outlook does not work follow up

I can’t get outlook to work to send and recieve e mails: When i ck the log it notes the following:
Descrip: Suspicious Behavior (outlook.exe)
Ap: \office11\outlook.exe
parent: system32\svchost.exe
protocol; TCP out
destination: …:pop3(110)

based on the notice i denied the connection. now i can’t get outlook to send and receive e mails unless i allow all of the access. how do i get back to the old setting that worked with outlook. thanks very much for your help

What are the details of your current Rule for Outlook in the Application Monitor?

svchost.exe is a known safe application, and is generally okay to allow; if you’re using a proxy server, you may even need to allow it in order to connect/access the proxy.

You asked how you get back to the old setting that worked with Outlook… to what are you referring? Did it work with CPF before, and has since stopped?


PS: Welcome to the forums! (:WAV)

thank you so much for your help… i like comodo…
the application monitor says the following;
application: Outlook.exe
distination: any
port: any:
protocol: tcp UDP out
permission: allow

Network Monitor says:
allow for all except
block for Protocol IP in/out
source: any
destination: any
criteria where IPROTO is any
blocks and log IP in or Out from IP (any) to IP (any) where iproto is any

With regards to it my reference to the old settings: I really don’t know what they were except I denied contact w/the net when asked by comodo . this evidently blocked outlook.

again thanks for your help… Paul

Okay, your App rule looks okay… however, what’s the “Parent Application” shown by the rule?

Also, the Network rule you’ve quoted would seem to be blocking everything… In or Out. If you can, take a screenshot of your Network Monitor, save it as a JPG (or similar image file), and attach to your post under “Additional Options.” (Just a note: If it shows your IP address, edit the image file to erase/cut the IP address.) By looking at that, I may be able to spot a discrepancy.


thanks tried to take a screenshot but it wont take. Also, not sure what parent application you are referring to … the only block is
ID 5 says block and log;
protocol In/Out
destination any
criteria where ipproto is any

when i click on the block and log to dialogue box say source IP any
action block
protocol ip
direction in/out

the network monitor has the following
I. Permission protocol Source Desitmation Criteria
0 allow tcp/udp… any any where source port is any and distination port is any
1 " IMCP out " " where ICMP message is echo requrest
2 " ICMP in " " where ICMP message is fragmentation needed
3 " ICMP in " " where icmp message is time exceeded
4. allow ip out " " where ipproto is gre
5. bock & log IP/in/out " " where ipproto is any

I hope this helps still have to disable should i re install comodo

Okay, Paul,

It looks like your network monitor contains the basic, default rules. That’s good; this works for the majority of systems/configurations/users. Let’s leave that for the moment, and focus on the application aspect of it…

Refer to the attachment at the bottom of my post; it’s a jpeg of a screenshot of a rule existing on my computer for my email client, Thunderbird. I got to this point by going to the Application Monitor, and double-clicking on the rule I want to see (you can also single-click to highlight, and choose Edit). The top line contains the Application Name/Path, and the second line contains the Parent Application/Path. What we’re wanting to look at is the rule (or rules) currently in your Application Monitor, for your email client, for Application, Parent, and rule details (allow, block, In, Out, etc). If you can’t get a screenshot, you can just type in your post…

I don’t think we’re at a reinstall point yet… :wink:


[attachment deleted by admin]

your are great thanks for the help… happy new year how do i get a screen shot…

Application/parent application
c:\program files\microsoft office\office11\outlook.exe
specifiy a parent
c:\program files\mozilla firefox\firefox.exe
apply the following criteria:
general: action allow, protocol tcp or udp, direction out
Destination IP: any
desitination port: any
misc: non selected

You shouldn’t have any problem with that rule for Outlook. I’m using outlook, and the parent is explorer.exe, rather than the browser, but that’s probably not a big deal. You can always go in to Edit the rule, and either change the Parent to explorer.exe (which will probably be c:\Windows\explorer.exe), or reset it to “Learn the Parent” ~ if you want. It might speed up your connection a bit, but probably not where you would reasonably notice it. At any I really don’t think that would be the cause any problems.

Try this: In CPF, go to Security/Advanced/Miscellaneous, and uncheck the box for “Do not show alerts for any applications certified by Comodo”. Then move the Alert Frequency up to High or Very High. Reboot. This will increase your alerts, and you should see more of what’s going on. If you get an alert that Outlook is trying to connect using svchost as the Parent, click allow. You don’t have to click “Remember”; just allow at this point. If every time after you reboot, you get the same thing, then maybe you’ll need to put it to “Remember” so as to create the rule automatically.

As far as capturing a screenshot, here’s what you do: With the information on your screen (where you can see it) that you want to capture, press the Control key (“Ctrl”) and Print Screen (“PrtScn” - usually somewhere above your Delete key). Now it’s captured in your clipboard.

Open a photo/image editing software (which you’ll probably have if you have a scanner, or a digital camera), and select to Import from Clipboard (probably under “Edit”). From there you can save the image as a jpg, gif, png, etc file. You can also Crop it to just the area you want, which will make it easier to see details. If you don’t happen to have any such software, there are free softwares available that can provide you this capability.