Answering your question 1 & 2 : V12.2.2.8012 (Firewall only) Windows 7 Ultimate 64-bit (clean install with all MS-updates)
Regarding the not working “Create rules for safe applications”, did you run the Trusted applications elevated to SYSTEM ?
Note that when running the same Trusted applications normally (not elevated) “Create rules for safe applications” does work correctly. The issue happens when Trusted applications run elevated to SYSTEM, have you tried that?
Please also make sure to delete the Trusted application HIPS rule(s) before running the Trusted application to have HIPS re-create the rule when running the Trusted application.
Regarding issue no.30 (and the “Create rules for safe applications” issue) did you try to reproduce it on Windows 10, 8 and 7 ?
We did run trusted application as “administrator” and checked the hips rules setting, the rules are being created for the trusted application which is ran as administrator.
Where the Hips is in “safemode” and the option “create rules for safe application” is checked
We have checked on win 10, 7 & 8 machines
So, we couldn’t able to reproduce this issue.
Issue no.30 and the issue “Create rules for safe applications” only happen when applications first are elevated from “administrator” to “SYSTEM” before they are run. Please run the applications with SYSTEM credentials (not administrator) and check again.
Thank you.
Run any keylogger or any application that can perform direct disk access such as a hex editor and run them as SYSTEM using process hacker run as feature. HIPS will not alert an automatically allow the action for the following HIPS access rights: Direct Disk, Direct Keyboard, Direct Monitor, Direct Physical Memory, Access to protected COM interfaces, DNS/RPC Client service, and Interprocess memory access.
One easy way to check is to get OleViewDotNet and then click registry menu then select Prog IDs to list all registered COM objects by their Program IDs, then expand the WindowsInstaller.Installer. Once you expand the COM object it should produce an alert for that specific COM object due the default COM interface WindowsInstaller.* being listed under protected COM interfaces. Now if you try to expand the InternetExplorer.Application.1 COM interface, you will get an alert for OLEview.net trying to access the protected COM interface of InternetExplorer.Application.1
I’ve provided C.O.M.O.D.O RT another “run as SYSTEM” method that I’ve used during testing issue no.30. I confirm that the process hacker run as feature yields the same issue result.
Could you replicate also the not working “Create rules for safe applications” issue, related to no.30, as described in my previous posts?
So, the not working “Create rules for safe applications” issue related to no.30 is considered to be a non-issue then.
Thanks for spending my time on it.
Any chance for a new release or at least a new beta to come out this month? The year is almost over and Comodo only released a single CIS build this year…
Yes I know dev team had problems but still, a new release would cease all speculations about CIS being dead and etc. It’s always better to not give ammunition to the haters… >:-D
As it has been asked already and no answer no bug fix information will be given I’m afraid.
We’ll have to wait for the next CIS release together with a new Release Note to come out to see what has been fixed (if a new CIS will ever come out…).
