Performance issue with HIPS enabled

Hi.

I have noticed that CIS 12.0.0.6818 HIPS is causing the following issues:

  • High Disk Usage quite regularly (sometimes around 20-30%)
  • Stuttering when typing i.e. If I hold down a key in a text doc it will type around 10-20 characters then pause for a second, then continue to type
  • Stuttering in game. When new data is loaded into the game the game freezes for about 1-2 seconds.

All of the above is resolved by turning off HIPS.

I have tried reinstalling CIS but this has not helped.

Please PM me with which logs and dumps you would like.

P.s. Apologies for posting this thread in the wrong forum. Please move this topic to the Defence+ Help Forum.

Thanks.

Reece

Try uninstalling ISE, Secure shopping and using your ISP’s DNS instead of Comodo servers. I was having some game issues and removed those myself and notice a noticeable performance increase and no longer the lag issue.

Probably an idea to try it one by one and see what works for you. I don’t use Comodo DNS as my ISP utilizes IPv6 and it’s more stable.

Eric

Can you check resource monitor disk tab to identify the process using the most disk and what file it is accessing. I’m guessing it is the excessive writing to the cis log file. Also check HIPS logs to see if there are many blocked events being logged.

I have just reinstalled ISE and I don’t use Comodo’s DNS anyway actually.

So… yup… as soon as I launch Steam cmdagent.exe > COMODO Internet Security Helper Service starts using 20 - 30% HDD and won’t stop doing so until I close Steam.

According to Resource Monitor, cmdagent.exe is mostly writing to

‘C:\ProgramData\Comodo\Cis\lmdb\cmddata’
as well as
‘C:\ProgramData\Comodo\Firewall Pro\cislogs.sdb-journal’

According to CIS Logs, HIPS is continuously blocking steam.exe from accessing cis.exe memory.

[Edit] The ‘System’ process is also mostly accessing the ‘cmddata’ file also.

I am guessing ‘cmddata’ is the Log file CIS uses then?

I don’t really want to allow any application to access the memory of CIS… but I am guessing that this is the only way to prevent the log entries?

cmddata is the information database that stores information about files, vendors, certificates, etc. cislogs is where the logged events are stored. With steam it is either the known issue with 32-bit applications being incorrectly being monitored of accessing other processes in memory, or steam really is trying to access cis in memory as part of the anti-cheat that some games use. So you either have to add steam to protection exclusion of inter-process memory access of CIS HIPS rule, or you can disable writing to the comodo log format and use windows event log instead.

I have tried the Windows Logs instead but unfortunately the Disk usage was the same.

What I found was interesting.

- Creating new HIPS rule for steam.exe via ‘Blocked Applications > Unblock for All Components As Shown in Blocked Column [HIPS]’

Results in normal like Disk usage, but continues to show in ‘Comodo Logs > HIPS’

- Adding steam.exe to ‘HIPS Rules > ‘COMODO Internet Security’ File Group > Protection Settings > Exclusions > Interprocess Memory Accesses’

Results in high Disk usage, but does not show in ‘Comodo Logs > HIPS’

The only way to both reduce Disk usage AND prevent entries into the Comodo Logs is to do both.

Would you happen to know why that is?

Can you show a screenshot of disk usage in Resource Monitor (Event Viewer)?

Do you mean Task Manager?

Sorry, I meant Resource Monitor.

Ah, you should be able to see it from the screen shot a few posts up.

[Edit] I would also like to add that I have noticed a substantial increase in the amount of processes that seem to be being blocked by HIPS. I assume this is part of the issue with 32-bit applications .

I have noticed that many process launched by steam including all games tested are also apparently try to access cis.exe memory. I am therefore assuming that this may not be anti-cheat and may actually be related to the 32 bit application issue.

I have upgraded to Windows 10 1903 so it would make sense.

I have also emailed Valve to enquire if Steam is in fact scanning processes in memory.

Pretty much every game through steam is 32-bit so it is the known issue with false memory access on 1903 with 32-bit applications. cmddata also saves information about blocked applications and the quarantine, so anytime an application gets added to the blocked application list or is added to quarantine, then it is reflected in the database. Specifically the last blocked date and time will dynamically be updated in the database.

Thanks for clearing that up futuretech :slight_smile:

I will relay the info to Valve as the false alerts had me thinking steam was trying to access CIS memory.

I would also like to add the following bug.

Even though I create:

  • A new HIPS rule for the blocked file
  • A new Memory Protection exception for the ‘COMODO Internet Security’ File Group for the blocked file

This does not resolve all of the system usage issues caused by HIPS when running these 32bit applications.

I have noticed even with the above rules added, there is still stuttering in game (although far much less of it).

Furthermore nothing new is shown in the Comodo Log.

Once HIPS is disabled, the game will run fine.

Can you check how big cmddate is on disk and to what size it is set in Settings?

cmdata file is 829 MB and the Comodo Log size is set to 20 MB in the settings.

The size may be the problem here. Try deleting it. May be you need to enter Windows in Safe Mode to be able to delete it. Does that make a difference?

Thank you for the suggestion but unfortunately that didn’t help.

The only way that I have tried which successfully solves the game stuttering issue is disabling HIPS all together.

Hi there;
first of all forgive me if I am in the wrong topic.
I have updated to win10 1903 and now I have this problem (see attached image). I had over 65 000 Hips blocked actions. I have de- and reinstalled Comodo CIS and Msi gamingapp/ Iobit advanced care program, but the issue still remains I have try to make own rules for both but if I keep hips activated my gaming performance goes down(from 60 fps to 13 fps). how can I allow those programs the access they want?

???thats not really an answer?!
I dont want to install an unstable version I did that some time ago… but that caused even more problems! i.e comodo icon did not start/show up in taskbar after reboot etc…

hello any Comodo staff member here which are able to give some advice for fixing my problem?