Icon goes blank then enable/disable AV from tray malfunctions [~] [v6]

Hi!

First I noticed the tray icon of Comodo had become blank. It simply disappeared although the space where it should be was still there but empty. Hovering the mouse over it displayed the confirmation that it was Comodo’s tray icon.

Then I right clicked on it and disabled the antivirus to see if that would cause the icon to reload and fix the problem. Nothing. I re-enabled it, still nothing.

Then I opened the main GUI. I disabled the antivirus but the interface still showed the all-green “Secure” and real-time protection as “Active”.

Then I re-enabled the antivirus and downloaded the eicar.com file to test whether the antivirus was really working. No warning from Comodo, as if the antivirus component wasn’t working.

I have “Proactive Security” on with a few minor changes to configuration. “Enable adaptive mode under low system resources” is on.

[attachment deleted by admin]

That is strange. Does restarting the computer make it come back?

Yes, I turned off the PC and then back on, and now everything is normal again. I noticed only one glitch. Last time when I downloaded the eicar file, there was no warning. Right clicking the file and clicking “Properties” also didn’t prompt anything from the AV. After the restart, I did this procedure with the 4 different eicar test files I had downloaded. For the first, when I clicked to see the file’s properties, Comodo AV warned me immediately. When I did this for the second file, I was able to see the properties with no prompt from Comodo. Then I clicked “Cancel” on the properties screen and did it again for this second file, this time the AV warned me.

I am also using Kingsoft AV. I used to use it with Avira (Kingsoft only on “Quick Monitor”, that is, check only executables, plus its Boundary Defense, which scans downloads from browsers and etc) and had no compatibility issues. Now I am testing the CIS 6 with the AV and have uninstalled Avira’s real-time monitor. In this instance when Comodo AV wasn’t working and I was able to download the eicar test file with no prompt, I noticed that Kingsoft’s Boundary Defense also didn’t warn me, it wasn’t working correctly (now after restart it is working again). Could this be a compatibility issue between the two programs?

To see if you’re protected see if cmdagent.exe is running. It it is running you are protected.

Detection of eicar test virus as a means of testing if the av is still working can be a red herring.

A reason is that CIS does not have a web shield; it does not check while it is downloading from the web. Comodo beliefs that detection a virus before it gets loaded into memory or written to or from disk is early enough.

However you should have been warned when accessing the properties of both the eicar.com and eicar.txt files. If that is reproducible not the case we are looking at a possible compatibility problem between Kingsoft AV and CIS.

In general we advice against running two security programs of the same kind at the same time. In that spirit choose if you want Kingsoft or CIS to monitor for viruses as a Real Time Shield. The other program will be on demand then.

If it’s running but doesn’t detect a virus present in its signature base, am I protected?

Detection of eicar test virus as a means of testing if the av is still working can be a red herring.

Why? It’s in the signature base as a “virus”. Should have been detected. Or am I wrong?

A reason is that CIS does not have a web shield; it does not check while it is downloading from the web. Comodo beliefs that detection a virus before it gets loaded into memory or written to or from disk is early enough.

That’s a red herring. Comodo doesn’t need a Web Shield to detect this file on download. Normally Comodo will detect it before it is completely written, when it still has the .crdownload extension of Chrome/Dragon downloads.

However you should have been warned when accessing the properties of both the eicar.com and eicar.txt files. If that is reproducible not the case we are looking at a possible compatibility problem between Kingsoft AV and CIS.

In general we advice against running two security programs of the same kind at the same time. In that spirit choose if you want Kingsoft or CIS to monitor for viruses as a Real Time Shield. The other program will be on demand then.

Kingsoft Antivirus has been developed to be compatible with any other antivirus. Of course that’s probably much easier said than done, but as I’ve stated before I have been using it alongside Avira with no ill effects. In fact, Kingsoft incorporates Avira’s engine in its antivirus. Of course that may not apply to all antiviruses, maybe Comodo Antivirus and Kingsoft Antivirus don’t work well together. If that is the case, how can I determine it? Maybe memory dumps or log files? What procedure would be recommended to further investigate this issue?

Thank you.

You can use the test scenario I gave you. Right click on eicar.com or eicom.txt and CIS should detect it. Try it with Kingsoft Real Time Shield completely disabled and enabled and see the differences. When needed uninstall Kingsoft temporarily and test again.

Like I said, everything is normal now. The problem hasn’t reoccurred (yet). If I download eicar with both AVs on, Comodo detects it. If I disable Kingsoft, obviously Comodo still detects it. If I disable Comodo, Kingsoft detects it. Both AVs are working correctly as of now. The computer has been on for 17 hours with programs running (torrents) and no problems. However I’m still worried that my antivirus protection was disabled the way it was in that occasion. I’ll keep running both AVs together and try to see if something goes wrong again.

Thanks please keep us informed and make a full beg report if any part of this bug recurs.

For the moment I’ll move this to non-format reports, so the devs can have a look if they wish.

Best wishes

Mouse

Ok thanks, I’m glad to help. How do I make a full bug report?

You can do one now if you want - now I’ve worked out what probably happened. And next time it happens please take a dump of cistray.exe using Killswitch before rebooting and append it.

Just use this link: here.

I’m guessing what happened here was a partial cistray.exe freeze.

Just a thought

Mouse

Would a simple partial cistray.exe freeze disable the real-time antivirus protection? Because the tray or GUI malfunctioning is a minor issue, but the real big problem was that the AV real-time was rendered useless.

Just to reiterate, this is not a simple tray icon / GUI issue (interface glitch). I think the new title of the thread is a little bit off the real problem which was the AV getting silently disabled (security breach) on top of the UI glitch.

I understand that, otherwise I would not be asking for a full report :slight_smile:

The summary was accurate I think? But now is slightly amended to indicate severity.

I rate separately rate severity on the mods system, this would be Major or more

Best wishes

Mouse

It took me a a week or so to drag myself through a formatted bug report. but then again…after I filed a few formatted bug reports I thought to myself…
Once you Comodo, You Always Comodo!

Filling out the formatted bug report is the only way to really help your situation…

DrHaze
88)

Now it’s propered. Thanks :slight_smile:

All the best,
Jaspion

Thanks very much for your issue report. We have moved it to the non-format bugs board for the moment, because too much of the information we normally need to replicate a problem and fix it is missing, or it is not in the format we request.

We realize some people may not have the time to do bug report in standard format, and therefore offer the option of a non-format report instead. But the problem is much more likely to be fixed promptly if you edit your first post to create an issue report which meets all criteria in the Checklist and Format. (You can copy and paste the format from this topic). The general reasons why are summarized in that post, the reasons we ask for specific pieces of information are given in this detailed post.

You can get your report moved to the format verified issues board simply by ensuring that it is correctly formatted and all criteria are met, and PM’ing a mod who is active on the bug board.

Best wishes

Mouse

Can you please check and see if this is fixed with the newest version (version 6.2.282872.2847)? Please let us know whether it is fixed or you are still experiencing the problem.

Also, note that all bug reports in the Non-Format section of the forum, which is where this report currently is, are not looked at by the devs. Thus, if the bug you were experiencing is still not fixed please edit your first post so that it is in the correct format (found here, with all required attachments, so I can forward this to the devs and get this problem fixed.

Thank you. PM sent.

As I state before, this problem has not reoccurred. Thank you.

Thank you for checking this.

I will now move this to Resolved.