Key processes missing from 'Running Processes' in firewall rules [M195]1[v6]


When attempting to create firewall application rules two processes are not listed when selecting:

Application Rules/Add/Browse/Running Processes

The processes are ‘System’ and ‘Windows Operating System’ (System idle Process) Although the latter is not a true process it is helpful when creating log filtering rules, particularly with P2P applications. The former is used when creating rules for file sharing and is a key process.

A. The bug/issue

  1. What you did:

Install CIS V6 and attempth to create rules for the ‘System’ process and Windows Operating System (WOS)

  1. What actually happened or you actually saw:

Both of these processes are absent from the list of those available.

  1. What you expected to happen or see:

I would have expected to see these processes.

  1. How you tried to fix it & what happened:

Checked the installation on several different PCs to discount the possibility of corruption.

  1. If its a software compatibility problem have you tried the compatibility fixes (link in format)?:


  1. Details & exact version of any software (execpt CIS) involved (with download link unless malware):

Windows 7 x64 and Windows 7 x86 bare metal and VMWare Workstation 9.1

  1. Whether you can make the problem happen again, and if so exact steps to make it happen:

The situation is reproducible always

  1. Any other information (eg your guess regarding the cause, with reasons):

It’s possible they’ve been purposely removed, which is a mistake.

B. Files appended. (Please zip unless screenshots).


  1. A diagnostics report file (Click ‘?’ in top right of main GUI) Required for all issues):


  1. Screenshots of the 6.0 Killswitch Process Tab (see Advanced tasks ~ Watch Activity) or 5.x Active process list. If accessible, required for all issues:


  1. Screenshots illustrating the bug:


  1. Screenshots of related CIS event logs:

Attached - The logs still capture WOS events but there appears no way to deal with the entries

  1. A CIS config report or file.


  1. Crash or freeze dump file:


  1. Screenshot of More~About page. Can be used instead of typed product and AV database version.


C. Your set-up

  1. CIS version, AV database version & configuration used:

CIS v6 Firewall only
Customised Firewall Configuration

  1. a) Have you updated (without uninstall) from from a previous version of CIS:
    b) if so, have you tried a clean reinstall (without losing settings - if not please do)?:

Clean install.

  1. a) Have you imported a config from a previous version of CIS:
    b) if so, have U tried a standard config (without losing settings - if not please do)?:

Newly created configuration

  1. Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.):

N/A - See attached configuration file for details.

  1. Defense+/HIPS, Autosandbox/BBlocker, Firewall & AV security levels: D+/HIPS= , ASB/BB= , Firewall = , AV =

N/A - Firewall only - Custom Policy mode/Alerts very high

  1. OS version, service pack, number of bits, UAC setting, & account type:

N/A - Windows 7 x64/x86 SP1 + Hotfixes - UAC off/Administrator

  1. Other security and utility software currently installed:


  1. Other security software previously installed at any time since Windows was last installed:


  1. Virtual machine used (Please do NOT use Virtual box):

Bare metal and VMWare Workstation 9.1

[attachment deleted by admin]

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Many thanks again


Appears fixed in 2708

Thanks, tracker updated

This issue appears to me to be the same as one already on file. Accordingly, I will merge them, if that’s OK. You can locate the merged report by following the link in the email notification.

If you don’t agree please PM any active mod with your reasons and, if appropriate, they will unmerge the issue.

Many thanks