission for System and other system programs to create files, run elevated levels, etc. So my HIPS rules seemed to have been wiped.
There is another Windows 10 bug that will get you the black screen and mouse cursor and I thought that was my issue as well. (video drivers need updating). But when this black screen happened for the 3rd time, with the same HIPS alerts being wiped, I realized there might be a COMODO problem as well. Doesn’t make sense for video driver problems causing HIPS to lose it’s settings.
Today, I realized it was explorer.exe that was not starting. I’m not sure if COMODO is causing explorer.exe not to start on restart, or how the 2 problem connects, but I at least have the problem of HIPS losing it’s RULES on restart, as in the bug report here.
Well, under Paranoid mode, rules don´t disappear so far.
Long standing bug. Or at least on v8, no idea about earlier since I only started using it in January, but it’s been happening all along. It’s not quite random though, it seems to happen if you save a change shortly before reboot or if it otherwise times out on saving a change.
I’m really guessing here, had just logged on to post about it since it just happened again, but seems that settings saving can time out if there’s too much or it’s otherwise busy, no idea why, in which case it may try again later or require the user to hit ok again, no idea what would fix it…
But basically:
Oddly, if I check the file, I see HIPS settings in it. So no idea what’s going on. I tend to leave some exported settings “breadcrumbs”, just to be safe. But it really is an issue, especially since settings for system processes poof when this happens as well and that sure messes things up.
Well, not for me.
It started after the last windows update. After that one HIPS was forgetting its rules 2 times now.
I was setting it to training some min before restart (something was slowing down the shutdown of windows) restarted, was setting it to paranoid - poff rules where gone.
2. time right now. Was updating comod, rebooted, all ok, all new rules there. Was starting a programm in training mode, was closing it, settings toparanoid. Hips was asking for something, i said what it shoudl save, HIPS asked me to allow stuff related to comodo and HIPS.
Hips should know it - training mode…
Looked into the HIPS-Rules - all gone. Not with the reboot but just somewhere in the middle…
Either something is corrupted or one of the windows update was flipping* things up. Not shure right now…
Well it´s been almost a month and under paranoid mode, rules don´t go away. Not even once.
Hello friends.
This problem really is annoying indeed.
My COMODO Firewall STILL giving me this problem.
What have I done to “temporarily fix” this problem was: Performing a backup of my settings whenever I allow or deny any application. Then just import the previously saved settings, activate them and delete the old settings. But as I said, this is a “temporary” fix, because sooner or later the problem will happen again.
With me the problem occurs in any of the Windows boots. It’s not always that happens. Sometimes takes a week. Sometimes two reboots of the system (as if you need to reboot several times due to program updates or drivers).
I followed the guidance of the administrators of this forum but unfortunately did not result in anything. 
I use Comodo since its version 5. I went to 6, great, still worked perfectly, but then went to version 7 and I dare to say it was from this version that the problem appeared.
I will continue to use the COMODO Firewall, but I’m sad about this problem.
I hope I helped you with my “temporary fix”. It works for me. Whenever HIPS ask about any program or even on Windows own applications, just import the settings that were previously saved, activate them and delete the old one.
Regards.
I’m afraid that we may need more data on this one to be considered by devs.
For now, please attach a configuration.
@rotulos1, did you notice any other unusual behavior?
A list of installed programs might be helpful…
No, no other unusual behavior. And here you have my current CIS config and a list of installed software.
[attachment deleted by admin]
Did you check junction points? Just wondering if that might be the cause.