opera browser now blocked!? [Resolved]

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
#1

CIS has just updated to 10.0.1.6209 db 26961
I can now no longer launch/use Opera. >:(

I found operalauncher.exe in the blocked app list!
I unblocked it but opera still hangs on ‘loading’ & is completely unusable.
I assume this is a false positive as I have been using opera+CIS without issues for several years - please advise on how to fix this.

#2

Hi jcmil,
The only possibility is that due to first v6209 update you have trusted vendor list corrupted.

May you please check out if you can find “Opera Software AS” vendor listed in interface as shown in enclosed snap?
If you don’t find that vendor then you have two options:

  1. Try to run update from interface and accept any updates and upon system re-start see if you find vendor.
  2. If first step doesn’t work, then re-installation is only alternate.

Please check and let us know.

Thanks
-umesh

#3

Thanks Umesh.
The 2 Opera Software AS /ASA entries are present in the trusted vendor list.
I manually white-listed the exes & after 2 reboots opera has come back.
I assume that the update somehow corrected it’s installation with the rebooting process.

Panic over for now! :wink:

#4

Spoke too soon…
This is obviously not a white-list/false positive issue. (So maybe this thread needs moving?)
I have just lost over an hours work using white-listed apps due to unrequested virtualization of them. Only at the end of the time period did the window hi-lites suddenly appear & all the work reverted to previous state.
Very pis… off !

Additionally I have just found the w7 laptop I have now will not start CIS on boot. CIS diagnostics run & say everything is fine, CIS will manually start but on a boot it will error out & tell me to run diagnostics again. This is every time since update!

The only similarity in this is both PCs use W7x64 & CIS. The other installs vary widely.

How do I invoke diagnostics manually? Can’t see it…

#5

Hi jcmil,

This is obviously not a white-list/false positive issue. (So maybe this thread needs moving?) I have just lost over an hours work using white-listed apps due to unrequested virtualization of them. Only at the end of the time period did the window hi-lites suddenly appear & all the work reverted to previous state. Very pis.... off !
After you observed Opera entries in trusted vendor list, did you see alert for Opera again? If not but for other applications, please re-install latest v10 and re-check this behavior of seeing alerts for known safe applications. Regarding following:
Additionally I have just found the w7 laptop I have now will not start CIS on boot. CIS diagnostics run & say everything is fine, CIS will manually start but on a boot it will error out & tell me to run diagnostics again. This is every time since update!
This is a known issue, for which we posted following previously, see if that helps:
Following are known issues as have been observed in last release: [b]Issue - A:[/b] Many users have reported [url=https://forums.comodo.com/bug-reports-cis/comodo-security-agent-could-not-be-started-merged-topics-t118753.0.html]Comodo Security Agent could not be started[/url] problem upon system re-start.

Re-production:
This bug can not be produced always.

Reason:
Upon system re-start, cistray.exe could launch before Comodo services started.

Impact:
There is no security impact. You are still protected. You just do not see CIS interface.

Possible Workaround:
Step - 1: Try to launch CIS interface from desktop shortcut, if doesn’t work try step-2.
Step - 2: See if you can locate CIS tray icon in system tray, exit and try to launch CIS interface as mentioned in Step-1, if doesn’t work try Step-3
Step - 3: Locate cistray.exe in TaskManager, terminate and launch CIS interface as mentioned Step-1

We plan to make update on 24th April, 2017 that is supposed to fix above mentioned problem.

Thanks
-umesh

#6

Thanks Umesh
FYI When I click on the link I get The topic or board you are looking for appears to be either missing or off limits to you.
I’ve been starting CIS via the shortcut.

I did a fresh install on the laptop.
Not easy as it wouldn’t accept the installer as an upgrade, it gave an Endpoint error when trying to use the CIS uninstall & windows said it was already uninstalled.
Used the Removal tools & finally got a new copy on.
I found from that moment on IE11 would not access the Internet. CIS updated the definitions, and other software could use the Internet. Windows troubleshooter could find no errors with Internet Explorer, and it could see no trouble with the network.

Uninstalled ie11 via Winupdates & reinstalled - still no way it will access the Internet. A clean install of the latest build of Opera however did without issue.
I then ran today’s update which said it resolved issues with the white list of vendors.
After CIS req’d reboot, opera would not access the Internet and despite opera being in the white list of vendors, it was being blocked by CIS - see screen.
Whitelisted it all again. Opera now works on the laptop but not IE - cannot see why???

Opera is OK on the PC but I have had to whitelist things again after the latest update.

#7

Please find merged topic here
https://forums.comodo.com/bug-reports-cis/comodo-security-agent-could-not-be-started-merged-topics-t115574.0.html;msg855156#msg855156

#8

Hi jcmil,
We don’t see the behavior your described with IE11.
Does it work with Comodo Firewall disabled?
Does it work when you don’t have CIS?

I then ran today's update which said it resolved issues with the white list of vendors. After CIS req'd reboot, opera would not access the Internet and despite opera being in the white list of vendors, it was being blocked by CIS - see screen.
May you please share diagnostics report? You should not be seeing problems with fresh installation!

Thanks
-umesh

#9

Thankfully my Opera problems have passed.
I didn’t have any diagnostics reports BTW as I cannot find the button to run diagnostics any more. It only comes up when CIS fails to start & then says all OK 88) Has the option to run diagnostics manually been removed?

However I still have a few problems on the laptop, now I have opera working on both PCs but not IE11 on the laptop ???
I am seeing infrequent random CIS issues on laptop boot-up: -
Sometimes CIS won’t start, or locks up or gives the error message asking to run diagnostics & finds no error.
I estimate I may see one of these problems once in 3 or 4 cold boots.

I cannot see any reason why IE cannot connect to the net. Windoze says it can find no errors, tried uninstalling & a fresh download & install of IE from MS - same problem persists.

Anyone have any ideas about a deep scan/removal of IE11 so I can verify there isn’t some sort of corruption in it?

#10

Spoke too soon.

PC wouldn’t finish booting this morning, froze on desktop, no input possible.

Booted in safe mode & opera is blocked again! 88)
Unblocked it again & PC now boots.
Not clever…

#11

What component is listed as blocking opera? Then check the relevant event logs to see why e.g. if its blocked by AV check av logs, HIPS or containment, etc.

#12

Thanks for the reply futuretech
The logs are vague/not very helpful & there seems to be a contradiction in how CIS is handling Opera.
It is blocked then unblocked by me, it goes back to being blocked but is functional… :-\ ???

Note the timestamps, I have had to re-unblock Opera just now.
I attach images of the logs for the events today. (jpg title shows log source).

#13

That is normal because cis is protecting its processes from memory injection. see similar issue here https://forums.comodo.com/defense-sandbox-help-cis/solved-unblock-applications-for-good-t119030.0.html;msg855843#msg855843

#14

I realized that that must be the case.
What I didn’t understand was the contradiction of being shown in ‘blocked apps’ again, i.e. after unblocking & having the HIPS rules set to ‘allow’ in the rules dialog.

Currently HIPS shows ‘launcher.exe’ as having ‘allow’ for memory access etc. (for the second time).
I wonder if ‘launcher.exe’ can/will again appear in ‘blocked’ & if so, will its’ functionality will be restricted?
I say this cos the 2nd entry of that file in the blocked list didn’t seem to actually do anything to ‘launcher.exe’ functions.
Today I have seen these 3 states:-

  • blacklist/block
  • unblock/whitelist
  • blacklist/allow

Hope that why I find this contradictory is clear.

#15

I had to hit reset a bunch of times today as PC is freezing on desktop at boot again.
CIS gives no errors or events in the logs.
I finally found that if whilst in safe mode I turned off Containment HIPS AV & VS - I could then boot & start them manually & the PC is ‘fine’ :-\ 88)

Event viewer gives me for every failed load -

  • 10005 - DCOM got error “1068” attempting to start the service fdPHost
  • 7001 - The Computer Browser service depends on the Server service which failed to start

DCOM, RPC & Security Accounts Manager all start OK.
I have no NetBIOS over Tcpip in Non-Plug and Play Drivers.

The point of lockup appears to be when my VPN client (ibVPN) is being initialized.
ibVPN also provides an app/extension for Opera & Chrome which I have installed - could this be the problem?
I have given the exes full permissions but this may explain whats happening. Any way you can investigate this?

#16

This is just an FYI
\opera\launcher.exe is back in the ‘blocked’ list for ‘access memory’.

#17

Just add opera launcher to the inter-process memory access protection exclusion of CIS HIPS rule to stop it from showing up in blocked applications. Also fill out a bug report for the vpn issue if you can replicate the issue every time.

#18

OK thanks. I have now fully whitelisted that file.

I don’t know if it is a clash with the VPN this is a supposition based on behavior that I can see but no logs are being written for me to say definitively. :-\

#19

Didn’t have any boot-up issues since manually extending the whitelist inclusions for Opera & the VPN procs.
Looks like it may be solved.