I keep getting the first attached message, although I have enabled “Allow invisible connection attempts” and have allowed the kind of connection requested for the application.
[attachment deleted by admin]
Please take a look or bookmark my FAQ link in my sig:
Constant Same Alerts / Doesn't Remember Rules https://forums.comodo.com/index.php/topic,6908.0.html
Scroll down to reply #4 and #5.
I also have one like that: yahoo messenger opens a browser window to directly access my web email.
I already have checked “remember” and even checked “allow invisible connection attempts” manually (which was already checked due to me checking “remember”). It did not help. I have the same problem with DLL-Injection, which made me deactivate DLL-Injection-Detection completely!:
https://forums.comodo.com/index.php/topic,8632.0.html
I think that many of the new “application behaviour analysis”-detections have the problem of being reported again and again, as they (except “invisible connection attempts”) have no option of allowing them forever for an application. Allowing the “injecting/injected” components did not work either (see post linked above).
Comodo firewall looked nice in the beginning but now I have deactivated it as it keeps annoying me with the aoltopspeed3-thing.
I know what you mean. I myself have disabled ABA monitor entirely, but due to other reasons. Once version 3 is out, you won’t see these alerts anymore except for 2 conditions:
the associated programs are not on the safelist yet or they are malware.
Try changing the rule to “Skip Parent” instead of waol.exe as the “set” parent application. See if that makes a difference.
Might also set it to “Skip advanced security checks.” It’s self-activating, but the app is not its own parent, which is odd. This may be part of the problem.
LM
Could be an imperfect installation. i.e. ensure that other software like AV’s are disabled during that time.
Did both, keeps annoying me (see attached images).
[attachment deleted by admin]
I would have two other suggestions:
-
Set the Application Monitor rule from “Apply the following Criteria” to “Allow All activities for this application.” This will, however, remove all IP, Port, Protocol, Direction restrictions for the app, and combine all those rules into one. It obviously places a lot of trust in the app, which you may not want to do.
-
Turn off/disable/close any active/real-time security applications (such as AV, HIPS, etc), then uninstall the FW. Reboot, turn off all active security again, reinstall. You can use the script here: https://forums.comodo.com/index.php/topic,2366.0.html to export and re-import your existing FW rules.
LM
I did that, and am starting to create new rules now (skipped the rule-backup-part).
That helped, for now. I have the suspicion, that it was simply the high number of rules I had, as I set the Alert-Rate to “Very High”. It is an old observation of mine that most programs become unstable if you just put enough data into them, although it should not be like that.
If alert frequency is set to Very High, this requires Application, Protocol, Direction, IP, and Port to be specified. If any piece of this changes (which it probably always will), you will get a new alert. Plus, when you factor ABA stuff in, you will get an alert for each new thing (such as “invisible” connections) for each combination of details in your application rule, as per the Alert Frequency level. So if you have 20 different rules for an application, you have that factored out by each new change… After 42,000 popups, they start coming off the monitor and hitting you on the forehead. Painful. 
LM
I know what I am doing. I watch the rules build up and then condense them into IP-Ranges etc.
If you look above, you will see that the problem only applies to the single aoltpspd3.exe, 127.0.01, any port, TCP-Out-Rule (ComodoReport_5_V1.png). That kept reappearing (ComodoReport_3_V1.png) because of ONLY the “invisible”-Stuff for the same parent over and over and over.
I don’t doubt it. Merely pointing out, Very High requires detail. I (and other users working through this) have found that if our details don’t match, it prompts an alert. Thus, if you have the Port field set to Any, this will probably prompt an alert; you’d think it wouldn’t, since “Any” should include all ports, but there you go. Apparently, in this scenario, with this firewall, that’s not the case. It demands individual detail of each rule.
LM
As I expected, after rebuilding all rules from scratch after a reinstall of comodo, first, i had no problem with idle.dll, but now it reappeared, like described in https://forums.comodo.com/index.php/topic,8632.0.html.
I replied in the other thread. As far as this one, since the reinstall, how are the “invisible” popups going?
LM
They are behaving OK (as expected) so far.
Good so far, then. Let’s see if it stays that way…
LM