How do I fix this?

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
1

I originally posted this in the firewall help section, but thought it may actually be a Defense+ issue.

I recently updated to the new CIS 9.9 from Firewall Pro that I have run successfully since it was first released. Since the update, I have no longer been able to access previously entered data in forms in HTTPS sites when running both Firefox 3.5 and Internet Explorer.

Autocomplete functions through the browser have been turned on and has been working until the most recent update. I do believe I was running Defense+ in Clean PC mode prior to the update and have followed the suggestions here to run in Safe mode.

Entering data in forms as late as last night, while showing up in Firefox’s Autocomplete folder (have already deleted it and allowed it to recreate in case of corruption), yet I am unable to access the previously entered data (text fields).

How do I resolve this? Many thanks!

2

From what version did you update? I would suggest to do a clean installation of v3.9 and not importing your old configuration as there have been changed in the defaults of v3.9.

Do as follows (don’t delete the Legacy keys as they are a lot of work):

Uninstall CIS and reboot. Then run [url=https://forums.comodo.com/comodo_system_cleaner_fileregistryprivacy_cleaner/comodo_system_cleaner_116494436_released-t37631.0.html]Comodo System Cleaner[/url] to get rid off registry keys.

Then delete the Comodo folders under Program Files, Program Files\Common Files, C:\Documents and Settings\All Users\Application Data\ .
For Vista/Win7
Users%username%\appdata\local, Users%username%\appdata\roaming\ and \Users%username%\appdata\local\virtual store

To be even more thorough open Device Manager and set it to show hidden devices under menu option View. Then see if there are Comodo driver(s) left in non Plug and Play drivers. If so select the driver → click right → uninstall and reboot.

Now delete the following:
C:\boot.ini.comodofirewall (this file may not exist).
WARNING: Do not mistakenly remove the original “boot.ini”.
C:\WINDOWS\system32\drivers\cmdGuard.sys
C:\WINDOWS\system32\drivers\cmdhlp.sys
C:\WINDOWS\system32\drivers\inspect.sys
C:\WINDOWS\system32\guard32.dl

a. HKEY_CURRENT_USER\Software\ComodoGroup\CFP and HKEY_CURRENT_USER\Software\ComodoGroup\Comodo Internet Security
b. HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\CDI\1 *
*(If you have other Comodo products installed, delete only the values
for CFP)
c. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
\cmdAgent
d. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
\cmdGuard
e. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdHlp
f. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Inspect
g. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
\cmdAgent
h. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
\cmdGuard
i. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cmdHlp
j. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Inspect
k. KEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services
\cmdAgent
l. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services
\cmdGuard
m. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\cmdHlp
n. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Inspect
o. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdAgent
p. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdGuard
q. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdHlp
r. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\Inspect
s. HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\Firewall Pro
t. HKEY_USERS\S-1-5-21-1202660629-746137067-2145843811-1003\Software\ComodoGroup\CFP
u. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDAGENT *
v. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDGUARD *
w. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDHLP *
x. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_INSPECT *
y. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_CMDAGENT *
z. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_CMDGUARD *
aa. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_CMDHLP *
bb. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_INSPECT *
cc. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDAGENT *
dd. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDGUARD *
ee. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDHLP *
ff. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_INSPECT *
gg. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDAGENT *
hh. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDGUARD *
ii. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDHLP *
jj. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_INSPECT *
kk. HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\CFP_Setup_3.0.14.276_XP_Vista_x32
ll. HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\CFP_Setup_3.0.14.276_XP_Vista_x64
mm. HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\CFPLog
nn. HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\CPFFileSubmission
oo. HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\Firewall Pro

*Note: It may not be possible to remove these “LEGACY” keys. If you cannot delete them, leave them in the registry. However, I have subsequently found that you MAY be able to remove these keys in Safe Mode by using a third-party registry tool. To permanently remove them may also require modifying the Permissions for each key. See: https://forums.comodo.com/help_for_v3/comprehensive_instructions_for_completely_removing_comodo_firewall_pro_info-t17220.0.html;msg119226#msg119226

Now you should be good to go

3

Ok, have followed your directions. As indicated, I couldn’t delete the legacy drivers. Even using the ‘uninstall tool’ I found on here.

Did a clean install using the fresh download from the Comodo site and followed setup instructions I found on here:

https://forums.comodo.com/firewall_guides/setting_up_firewall_for_maximum_security-t30535.0.html and

https://forums.comodo.com/defense_guides/setting_up_defense_for_maximum_security-t30473.0.html

Are there any other configuration/setup settings that should be changed in addition to the above?

I won’t be entering any more reports until tomorrow night and don’t know how to test to see if the autocomplete function in Firefox is working correctly.

Y’alls help is greatly appreciated!

4

Ok, all the above has been accomplished and am still experiencing the same problem with the autocomplete function within Firefox that had been working until the most recent update to CIS.

Any other ideas?

5

See if FF is Trusted Application in D+ and Firewall. If not set it to be Trusted Application.

6

Ok, checked and FF wasn’t defined as Trusted Application. Set FF as TA in both FW and D+

Tested again last night and problem persists. No change.

7

Problem persists. Any ideas?

8

I browsed through the Firewall tutorial from Kyle you followed. Try bringing back attack detection settings to its defaults; that is only having "Block fragmented IP datagrams " enabled.

9

Ok. Done.

No change. Problem persists.

10

I have tried again with the new settings using Firefox in Safe Mode and also using Maxthon (IE Based).

In neither of these browsere is autocomplete feature working correctly.

Any more ideas…Please?

11

I am not sure this is firewall related. My gut feeling is that this is a browser thing and not a firewall thing. Usually browsers allow very little when in secure mode. Usually they don’t cache https page and I wouldn’t be surprised if they didn’t allow storing form information as well.

To see where the problem lies disable Firewall and D+ and try again. You can disable the firewall by right clicking the CIS icon in the systray → then disable under Firewall Security Settings.

To disable D+ go to D+ → Advanced → Defense + Settings → now tick "Deactivate Defense + completely (requires a reboot) → reboot as requested.

When you are not behind a router I urgently advice to enable Windows Firewall before rebooting.