[Solved] Keeps blocking a Trusted manually ublocked file

[Citizen_K]

@Bucic post:4

“Is the functionality of the programs effected?” I’m troubleshooting ArmA’s BattleEye problems and I really wouldn’t want to have CIS as a variable in this scenario. Especially with anti-cheat protection and an injection-based performance monitoring software running. I don’t think I’ll be able to tell hot their functionality is actually affected either.

If you don’t notice the programs are effected assume they aren’t. Anti-cheat protection software can be very sensitive but will block you when it thinks you’re cheating (as far as I understand this type of programs); it would be in your face.

In case or injection based performance monitoring you could try to allowing interprocess memory access and see if the benchmarks differs before and after allowing.

I went ahead and created rules for RivaTuner components, MSI Afterburner and ArmA. After I restarted the system I got HIPS blocking RivaTuner right away.

Date & Time 	Application 	Action 	Target
2019-06-07 00:34:52  	C:\Users\hg1\AppData\Local\Temp\VO4KlzQS.exe.part  	Scanned online and found malicious  	 
2019-06-06 20:07:08  	C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooksLoader64.exe  	Access Memory  	C:\Program Files\COMODO\COMODO Internet Security\cis.exe 
2019-06-06 20:07:05  	C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe  	Access Memory  	C:\Program Files\COMODO\COMODO Internet Security\cis.exe  

Could you please share your take on that?

EDIT:
I forgot to add! I used “Allowed application” HIPS ruleset.

Trusted application does not allow interprocess memory access.

On what Windows version are you? With Windows 10 1903 CIS will erroneously report memory access with 32 bits programs:

@futuretech post:4

It is a bug with 1903 and 32-bit applications in which HIPS thinks those applications are trying to perform inter-process memory access for every running process which includes CIS own processes. Due to self-protection it will automatically block the inter-process memory access and thus you see the applications listed for blocked applications.

If you are not on Windows 10 1903. This tutorial describes how to allow interprocess memory access for an application: Comodo Forum .

Edit: A word of warning. Allowing interprocess memory access to CIS processes introduces an element of risk. It is something we only advice to do when a program is not working properly. Then it is worth exploring. If it turns out that memory access will make the program work like it should then keep it. In case it doesn’t make a difference undo the memory access to CIS processes.