A. THE BUG/ISSUE (Varies from issue to issue)
[ol]- Summary - Give a clear summary in the topic subject, NOT here.
Can U reproduce the problem & if so how reliably?: Happens periodically, but fairly often. Has been noticed on three different machines running running either XP Home/Professional (32 bit) or Win 7 Professional (64 bit).
If U can, exact steps to reproduce. If not, exactly what U did & what happened: a: Let the computer boot up and check if CIS icon has loaded, sometimes it loads as the first, some times it takes a few minutes and when the error occurs it doesn’t load at all. However, cistray.exe, cmdagent.exe and cavwp.exe is running (■■■ seen on the first two attached images). b: Pressing yes in the error dialog (see attached image) and loading diagnostics. cistray.exe then opens cis.exe and terminates itself. c: Diagnostics did not find anything (as seen from the third attached picture). Once the report is generated the cis.exe instance loaded by cistray.exe terminates as well.
If not obvious, what U expected to happen: Expected CIS and all it’s processes loads and runs after every boot.
If a software compatibility problem have U tried the conflict FAQ?: N/A
Any software except CIS/OS involved? If so - name, & exact version: Not that I know of.
Any other information, eg your guess at the cause, how U tried to fix it etc:
A reboot always fixes the problem, after a reboot the CIS tray icon loads perfectly. However, on the laptop i lent to my family/firends they just press no to the warning an keep working even though the security agent did not load. I fear that could compromise the security of machines.
My guess is that cistray.exe times out due to high machine load at boot. However, opening extra programs ASAP after boot doesn’t seem to affect the error. First time I tried I got the error, but next time the CIS tray icon appeared almost before I could manage to open one program.
As seen from the attached image (and described above) cistray.exe is infact loaded even when the error occours. However, it unloads itself once the diagnostics process is started.
This could be connected with having low free disk space on the computer and thus the high machine load I mentioned earlier. I haven’t verified it but I think the problem is more frequent when there’s less free space available on the computer. At least the HDD indicator LED on my laptop is constantly on during boot (while programs load after OS boot), i.e. a high load on the HDD as it is not even blinking.
The funny thing is that if I open CIS main GUI after the error appears the tray icon appears and the status in the main GUI says that it’s secure (as if everything loaded fine once the program was manually opened). This has been reproduced twice on two different computers (once with CIS 6.x on XP and once with CIS 7 win 7).
Two new diagnostics reports, from two computers on which this is seen, are attached to this post.
[/ol]
B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- Exact CIS version & configuration: CIS v7.0.313494.4115 (has been noticed on previous versions as well, though less frequent [even on 5.x]).
Configuration: Proactive Security
Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV: D+/HIPS on, Autosandbox off, BBblocker on, Firewall on, AV on.
Have U made any other changes to the default config? (egs here.):
AV: Heuristics Medium
HIPS: Enabled, Adaptive mode on, Enhanced mode on, Safe mode
Behavior blocker: Auto sandbox off, Detect programs on, Show privilege on, heuristics on, shellcode on.
Firewall: Customs ruleset, detect private network on, traffic animation on, filter loopback on, block fragmented on, protocol analysis on, anti ARP on
Have U updated (without uninstall) from a CIS 5?: No. Clean install
[li]if so, have U tried a a clean reinstall - if not please do?:
[/li]- Have U imported a config from a previous version of CIS: No
[li]if so, have U tried a standard config - if not please do:
[/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Win XP Home SP3 32 bit
Win XP Professional SP 3 32 bit
Win 7 Professional SP 1 64 bit (fully updated)
Other security/s’box software a) currently installed b) installed since OS: a=No b=No
[/ol]
As you have noticed this on multiple computers I will not ask you to see if reinstalling can fix the issue. However, please attach a list of the running processes after the computer fully loads for at least one of the computers (best if for all). It’s possible that there is some sort of interference from other programs, and this may point the devs towards the issue.
Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.
Developers may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.
A quick question (related to the format, for future reference): In the XML file generated by the diagnostics tool there is a list of the processes and their loaded modules at the time of the error, since I had to attach process list separately I was wondering what the differences on these two are?
Hope that’s not too off topic now that the post is in the format verified board
Thanks again for the quick responses!
Keep up the good work!
No problem. Thank you for providing such detailed information.
I’m actually not sure. I hadn’t realized that the processes are logged in there as well. However, I checked on my own system and found that the KillSwitch Process List contains more processes than are logged in the XML file. Thus, perhaps the diagnostics report only logs certain processes, which are commonly associated with problems, whereas the KillSwitch one logs them all.
I forgot to mention that I suspect that it could be connected with having low free disk space on the computer and thus the high machine load I mentioned earlier. I haven’t verified it but I think the problem is more frequent when there’s less free space available on the computer. At least the HDD indicator LED on my laptop is constantly on during boot (while programs load after OS boot), i.e. a high load on the HDD as it is not even blinking.
PS: Got another report from an error appearing after I posted this bugreprt. Do you want me to add them when I get more reports?
I have added the information about low-free space being a possible cause to the first post. As for the error report, if it seems that it may have information which was not included in the one attached to the first page it’s not a bad idea to add it. Please attach it to your next post, if it seems to have additional information.
I just did a test with low free diskspace (10.5 GB out of 148 GB) and I was able to reproduce the error three times in a row. Timed one of them and the error appeared about 6 min and 30 sec after I pressed the on button (I guess about 5 min and 30 sek from logon).
Also this was the first time the error reappeared after a reboot. One of the times I even got the windows warning that the antivirus and firewall etc. was off. Though the warning disappeared a couple of minutes later (before the error appeared).
On the fourth reboot the CIS icon appeared after 6 min and 55 sec from I pressed the on button (5 min and 55 sek from logon to windows and 5 min and 5 sek from desktop was visible).
The test was done on the Win 7 64 bit system.
I’m not going to test the low disk space further as I need to be able to work on my computer. Also I’m more certain now that the low diskspace is the main reason for the error.
I also have the error reports from the above test. However, I don’t know if any of them provide additional information. Maybe you can add a note for the developers that there’s more reports available if they need them (they can ask me to upload them). I’ll keep saving reports when I get the error just in case
Good idea. I have now updated the tracker mentioning that if they require additional error reports they can feel free to contact you. Also, I added that if they think looking at different scenarios would be helpful that you would be willing to try them. I hope that’s okay.
Yeah I just experienced it again on the win 7 machine (it’s less frequent after I freed up the space on my HDD).
I’ll do a clean install of CIS 7 and let you know if I experience it on the newest version, but as it is periodic it might take some time before it happens.
If it starts being more frequent again I can also test acidvenom’s suggestion.
Another funny thing I tried: After creating the diagnostics report I tried opening the CIS main GUI and the icon appeared in the tray and the GUI said “SECURE”, so seemingly everything worked fine if I manually open CIS main window when the error occurs (have reproduced this twice).
Strange. Let me know what continues to happen. If this becomes a somewhat serious issue we can move this back, collect more data, and reopen this in the tracker.
I uninstalled CIS 6.x and installed CIS 7. I’ve now gotten the error two times on my Win 7 computer after installing CIS 7.
The last time CIS also failed to save the diagnostics file and asked if I wanted to retry, after a couple of retires it worked and the file was saved.
The funny thing is that if I open CIS main GUI after the error appears the tray icon appears and the status in the main GUI says that it’s secure (as if everything loaded fine once the program was manually opened). This has been reproduced twice on two different computers (once with CIS 6.x on XP and once with CIS 7 win 7).
