Loss of Administrator rights after comodo firewall installation

Hello,
COMODO Firewall only installation: Version 4.1.19277.920 downloaded june,12-th, 2010. (No CIS-Inst.!)
I was logging in as a member of the Win-XP (32 bit) “Administrator Group” (not as “Administrator” !) . The login window showed only the possibility to log in for this user. The installation was successfully completed.
After the first reboot I could login the same way as before. The first error report from comodo said:
“Application could not start because of an error connecting to its database.” Then I tried to remove the installation with the comodo uninstaller: Add and remove components. “Error reading from file C:\System\XPPRO\32222.msi.Verify that the file exists and you can access it” So I went there and could start again the
msi-file. However, the above error popped up again. When trying to access the windows firewall to check that it was turned off, the indications were greyed out. Trying to change something caused a XP popup:“You must be administrator to change the settings”. I have lost my administrator rights!
What else can I do other than a new Win_XP installation? Please Help!

Use Administrator for login, change user settings on your account (Start>Settings/Control Panel/Users…>change rights). And use a password for your own safety.

I have this problem as well. I cannot install any new programs even though I am logged on as an administrator.
Please help!

thanks for your quick response.
In the meantime I managed to uninstall the comodo firewall by starting XP in the “Save Mode” (F8) and logged in with the “Administrator-Account”. This way I kept my full administrative rights and could do a normal uninstall. Having used comodo for years I was interesting what has caused the problem. I did a new installation on another computer with the account “Administrator”, checked the box “maximum proactive defense” and installation was normal. Sandbox was marked active. However when I tried to do the XP-sp3-update comodo said, that this application was saved in the sand box, no action required. When I continued to run the next step of the program comodo said “you must be administrator” to run the program. So I did a right click on the comodo symbol and switched the configuration to “Comodo Firewall Security”. This way I was allowed to continue the program. I think the chosen configuration “Comodo Proactive Security” was responsible for the behavior to withdraw the “Administrator” rights. If you know this dependency no problem or else one sends for help to comodo.

Regards
Klaus

Hi pistyhall and moderator ,

here are further results from my continuing “experiments” with comodo firewall 4.1.XXXX…920 under Win-Xp service pack 3. After reinstalling under the “Administrator” account everything seemed to work fine…
However, starting today as administrator the comodo popup said:“Application could not start because of an error connecting to its database”. This confirms pistyhall’s experience!
So I have lost again my “Win-Xp administrator” rights.
This time a restart in WinXP"Safe mode (F8)" verified that that comodo also has blocked the win-XP -installer services (win error 1084). So I could not uninstall comodo. However, the comodo firewall had started normal and I kept administrator rights. So I disabled comodo’s firewall and Defense+ and the Sandbox and created a new testuser with administration rights and restarted with the Win-xp normal mode. After the login as a testuser everything seems to work normal…
To verify stable operation of Comodo firewall I updated Win-XP(Sp3) with “ALL” Microsoft updates
available, in this case until February 2010, and so far I did not observe any malfunctioning of comodo firewall. It seems that there have been some inconsistencies in the MS-WinXP-Operating-System:
I had to apply 98 Win-Xp Updates to the baseline Servicepack 3 ! There are another 24 updates to be applied in order to have a complete update until today!!!

Best regards from Germany

Not sure if this matches the problem some have had, but on upgrading as an Admin user on XP-SP3 (Home version), I logged in as a Limited User account and got the:
“Application could not start because of an error connecting to its database.”
and all major systems were blocked (because the front end couldn’t “ask” me what to do)

The solution I used to make the front end system connect to the back end service was as an admin add users Full access rights to the C:\Documents and Settings\All Users\Application Data\COMODO folder.

For those wanting a cmd line solution:

cacls “C:\Documents and Settings\All Users\Application Data\COMODO” /E /G BUILTIN\Users:F

Not saying it’s the best solution, but I suspect that some testing in a limited user environment was missed.
However, there are not many XP users that run their PC with limited accounts (saves me a lot of headaches), and runas is your friend (make a bat file with: runas /user:admin cmd)

Hope this helps (as i was about to give up on the new version due to this issue).

Regards,
~ Grey

BUMP

Any dev have any ideas on this?

Best wishes

Mouse

Hello Senko,

thanks for your posting. I could confirm by another new installation using WIN-XP (Pro) that service pack
SP 3 as a baseline will not allow to install Comodo-FW properly. Again loss of administrator rights and “Application could not start because of an error connecting to its database.” showed up. Updating Windows-Xp with 98 updates helped also this time to install comodo FW. However, when I imported my configuration file from another computer (also 920 Version) and restarted again:“Application could not start because of an error connecting to its database.” So I deactivated (firewall, proactive, sandbox options, right click on comodo icon in the tray) and after restart uninstalled comodo and did a new installation without importing the configuration file. I noticed also that when I tried to import the configuration file there were no changes made e.g. to the Application rules.
After a few changes in Comodo FW configuration it happened again that “Application could not start because of an error connecting to its database.” So I disabled the “Sandbox” and all problems were gone.
This is no solution at all! Hope that comodo will soon come up with a more stable version (921?).
Regards
klaus

Hi Klamet and all

This is all very puzzling, and may take a while to sort out.

  1. Could you please reboot then post your defense plus logs (with all info visible)? They may show nothing due to the database error, but it may give some info.
  2. I’m assuming you are all updating from v3? If so please try an install without importing a config file.
  3. I have XPPro SP3 (x32) and have created a limited user a/c (though I installed 4.1 under a named admin account). I’m using (non-imported) proactive security settings - everything pretty standard. I have no problems from CIS yet, running under the limited user account, but I do have an access error on a \application data<vendor>\program directory (from Clipmate www.clipate.com) which seems to bear some relation to your error.
  4. In general I’d suggest switching off D+ ‘permanently’ when updating XP to SP3. I know it should be OK but it wasn’t when I did it!

Best wishes

Mouse

Hello gr3ywOlf,

I tried to apply your “solution” on my computer. It did not work the way I implemented it. Could you please help ? On my installation there was no folder C:.…COMODO . So I created a new one and applied the command as you did being administrator. THAN I called the new user “internet” and put him into the xp-group
“main user” and used again your command C:\daten\xppro\internet…" The folder “internet” was created automatically when I had created the user “internet”. What I am doing wrong?
By the way when I disable the comodo-Sandbox, all problems are gone away…

regards
klaus

Hi Klamet

I wonder if you could try 1) and 2) in my post above please - in that order. I’d like to try and work out what is happening here so we can understand what may need fixing.

If 2) does not fix, I think we probably should transfer to bugs for investigation.

Many thanks in anticipation

Mouse

Hi mouse1 and all,

as I explained in one of my posts that “all problems” were gone when I had disabled the sandbox I also tested the impact of doing this. A big surprise showed up using the test suite from www.matousec.com,
level 1, autorun1-test. Comodo failed the test when the sandbox was disabled. There was a new entry in the registry to be found created by the matousec-test as “run”. The test suite also includes the source code of all 148 firewall tests. So you exactly know what you are doing. However when the sandbox was enabled comodo discovered the test and and put the file into the “pending” folder and no new entry in the registry was shown.
Mouse 1, you are perfectly right that all is puzzling: I have the same installation (version 920) on another computer running with no problem at all. I have used the same XP-Installation!
The result testing Comodo-CIS (Version 828) showed a 100% score by matousec (May 1,2010)!
Congratulation to Comodo!
It seems that only a few users have encountered this “special” problem in the forum.

Lessons learned: DO NOT DISABLE “SANDBOX”!

My proposal to COMODO: Delete the possibility to disable the SANDBOX. Have the SANDBOX always running (as Agnitum OUTPOST Firewall does).

Regards
Klaus

Hi Klaus

Any chance of you re-enabling the sandbox and trying 1) and 2) in my post?

Really would like to track this down

Best wishes

Mouse

Hi mouse1,

thanks for your interest in “troubleshooting”.

As to your post reply #8:

  1. I will post the “defense plus” logs. Why only “defense +” logs ?
  2. I did a new installation (no upgrade).
  3. When upgrading to Win-XPPRO SP3 comodo was not installed. I installed it thereafter.

It may take a little while to do the new post.
First I want to try new settings for “Windows Services” and verify that they are 100% equal for both
my installations on two different computers. Remember one is working with no problems at all, the other
one has shown all the posted problems.

Regards
Klaus

Thanks. It’s the D+ facility that changes account permissions, hence d+ logs. Thanks for the other info. I will await the logs.

The ‘new install’ not upgrade you refer to was CIS?

Best wishes

Mouse

Hi all,
Did you install Windows in an other folder than C:\Windows ?
Maybe that has caused some issues.

Other question did you “tweak” the system in any other way like changing explorer.exe so change for example the start bar button, or the text “Start” maybe used theme/skinning software?

Hi mouse 1,

I have taken the requested logs:

Defense+ Events

Date Created 2010-07-04 15:33:24

Records count 36
Date Application Action Target
2010-07-04 09:28:53 C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe Sandboxed As Limited
2010-07-04 09:29:14 C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe Sandboxed As Limited
2010-07-04 09:36:40 C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe Sandboxed As Limited
2010-07-04 09:37:00 C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe Sandboxed As Limited
2010-07-04 10:54:11 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:32 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:36 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:36 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:37 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:46 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:48 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:48 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:48 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:54:49 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\SYSTEM\XPPRO\system32\verclsid.exe
2010-07-04 10:55:07 C:\Programme\Intel\Wireless\Bin\S24EvMon.exe Modify Key HKUS.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ParseAutoexec
2010-07-04 10:56:24 C:\Programme\Intel\Wireless\Bin\RegSrvc.exe Modify Key HKLM\SYSTEM\ControlSet???\Services\WZCSVC
2010-07-04 10:56:55 C:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe Access COM Interface C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
2010-07-04 10:57:30 C:\Programme\Intel\Wireless\Bin\S24EvMon.exe Modify Key HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile
2010-07-04 11:01:31 C:\Programme\Intel\Wireless\Bin\RegSrvc.exe Modify Key HKLM\SYSTEM\ControlSet???\Services\WZCSVC
2010-07-04 11:06:22 C:\Programme\Mozilla Firefox\firefox.exe Scanned Online and Found Safe
2010-07-04 11:06:23 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\Programme\Mozilla Firefox\firefox.exe
2010-07-04 11:54:11 D:\autorun.exe Sandboxed As Limited
2010-07-04 11:56:44 C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe Sandboxed As Limited
2010-07-04 13:17:18 C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe Access COM Interface C:\SYSTEM\XPPRO\system32\svchost.exe
2010-07-04 13:17:55 C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe Access COM Interface C:\SYSTEM\XPPRO\system32\svchost.exe
2010-07-04 13:17:58 C:\SYSTEM\XPPRO\system32\ctfmon.exe Send Message C:\Programme\COMODO\COMODO Internet Security\cfp.exe
2010-07-04 13:18:07 C:\SYSTEM\XPPRO\system32\userinit.exe Modify Key HKUS\S-1-5-21-1801674531-1606980848-1060284298-500\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device
2010-07-04 13:18:13 C:\SYSTEM\XPPRO\system32\ctfmon.exe Send Message C:\Programme\COMODO\COMODO Internet Security\cfp.exe
2010-07-04 13:18:33 C:\SYSTEM\XPPRO\system32\userinit.exe Modify Key HKUS\S-1-5-21-1801674531-1606980848-1060284298-500\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device
2010-07-04 13:28:09 C:\SYSTEM\XPPRO\system32\userinit.exe Modify Key HKUS\S-1-5-21-1801674531-1606980848-1060284298-500\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device
2010-07-04 13:28:46 C:\SYSTEM\XPPRO\system32\userinit.exe Modify Key HKUS\S-1-5-21-1801674531-1606980848-1060284298-500\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device
2010-07-04 14:29:41 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\Programme\COMODO\COMODO Internet Security\cfplogvw.exe
2010-07-04 14:45:24 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\Programme\COMODO\COMODO Internet Security\cfplogvw.exe
2010-07-04 14:49:23 C:\SYSTEM\XPPRO\explorer.exe Create Process C:\Programme\COMODO\COMODO Internet Security\cfplogvw.exe
2010-07-04 14:53:09 C:\SYSTEM\XPPRO\explorer.exe Create Process D:\AUTORUN.EXE
2010-07-04 14:54:48 D:\autorun.exe Sandboxed As Limited
End of The Report

COMODO Firewall - Log Viewer Logs

Table

:

Alerts Displayed

Date Created 2010-07-04 15:32:16

Records count 29
Date Type Description Advice Answered Answer Flags Treat As
2010-07-04 09:28:53 Sandbox Alert ZCfgSvc.exe
2010-07-04 09:29:13 Sandbox Alert ifrmewrk.exe
2010-07-04 09:36:39 Sandbox Alert ZCfgSvc.exe
2010-07-04 09:37:00 Sandbox Alert ifrmewrk.exe
2010-07-04 10:54:11 Defense+ Alert explorer.exe is trying to execute verclsid.exe. What would you like to do? verclsid.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 10:54:31 Deny
2010-07-04 10:54:32 Defense+ Alert explorer.exe is trying to execute verclsid.exe. What would you like to do? verclsid.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 10:54:36 Deny
2010-07-04 10:54:36 Defense+ Alert explorer.exe is trying to execute verclsid.exe. What would you like to do? verclsid.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 10:54:46 Deny
2010-07-04 10:54:46 Defense+ Alert explorer.exe is trying to execute verclsid.exe. What would you like to do? verclsid.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 10:54:47 Deny
2010-07-04 10:54:48 Defense+ Alert explorer.exe is trying to execute verclsid.exe. What would you like to do? verclsid.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 10:54:49 Deny
2010-07-04 10:54:49 Defense+ Alert explorer.exe is trying to execute verclsid.exe. What would you like to do? verclsid.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 10:54:55 Allow Remember
2010-07-04 10:55:07 Defense+ Alert S24EvMon.exe is trying to modify a protected registry key. What would you like to do? S24EvMon.exe could not be recognized and it is about to modify the protected registry key HKUS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ParseAutoexec. You must make sure S24EvMon.exe is a safe application before allowing this request. 2010-07-04 10:56:22 Allow
2010-07-04 10:56:24 Defense+ Alert RegSrvc.exe is trying to modify a protected registry key. What would you like to do? RegSrvc.exe could not be recognized and it is about to modify the protected registry key HKLM\SYSTEM\ControlSet???\Services\WZCSVC. You must make sure RegSrvc.exe is a safe application before allowing this request. 2010-07-04 10:56:53 Allow
2010-07-04 10:56:55 Defense+ Alert Dot1XCfg.exe is trying to access a protected COM interface. What would you like to do? Dot1XCfg.exe could not be recognized and it is about to access the protected COM interface C:\Programme\Intel\Wireless\Bin\RegSrvc.exe. If Dot1XCfg.exe is one of your everyday applications, you can allow this request. 2010-07-04 10:57:23 Allow Remember
2010-07-04 10:57:30 Defense+ Alert S24EvMon.exe is trying to modify a protected registry key. What would you like to do? S24EvMon.exe could not be recognized and it is about to modify the protected registry key HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT\EventMessageFile. You must make sure S24EvMon.exe is a safe application before allowing this request. 2010-07-04 10:57:44 Allow Remember
2010-07-04 10:57:34 Firewall Alert svchost.exe is trying to connect to the Internet. What would you like to do? svchost.exe is a safe application. You can safely allow this request. 2010-07-04 10:57:39 Deny Remember
2010-07-04 11:01:31 Defense+ Alert RegSrvc.exe is trying to modify a protected registry key. What would you like to do? RegSrvc.exe could not be recognized and it is about to modify the protected registry key HKLM\SYSTEM\ControlSet???\Services\WZCSVC. You must make sure RegSrvc.exe is a safe application before allowing this request. 2010-07-04 11:01:34 Allow Remember
2010-07-04 11:06:23 Defense+ Alert explorer.exe is trying to execute firefox.exe. What would you like to do? firefox.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 11:06:35 Allow Remember
2010-07-04 11:06:37 Firewall Alert firefox.exe is trying to connect to the Internet. What would you like to do? firefox.exe is a safe application. You can safely allow this request. 2010-07-04 11:06:40 Deny Remember
2010-07-04 11:54:11 Sandbox Alert autorun.exe 2010-07-04 11:54:19 Keep inside Sandbox
2010-07-04 13:17:17 Defense+ Alert ZCfgSvc.exe is trying to access a protected COM interface. What would you like to do? ZCfgSvc.exe could not be recognized and it is about to access the protected COM interface C:\SYSTEM\XPPRO\system32\svchost.exe. If ZCfgSvc.exe is one of your everyday applications, you can allow this request. 2010-07-04 13:17:54 Allow Remember
2010-07-04 13:17:55 Defense+ Alert iFrmewrk.exe is trying to access a protected COM interface. What would you like to do? iFrmewrk.exe could not be recognized and it is about to access the protected COM interface C:\SYSTEM\XPPRO\system32\svchost.exe. If iFrmewrk.exe is one of your everyday applications, you can allow this request. 2010-07-04 13:17:58 Allow Remember
2010-07-04 13:17:58 Defense+ Alert ctfmon.exe is trying to modify the user interface of cfp.exe. What would you like to do? Modifying the user interface of another application is a fairly common operation in Windows. However, some malware also exploit this feature. If ctfmon.exe is one of your everyday applications, then you can safely allow this request. 2010-07-04 13:18:06 Deny
2010-07-04 13:18:06 Defense+ Alert userinit.exe is trying to modify a protected registry key. What would you like to do? userinit.exe could not be recognized and it is about to modify the protected registry key HKUS\S-1-5-21-1801674531-1606980848-1060284298-500\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device. You must make sure userinit.exe is a safe application before allowing this request. 2010-07-04 13:18:29 Deny
2010-07-04 13:28:09 Defense+ Alert userinit.exe is trying to modify a protected registry key. What would you like to do? userinit.exe could not be recognized and it is about to modify the protected registry key HKUS\S-1-5-21-1801674531-1606980848-1060284298-500\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device. You must make sure userinit.exe is a safe application before allowing this request. 2010-07-04 13:28:42 Deny
2010-07-04 14:29:41 Defense+ Alert explorer.exe is trying to execute cfplogvw.exe. What would you like to do? cfplogvw.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 14:29:47 Allow
2010-07-04 14:45:24 Defense+ Alert explorer.exe is trying to execute cfplogvw.exe. What would you like to do? cfplogvw.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 14:45:27 Allow
2010-07-04 14:49:22 Defense+ Alert explorer.exe is trying to execute cfplogvw.exe. What would you like to do? cfplogvw.exe is a safe executable. However, the parent application explorer.exe could not be recognized. Once the application is executed, its parent will have the full control over its execution. If explorer.exe is one of your everyday applications, you can safely allow this request. 2010-07-04 14:49:31 Allow
2010-07-04 14:53:08 Defense+ Alert explorer.exe is trying to execute AUTORUN.EXE. What would you like to do? explorer.exe is a safe application. However the executable AUTORUN.EXE could not be recognized. Please submit it to COMODO for analysis. 2010-07-04 14:53:20 Allow
2010-07-04 14:54:48 Sandbox Alert autorun.exe
End of The Report

Good Luck! I did not find anything abnormal.
Here are my settings:
Firewall Security Level: Custom Policy Mode
Defense Security Level: Safe Mode
Sandbox Security: Enabled
Configuration: Proactive Security

I did a complete new COMODO Firewall only installation on the 2nd computer. Everything worked fine: using internet, five reboots, changing the application rules and so on …

Unfortunenately suddeny after another reboot comodo firewall again could not connect to its database and the administrator rights were lost…

This was my last try to use Comodo Firewall ONLY. I downloaded the Comodo CIS and I will see what happens when I install "Comodo Internet Security) completely.

Regards
Klaus

However, the parent application explorer.exe could not be recognized.

Looks like your explorer.exe is patched with “something”
Did you see my questions above? explorer.exe is probably sandboxed causing all kinds of strange behavior…

Ronny is right! To check if your version of explorer.exe is the signed do Start ~ run ~ sigverif.exe ~ start. This will report any unsigned system files. (Or you can do the same more quickly by restricting its scan using the advanced options). To replace an unsigned version by the original do Run ~ sfc /scannow with the windows installation disk in your CD drive. Then reboot.

Make a restore pt first :slight_smile:

Best wishes

Mike

Hi mouse 1 and all,

thanks for your continuing interest. I ran sigverif.exe and all the files were o.k. Than I installed Agnitum Outpost PRO Firewall and it works fine. I am convinced that the new “SANDBOX” needs some
improvement. If you disable the SANDBOX no losses of rights do not occur any more. However, if you disable the Sandbox matousec test suite autorun1.exe is not recognized and comodo fails this simple test and as a result your registry entries have changed. (see my post#11).
By the way my first Comodo installation on ASUS-P4C800-E is still running with no problems! The second installation was on a Toshiba notebook Satellite M30-951, which constantly failed when the SANDBOX is activated. This notebook gave me a headache when I was trying to update the BIOS. Being logged in as
administrator was not enough. I had to install a Toshiba tconsole program, set a password there and than I could update the BIOS.

Regards
Klaus