store apps fail on first run, (or more), after CIS install. Reboot is only fix.

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
1

CIS Product Version: 10.0.1.6223
System: Gigabyte Z97-D3H-CF (Custom Desktop PC)
OS: Windows 10 Home 64bits (Creators Update)
CPU: Intel Core i7 4790 [at] 3.60GHz
RAM: 32GB Dual Channel
Graphics: NVidia GeForce GTX 1080 (Founder’s Edition)
Sound: RealTech HD Audio
Display: Samsung HDTV x2
Network type: Wi-Fi/Ethernet (Interchangeable)
Drivers: All software, and drivers are up to date
Storage Space: LOTS

NOTE: This is a new clean install of Windows 10 - Creators Update (Installed around the 24th of April). CIS was installed 2-3 days ago. System is clean.

Store apps affected so far include:
Store (Windows Store) (Corrected by reboot)
Mail (Corrected by reboot)
Calendar (Corrected by reboot)
Photos (Corrected by reboot)
Skype (Corrected by reboot)
AccuWeather (Currently affected)
OneNote (Currently affected)

Symptoms:
Affected store apps open, show a splash for several seconds, then simply close with an error stating that the app failed to start within the specified time.
Event viewer shows either “The app failed to start” or “The app failed to start in the specified time” for affected apps. So far, reboots seem to correct the issue.

At first, I thought this was a problem with HIPS, and Auto-Containment, so I disabled them, but this continues to happen. I believed this was caused by the file rating portion of CIS, but OneNote was not flagged as a unrecognized file, so I still don’t know the cause. There are a few store apps that were not affected, (The Weather Channel for example), so this seems to be an intermittent problem, but I know it’s related to CIS, as I had absolutely no problems, until installing CIS.

Things I’ve tried:
Set HIPS to safe mode (No change)
Set HIPS to Training Mode (No change)
Disable HIPS (No change)
Disable Auto-containment/sandbox features (No change)
Completely disable Virus Scope (Reboot/testing needed)

I’m pretty sure I’m headed in the right direction with the troubleshooting, but if anyone has any ideas, it’d be much appreciated.

EDIT: I may have determined for sure that this is caused by Virus Scope’s behavioral analysis. After disabling it, and rebooting, no newly run store apps hang, freeze, or crash abnormally, and those listed as currently affected run normally. Sounds like this may be a bug.

2

Is VirusScope set to monitor only applications run in containment in VirusScope settings?

3

yes. that box is checked in settings.

4

I just tried and have no issues running mentioned store apps. I am using the proactive configuration and have set VirusScope to monitor all applications. Try adding the all applications file group to AV exclusions if you have the anti-virus installed.

5

well i mean… I don’t have any problems now that I’ve disabled virus scope, and I do have the antivirus installed. I would think that if this were the AV, it would still be happening… wouldn’t it?

6

Only reason I say that is because I have added the all applications file group to AV exclusions and had VirusScope enabled and I had no issues. But if it is related to VirusScope its weird that you are only getting this issue.

7

I’m wondering…

When I installed CIS, I made changes to my settings before i rebooted, customizing them the way i wanted them. When I did the reboot, i had to disable, and re-enable everything to get alerts to start appearing.

could changing my settings before the first reboot possibly be the culprit?

8

Maybe I have never tried changing settings before the requested reboot.

9

No idea how to add file groups to AV exclusions list. I only see ways to add paths, and specific apps

10

Click the add button and you will be given the option to add file groupss, files, or folders. This is of course under the excluded paths tab.

11

ok i added the exclusions, then turned virus scope on, and changed HIPS to safe mode. Give me a bit to find a store app that i haven’t run yet, and I’ll report back

EDIT: I ran several different store apps (something like 10 different ones) and had no problems, but I can’t be sure yet. I’ll test it over a few days. The exception that I added was metro apps, instead of all applications.

12

after making those changes above, and turning things back on, the problem has resurfaced.

Mail - Crashed on launch, opened normally second time
Store - Crashed on launch repeatedly
Skype - already running

I did install CIS from a download I had from before my reinstall of windows. If this already downloaded installer was from a version before the update designed for the Creators Update, and the app updated itself after… could this be the cause? I ask because I remember seeing that a certain update had to be applied before the creators update was installed on my previous install.

If it is, is there an easy fix that doesn’t require me to reinstall windows again? I know these security apps can be picky sometimes.

13

Uninstall and then install using the installer from the release topic. If you want you can also use this removal tool and run it using run as administrator and reboot after it completes before installing CIS again.

14

Just a note,

We fixed an issue resulting in many Win32 apps not launching if certain 3rd party antivirus programs were active prior to upgrading.
This from Donna Sarker re. the latest Insiders Build, 16199, released today. So the problem MAY be Windows related :)
15

That’s good to know. I may still try the uninstall/reinstall. Just didn’t have time yet. I’m curious… other than it’s use for file ratings (cloud lookup) does Virus Scope have any other use? If not, I don’t really need it, because I can easily tell CIS what’s good, and what’s bad. So far, that seems to be the only component interfering with normal windows use that I actually use.

16

Cloud lookup is performed by CIS as a whole and is not tied to a specific component. VirusScope is a behavior blocker for unknown rated applications and is most effective for monitoring applications running in containment. If you really want to you can disable it if it is causing issues for you.

17

When enabled, it is indeed set to monitor only items that are in the container, but for some reason it still appears to interfere with the use of Metro Apps. Disabling it appears to resolve the issue, and generally doesn’t require a reboot to restore these malfunctioning apps.

When apps started crashing yesterday, after enabling virus scope, they began working normally within a short time after disabling virus scope, without any need to restart the computer. To me, this sounds like it might be the MS bug mentioned above, or it could be a corrupted CIS install. I think I can live without the behavior blocker for now. Unknowns are set to execute within auto-containment.

When I disabled Virus scope, I also disabled the cloud lookup in the file rating settings. I just turned that particular setting back on, and will test some more.

18

Problem resurfaced again, and when it surfaced, the only fix was a reboot. It refused to run any store apps, and I kept getting permission errors on some of my files, and desktop apps. (can’t remember which they were now)

As a test, I’ve uninstalled CIS completely (btw the removal tool that was linked in this thread was completely useless. wouldn’t stop, or remove anything. not a very effective removal tool lol)

I’m going to keep it uninstalled for a little bit, and just go with Windows default security options in order to see if I’m going to be forced to reinstall my OS. If the problem doesn’t resurface without CIS, I’ll download, and install the latest version, and try again. If it surfaces now, I’ll have to reinstall my OS.

Unfortunately, I know that CIS is responsible as the initial cause, but not totally sure why. I know it’s the cause, because I had the computer running for roughly a month with just windows defender, and windows firewall with zero problems. These problems started shortly after CIS was installed. Hopefully I don’t need to reinstall Windows.

19

I have problem with win app LINE too. So I “ignore” win app in auto-containment and this solved my problem. You may give it a try. (I suggest reputation set to “Any” in your case)

20

I added all metro apps to global exclusions, including auto-containment, and the problem was not resolved. thanks for the idea though.