Persistent data being sent to Comodo servers after uninstall

[rozojaru]

I recently installed Comodo antivirus on my windows 8 tablet. After about a week, I decided I was not happy with it and performed an uninstall.

Even after uninstalling Comodo software completely, Wireshark, a network traffic monitoring program, still shows data being sent to Comodo servers.

On the Comodo forums, there are instructions towards how to uninstall the software. After following these instructions, there is still evidence of my computer sending data to Comodo servers.

To remedy this, I reinstalled windows 8. After reinstalling windows 8, there is still traffic being sent to Comodo servers.

This is unacceptable. Provide me with instructions on how to stop this.

[SanyaIV]

To which Comodo servers is traffic being sent to?

[rozojaru]

Peerblock shows

178.255.83.1

[SanyaIV]

@rozojaru post:3

Peerblock shows

178.255.83.1

The host of that IP is supposedly ocsp.comodoca.com where OCSP probably stands for Online Certificate Status Protocol and the “comodoCA” probably means it has to do with Comodo’s Certificate Authority business and not any of their other products. By the way, do you use any other Comodo products like Comodo Dragon or Chromodo etc? If so then it could also be originating from those.

[L.A.R_Grizzly]

Maybe you’re still using Comodo Secure DNS?

[rozojaru]

@L.A.R. Grizzly post:5

Maybe you’re still using Comodo Secure DNS?

Not using any Comodo software. Again, this is after a reinstall of windows 8 on the tablet.

@Sanya IV Litvyak post:4

The host of that IP is supposedly ocsp.comodoca.com where OCSP probably stands for Online Certificate Status Protocol and the “comodoCA” probably means it has to do with Comodo’s Certificate Authority business and not any of their other products. Edit: Previous sentence is not necessarily true, just my guess but they could of course use comodoca.com for other things as well. By the way, do you use any other Comodo products like Comodo Dragon or Chromodo etc? If so then it could also be originating from those.

All software was uninstalled, the traffic persisted. After that, I reinstalled windows 8, and the traffic remains.

[L.A.R_Grizzly]

@rozojaru post:6

Not using any Comodo software. Again, this is after a reinstall of windows 8 on the tablet.

When you reinstalled, did you wipe the tablet or restore the OS? If you chose to use Comodo DNS when you installed CIS, uninstalling CIS may have not returned your machine to its default DNS setting. You may still be using Comodo DNS. You should check to be sure:

SecureDNS Support | DNSbyComodo.com

[SanyaIV]

@rozojaru post:6

Not using any Comodo software. Again, this is after a reinstall of windows 8 on the tablet.

All software was uninstalled, the traffic persisted. After that, I reinstalled windows 8, and the traffic remains.

While the following link is about an unrelated and outdated issue it still contains technical information relevant to your issue. InfoSec Handlers Diary Blog - SANS Internet Storm Center

@https://isc.sans.edu/diary/ocsp.comodoca.com+blacklisted+(by+comodo+itself)/13606

OCSP is a newer web service that allows clients to verify if an SSL certificate has been revoked. The older standard, CRL (Certificate Revocation List) required that browsers download the entire list. With OCSP, it is possible to query the status of an individual certificate. The certificate has to have the URL for the respective CRL or OCSP service embedded.

Many browsers will accept a certificate, even if the OCSP service does not respond. They will only mark it as invalid, if the OCSP service responds with a result marking the certificate as revoked. However, for Extended Validation (EV) certificates, browsers tend to be more specific and require a positive OCSP response.

ocsp.comodoca.com appears to be the valid OCSP URL for Comodo. For example, the certificate used for https://www.comodo.com uses this particular OCSP URL.

That leads me to believe what you are seeing is caused by visiting a website using a Comodo certificate which points to the OCSP in question and then your browser sends a request to the OCSP in question which results in you seeing the traffic. Looks normal to me.

[rozojaru]

@L.A.R. Grizzly post:7

When you reinstalled, did you wipe the tablet or restore the OS? If you chose to use Comodo DNS when you installed CIS, uninstalling CIS may have not returned your machine to its default DNS setting. You may still be using Comodo DNS. You should check to be sure:

SecureDNS Support | DNSbyComodo.com

I don’t know how else to say it. Windows 8 was reinstalled. DNS settings did not persist. I have them manually set to OpenDNS.

[L.A.R_Grizzly]

@rozojaru post:9

I don’t know how else to say it. Windows 8 was reinstalled. DNS settings did not persist. I have them manually set to OpenDNS.

OK. Just mentioned it to be sure.

[Melih]

if you are seeing any Comodo certificate (if you are in this forum, you will of course see a Comodo SSL certificate), then it will check the status of it using OCSP protocol.
Considering that over 40% of the ssl certificates in the world are Comodo certificates Usage Statistics and Market Share of SSL Certificate Authorities for Websites, April 2023 , you will see the communication with our OCSP protocol 40% of the time when visiting an HTTPS secured site.