Ignore Once Not Working Correctly [V6][M44]

After disabling the option for the antivirus component labeled “Do not show antivirus alerts” I tried downloading a potentially dangerous program through Comodo Dragon. When the antivirus popped up I chose the option to ignore once. This seemed to work fine, but a few seconds later the same alert popped up again. I once again chose to ignore once. This same process occurred over and over, potentially forever.


A. THE BUG/ISSUE:

  1. What you did:
    I downloaded the test application from this link:
    Leaktest | PCFlank
    through Comodo Dragon. Downloading it immediately caused an antivirus alert, which I chose to ignore once. Note that Comodo Dragon was not sandboxed. This seemed to work fine, but a few seconds later the same alert popped up again. I once again chose to ignore once.

Note that after selecting ignore once two times it was able to be downloaded enough in Dragon to allow me to tell it to keep the file (which was flagged by Dragon as potentially dangerous). However, even after I selected Keep and it downloaded through Dragon I kept getting the antivirus popups, which I always chose to ignore once. It was these which appeared to continue forever.
2. What actually happened or you actually saw:
After the file was allowed to download correctly I kept getting antivirus popups, one after the other, as I selected ignore once for each one.
3. What you expected to happen or see:
I expected to get one popup as it was downloading. Then, I expected one after it finished downloading. Selecting ignore once should remember that answer in some sort of a usable fashion so the user could at least have time to investigate the file in between antivirus popups.
4. How you tried to fix it & what happened:
I do not know how to fix this.
5. If a software compatibility problem have you tried the compatibility fixes (link in format)?:
NA
6. Details & exact version of any software (except CIS) involved (with download link unless malware):
Comodo Dragon Version 23.4.0.0
7. Whether you can make the problem happen again, and if so precise steps to make it happen:
Just download that file and choose the option to ignore once in the antivirus popups. I can reproduce this as many times as you wish.
8. Any other information (eg your guess regarding the cause, with reasons):
I’m not sure what causes this, but it may be that it happens because ignore once only works until the next time it is accessed. Thus, perhaps files downloaded are accessed by something immediately after an antivirus popup.
B. FILES APPENDED. (Please zip unless screenshots).:
0. A diagnostics report file (Click ‘?’ in top right of main GUI) Required for all issues):
Attached.

  1. Screenshots of the 6.0 Killswitch Process Tab (see Advanced tasks ~ Watch Activity) or 5.x Active Process List. If accessible, required for all issues::
    Attached.
  2. Screenshots illustrating the bug:
    Attached, both while being downloaded and after being downloaded and allowed through Dragon.
  3. Screenshots of related CIS event logs:
    Attached.
  4. A CIS config report or file:
    NA
  5. Crash or freeze dump file:
    NA
  6. Screenshot of More~About page. Can be used instead of typed product and AV database version:
    Information provided above.

C. YOUR SETUP:

  1. CIS version, AV database version & configuration:
    Comodo Internet Security Version 6.0.260739.2674
    Database 14614
  2. a) Have you updated (without uninstall) from a previous version of CIS:
    No
    b) if so, have you tried a clean reinstall (without losing settings - if not please do)?:
    NA
  3. a) Have you imported a config from a previous version of CIS:
    No
    b) if so, have U tried a standard config (without losing settings - if not please do)?:
    NA
  4. Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.):
    No, it is default, except that I disabled the option for the antivirus component labeled “Do not show antivirus alerts”.
  5. Defense+, Sandbox, Firewall & AV security levels:
    Default.
  6. OS version, service pack, number of bits, UAC setting, & account type:
    Windows 7 x64 (Service Pack 1)
  7. Other security and utility software currently installed:
    Just Comodo System Utilities and CCleaner.
  8. Other security software previously installed at any time since Windows was last installed:
    No
  9. Virtual machine used (Please do NOT use Virtual box)[color=blue]:
    Not a virtual machine.

[attachment deleted by admin]

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Many thanks again

Mouse

This bug still exists in version 6.0.264710.2708. Hence I am adding a new post with the new format.

A. THE BUG/ISSUE (Varies from issue to issue)
[ol]- Summary - Give a clear summary in the topic title, NOT here.

  • Can U reproduce the problem & if so how reliably?:I can reproduce the problem every time.
  • If U can, exact steps to reproduce. If not, exactly what U did & what happened:To reproduce this download the pcflank test application from this page. Downloading it will immediately cause an antivirus alert. Choose to ignore once. In fact, every time CIS pops up with an antivirus alert ignore once. Also, during the download CD will flag it as potentially dangerous. Select the option to keep it. What happens is that I keep getting the antivirus alerts, which I always choose to ignore once. However, after a few seconds another alert always pops up. This process appears to continue forever until you either select to clean it or to add it to the exclusions. Ignore once is obviously not working correctly.
  • If not obvious, what U expected to happen: I expected that after choosing ignore once I would still get one popup as it was downloading. Perhaps another after it finished downloading. Then another when I tried to run it. Essentially, I expected that selecting ignore once would be usable for software I would like to be able to take time to investigate.
  • If a software compatibility problem have U tried the conflict FAQ?: Not a software compatibility.
  • Any software except CIS/OS involved? If so - name, & exact version: Just Comodo Dragon, but I don’t think that is the issue.
  • Any other information, eg your guess at the cause, how U tried to fix it etc: I’m not sure.
  • Always attach - Diagnostics file, Watch Activity process list, (dump if freeze/crash). If complex - CIS logs & config, screenshots, video, zipped program (not m’ware) Attached. Note that I attached an old screenshot of the antivirus logs. I did this because it had already been edited to remove names and the behavior was exactly the same.
    [/ol]

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- CIS version & configuration: CIS 6.0.264710.2708. Database 15112. Everything is default except I disabled the option for the antivirus component labeled “Do not show antivirus alerts”.

  • Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV: Everything is default.
  • Have U made any other changes to the default config? (egs here.): Everything is default.
  • Have U updated (without uninstall) from a previous version of CIS: No, it was a clean reinstall.
    [li]if so, have U tried a a clean reinstall - if not please do?: NA
    [/li]- Have U imported a config from a previous version of CIS: No
    [li]if so, have U tried a standard config - if not please do: NA
    [/li]- OS version, SP, 32/64 bit, UAC setting, account type, & VM used: Windows 7 x64 (Service Pack 1), UAC is disabled, administrator account, not a virtual machine.
  • Other security/sandbox software a) currently installed b) installed since OS: None.
    [/ol]

[attachment deleted by admin]

Thanks CHiron, I can confirm this.

Not essential to post in new format - if you have it in new or old standard format you can just say ‘still there in 2708’ - but I’m sure QA will appreciate it

Thanks again

Mouse

According to Comodo this is intended behavior. Thus, I suppose this should be moved to Resolved.

For the purposes of this forum, I would decide it’s status is ‘solution deferred’. Yamlyi has agreed to this as a general BZ status.

Broadly that’s because this forum takes a user’s view of bug, not a technical view.

It is clearly a problem for users, but Comodo has not worked out how to address that yet. So it’s by design for the moment, but the design may change.

There is value to users in keeping it in the main bug forum so people can see it

Is that OK with you

Mike

Sure, I’ll move it back.

Ta, Mouse

In the tracker this is marked as “Confirmed and Deferred”.

I’ve attached a screenshot of my AV settings to this post.

[attachment deleted by admin]

This is not fixed for CIS version 6.3.294583.2937.

Thus, I have updated the tracker accordingly.

The devs have decided that they will not fix this as they do not see a problem with the current implementation. I will therefore move this to Resolved.

Thanks.