Playing with and exploring CIS 6882 and 7036

I just installed it from scratch yesterday. Before that, there were no problems in 1909.

I don’t know how you have your system set up or what Configuration you are using; but I just tried the first 4 on the list from that website. None were recognized, which isn’t surprising since they’ve just been around since today. HIPS warned on every one giving me the choice . . .

Just for interest I allowed the last one to run as contained, which of course treated the File manager as contained (which would have been Windows Explorer if I used it). That naturally blocked access to the drive where the data on this machine is stored as it is set as a Protected Folder . . . even after a reboot which worked fine otherwise. Removing the HIPS entry for my File Manager from the Rules which had it as contained, restored everything to normal as expected.

If you had a similar HIPS entry, then Windows Explorer wouldn’t run on startup

Plus, I’ve never had a WSC warning for this CIS version and very rarely for the previous versions. Windows Firewall is turned off and stays turned off, but is still running as a Service

Hi Nunzio,
I have the latest licensed CIS Pro version, I tried to download Malware from the named site, none can be decompressed because Windows 10 refuses decompression (see image)
To activate the protection guarantee Comodo requires a very precise paramatrège of CIS (I specify)
I have carried out eicar tests on kasperky and CIS blocks all malware from downloading

To unzip the files you must enter the password: infected
I with 7 ZIP I unzipped them all without problems.

I reinstalled it and here is the result … a really big disappointment … I tried several times to restart to deactivate and reactivate but nothing … Furthermore if you deactivate and reactivate a component the icon in the status bar remains with the X. :-TD
Since 6882 we have waited almost 1 year for a new “stable” version and this is the truly disappointing result …
Then maybe it works for others but I believe that a security application should work on all PCs and without great efforts to make it work …
I go back to Kaspersky … at least they are more reliable in stability and frequent updates of new releases if something does not work well.
I’m sorry to leave COMFORTABLE but in these conditions I can’t do anything else. :frowning:

The user needs to keep in mind that HIPS alerts in Comodo apply to the object being mentioned at the LEFT side in the alert. If they choose the option to treat as: Blocked Applications, then explorer.exe which corresponds to Windows Explorer will be blocked from running other executables and this will cause problems in the system.

I even saw a Youtube tester commit this mistake once while testing Comodo and worse of all, he initially thought that Comodo allowed an infection. In the end he had to delete his video because of this silly mistake, but the point is: If you don’t know how to properly answer HIPS alerts in Comodo, you may as well destroy your OS. So users are advised to:

a) Set HIPS to Auto-Block in HIPS settings.
b) Disable HIPS.

I really don’t see the need for all this lamentations if the user just answered a HIPS alert in the wrong way.

EDIT: Also, this:

Sorry, after decompression the latter has been deleted by the protection of Firefox in download

The HIPS I have always kept it off, I only wanted to do a test yesterday and maybe I would have made a wrong choice even if I remember choosing to start in the container (I don’t think it’s wrong) was referring to explorer.
In any case, I would never reactivate HIPS, since it always gave me problems with the functioning of the PC.
Now the important problem is that now the new version of CIS with a clean installation does not work … for the problems I mentioned above and for which I have delegated the screenshots.

If you try to manually run a file or Malware through Windows Explorer, it will generate a HIPS alert for Explorer.exe.

The correct way to Block a thing through HIPS is answering with: Block > Block Only. Or you can allow it’s execution to test if will be Contained, or if HIPS will alert for its actions (then again Block > Block only or Block and Terminate).

Selecting “treat as:” option will change the HIPS ruleset for the Object at left side in alert, in this case Explorer.exe which will cause system malfunction with any other ruleset than the default ruleset (allowed application).

If you reformat your system and install latest Win10 Build the issue with Security Center will most likely get solved.

Thanks but I prefer not to format the PC to make the new version of CIS work …
Since with Kaspersky Cloud Free I have no problem, I first change antivirus software that format the whole PC and restore everything.
Sorry but honestly it seems a bit exaggerated that to make CIS work I have to format the PC … ;D

If possible then re-format your OS (Windows 10) HD partition and re-install the OS on that partition and then wait to get all the MS updates before installing CIS and other software again. I know, this is awfull lot of work but believe me if your OS is damaged, be it on the file system or in the registry, you can never repair it by using any cleaning tools. In fact such tools can make things even worse and drag you into more problems.

Seriously, whenever you think you OS is damaged then start all over by re-installing your OS, you just can’t repair it by using cleaning tools.
The only good way to restore a damaged OS is to put back a full HD backup image on the OS HD partition but for that to work you need to have access to your HD with a Dual Boot system or take out the HD from your system and re-image it on another system where you kept the HD backup image on. You need some expertise in doing this but unfortunately it is the only good solution to repair a damaged system.

Keep in mind that Security Center is just aesthetical thing and it’s function is just to report if security programs are enabled or disabled, by colecting information from them. It does not increase security or reliability of anything.

If I were you and not wanting to reformat, I’d do the following:

  1. Manually disable Windows Defender through Group Policy or other means.
  2. Do the same for Windows Firewall.
  3. Manually shut off Security Center through services.msc or other means.

So no, you are not reformating or doing the above to “make CIS work”, you are doing this to make a Windows feature, which is flaky and prone to malfunction, work, just so it will tell you that the modules in Comodo are enabled, when Comodo GUI already does that for you. ;D ;D ;D

But if my operating system would be damaged and therefore the Windows 10 security system would be damaged why does it work perfectly well for example with Kaspersky Security Cloud Free?
I reinstalled it again and it responds perfectly (see attachment).
I tried to deactivate and reactivate the protection of KSCF and the Windows security system always works optimally and is more reactive even when the PC is restarted, KSCF is recognized within a maximum of 1 minute, while with CIS in the reboot I had to wait even up to 5 minutes to be recognized.
In my humble opinion there is something wrong with CIS (especially in this new version) with the Windows 10 security center. Then it will surely be only a graphic thing but also the X that remains on the CIS icon in the status bar despite having all the active components is a graphic but very annoying thing.
I prefer software that works without bugs.
Comodo knows that it has yet to work for compatibility with Windows 10 and predict example from other software manufacturers.
Obviously this is always my personal impression that I learned from these experiences and I start by saying that I like COMODO products if unfortunately they would not create these annoying problems. :wink: :smiley:

If I were you I would not leave Comodo just because of this simple problem. Just disable Security Center, WD and Windows Firewall and be happy.
Or even better, install KSC Free alongside Comodo Firewall, by setting mutual exception rules they work great together.

When you test with real Malware samples and KSC Free is bypassed you will want to return to Comodo. If something is not on Kaspersky’s database it will most likely allow an infection, System Watcher (and any other Behavior Blocker) may fail against Malware that act by co-opting legitimate system processes according to Cruelsister. Security Center issue is not important and other users already reported they are not facing such issues.

But what if instead of CIS I try to install only CAV?
Would I still be safer with CAV than with KSCF?
Thanks.

Yes of course. CAV includes Auto-Containment and Embedded Code Detection feature to prevent Malware that co-opts legitimate system processes, as well as any other Malware, known or unknown. Also HIPS is stronger than System Watcher.

Ok you convinced me. ;D
I try first with “regedit” to remove all of COMODO and reinstall CIS. If it still doesn’t work, try again with CAV.
Thanks. :wink: :-TU

No problem friend and make sure you uninstall CIS using the Uninstaller Tool and install either CIS or CAV using the Offline Installer, and to attempt a fix at those Security Center issues, try following this to reset Security Center to a clean state.

I’m sorry but despite having done as you suggested the problem with CIS and CAV is the same, nothing has changed.
The strange thing that the same problem does it also on my sister’s PC on which there was CAV.
I don’t know what else to do just that I don’t want to format the PC.
I’ll see later when and if a new version of CIS / CAV will be released.

Thanks friend for the support. :smiley:
We’ll update. :wink: :-TU

As [at]mmalheiros wrote, I would change to Kaspersky. CIS runs on my computer without problems. One problem (I wrote about this), was the problem with the ping and [at]mmalheiros endeavoured to help me, but to no avail. With the new release of 7036 the problems was solved. I didn’t find the problem. What I want to say is if your problem is such a big problem I would change to Kaspersky, and maybe your problem is in your system (so it was in my case). You waste your time.