A. THE BUG/ISSUE (Varies from issue to issue)
[ol]- Summary - Give a clear summary in the topic subject, NOT here.
Can U reproduce the problem & if so how reliably?: Yes, fairly reliably.
If U can, exact steps to reproduce. If not, exactly what U did & what happened: While reproducing works with most programs I find it fairly easy to replicate with a torrent client. a: Download a torrent client, portable works well (I used tixati portable) Start the client but don’t answer the firewall alerts. b: Add a new torrent to the torrent client, for example Ubuntu but don’t answer the firewall alerts. c: Go into the advanced settings and create a firewall application rule for the torrent client that says to block IP in and out from any to any with any protocol. d: Untick the “Remember my answer” in the firewall alert and then click Block > Block only e: You will now continue to get these alerts that are queued, Block and Terminate doesn’t help, queued alerts will still come.
If not obvious, what U expected to happen: I expected the queued alerts that now had rules to be disregarded.
If a software compatibility problem have U tried the conflict FAQ?: I don’t believe there is a software compatibility problem.
Any software except CIS/OS involved? If so - name, & exact version: Tixati portable v1.96
Any other information, eg your guess at the cause, how U tried to fix it etc: My guess is that queued alerts simply don’t respect rules created after the alert was queued, it would make sense.
I tried to fix it by killing tixati, had no effect, but rebooting seems to fix it as I suppose it flushes the queued alerts.
Further elaboration can be found here.
B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- Exact CIS version & configuration: 6.3.294583.2937 - Configuration file attached.
Have U made any other changes to the default config? (egs here.): Configuration file attached.
Have U updated (without uninstall) from a CIS 5?: No
[li]if so, have U tried a a clean reinstall - if not please do?: N/A
[/li]- Have U imported a config from a previous version of CIS: Yes
[li]if so, have U tried a standard config - if not please do: Yes, same issue.
[/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used: Windows 8 64bit, UAC disabled through registry, Administrator account, real system (not a virtual machine)
Other security/s’box software a) currently installed b) installed since OS: a= Zemana AntiLogger Free b= Zemana AntiLogger (paid)
I’m a little bit confused. Do you mean that there are already a few popups on the screen when the rule is created, and that after that the popups remain?
Is that what you’re saying, or are you saying that even after creating the rule which should negate the need for the popups the popups keep coming for a while? Please clarify as I can’t quite visualize this yet?
Neither of what you said, in CIS 6 only one alert will show at one time and the rest are queued until you’ve made a decision on the current alert. It’s the queued alerts that still show up even if you manually create a rule that deals with them, so I had to either a) click through thousands of alerts or b) restart … I chose b.
So lets say you have a program called example.exe that tries to connect to 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52 and 184.108.40.206 at the same time.
Now you’ll get a firewall alert for example.exe which says it tries to access 220.127.116.11 however the alerts for 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52 and 184.108.40.206 are queued but not showing on the screen currently.
Now while still at the alert for 220.127.116.11 you go into the advanced settings and create a firewall rule that says to block all traffic for example.exe and you apply it.
Now for the firewall alert of 18.104.22.168 you un-check “Remember my decision” (not needed but to keep the application rule clean) and then block only.
Now firewall alerts for 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206 and 220.127.116.11 will come one after the other… even though you have a rule that takes care of the queued alerts.
Now imagine a program like a torrent client that tries to connect to thousands of people… yeah not a fun time.
You can read more in my help thread found here or my wish found here.
Okay, now I understand. I apologize for apparently forgetting how CIS works. :embarassed: I’ll forward this to the devs.
Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.
Developers may or may not communicate with you in the forum or by PM/IM, depending on time availability and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.
Not fixed in CIS 7.0.308911.4080 Beta. (Started application and got pop up, opened CIS and made rules to allow certain things and block everything else and clicked OK, still getting hundreds of alerts for things that the rules should deal with)