In v. I not see the checkbox to allow or deny

I’am installed the version.
Today, updating, I’am the version.

Previously, with, if any application try to connect to internet, I’am a dialog asking Allow or Deny, with a checkbox to remember my choice.

Then, in, the checkbos is not present.

This is a bug?
Or I must change configuration of CPF?


Can you please paste a screenshot of such an alert?


The alert is to svchost.exe, allowed from me, without the checkbox.
If I delete svchost from application control rules, it not reappear.
If I delete SpybotSD.exe then the alert reappear, and the checkbox is present.
Mistery of computers.


Sounds similar to this alert. See screenshot below:-


[attachment deleted by admin]

Yes, similar to this alert

Im not absolutely sure but thats part of the way cpf works and it has no checkbox because it saves automatically because the alerts without boxes usually mean the components have changed version or some other change to components so it doesnt allow you to remember because it automatically remembers if its annoying then just turn off the component monitor.

Correct me if im wrong!

My guess is that it’s because of the “type” of alert it is. You have a security alert below warning that SysSafe.exe is refusing communications with Comodo, so the firewall sees this as a “serious” connection attempt so by default it won’t offer the possibility of permanently allowing something that could be malware. Just my guess, but I’m sure someone could clarify.

The alert is the attached.

Please, help me.



[attachment deleted by admin]

Can you show us the screenshot of your Task Manager with all processes listed. Or better a screenshot of process explorer?


I noticed the common element in both screenshots is they refer to a crashed process.

Egemen, is it correct to assume that CPF doesn’t actually want you to remember any settings for a crashedprocess? Is CPF this discriminating with its alerts? Great, if it is.

ewen :slight_smile:

Yes. It is intentionally not remembering these cases. These types of alerts can be only for 2 reasons: Crashed processes or processes that set kernel hooks with a driver. CPF does not provide any remember option for both of these cases.


Excellent! And so logical when you think through the implications of remembering.

Ewen :slight_smile:

Hi again,

Some of our users reported in our Turkish forums that an unknown trojan modifying system services is causing this exact behavior. And CPF’s behavior analysis is constantly raising this alert.
They used Windows Worms Doors Cleaner 1.4.1 to verify and fix the issue. Please try to use it and let us know if your case is the same.



The problem is:
In Security->Application Monitor:
I’am 2 rules for svchost.exe:
one for TCP/UDP out allow
one for TCP/UDP out block

Removed the “TCP/UDP out allow” rule, and the problems of crashed process disappear