Odd blocking behavior from ccApp on something totally unrelated

Hello,

Although this has been working fine for the past many months a couple of days ago Comodo decided that I was no longer allowed to connect to bizmail.pop.yahoo.com.

I’m using an intermediate spam filter called Popfiles which runs on my local WinXP system, Thunderbird connects to it, which than connects to the pop3 in question, returns all messages with the spams tagged as so.

Here is the odd part, I cleared the logs in Comodo, asked TB to try to connect and have it fail. Look at the log and it says that ccApp (Norton Antivirus) was denied. Huh? Ok maybe ccApp had somehow DLLs in there that are monitoring something. I look in Application Monitor, delete ccApp.exe and try again, same thing, no prompt. This time I delete Thunderbird from AppMon, this time Comodo does prompt me, I allow and it still fails.

I specifically create a AppMon Entry for ccApp, allowing both TCP and UDP any to any and still is failing.

BTW, if I change the security level to “Allow All” everything works, so it is something that is specifically being blocked by Comodo.

Here is the info:

Comodo Firewall Version: 2.4.18.184
Comodo SADV: 3.0
Connection: Cable
OS: Win XP SP 2
Login: Admin
Other apps: Norton AntiVirus 2007
Mozilla Thunderbird 2.0.0.9
PopFiles v0.22.5

Error in question:
Date/Time :2007-12-20 23:36:15
Severity :Medium
Reporter :Application MonitorDescription: Application Access Denied (ccApp.exe:68.142.224.70: :pop-3(110))
Application: C:\Program Files\Common Files\Symantec Shared\ccApp.exe
Parent: C:\WINDOWS\explorer.exe
Protocol: TCP Out
Destination: 68.142.224.70::pop-3(110)

Odd Rules, in Network Monitor I have a local network all open, TCP, ICMP, TCP/UDP. See attachment.

[attachment deleted by admin]

I have further information:

  1. Turning off “just application” monitor also gets around the problem. Turning of Network or Component Monitor does not. So its 100% in Application Monitor.

  2. If I delete the entry for ccApp.exe and try to connect, it still fails but no pop-up to ask me to add it back in.

  3. Adding the ccApp.exe with, without or learning parent does not help.

I am assuming that somehow some DLL from ccApp has gotten mixed up with Thunderbird and that’s what’s making it goofy. Any suggestions would be greatly appreciated.

Was there ever an answer for this behaviour, because I am getting exactly the saem problem.

thanks

The answer was in Norton Settings.

In Anti-Virus I turned off:

  • Internet Worm Protection
  • Spyware Protection
  • Incoming Email Scanning

That solve the problem. Now I only did this because I do all these checks in other programs and Norton was double-checking them.

Aram