"System" was not recognized and tried to modify / create a file.

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
#1

Hello there.
Sometimes I got the pop-up from COMODO CIS Defense+ saying that “‘System’ was not recognized and tried to modify / create a file.” when I attempt to log-in on Steam.
What I had to do to solve this was create both the Windows System files and Windows Updater files groups on HIPS Active rules again.

What is this “issue” with the “System”? Some kind of bug or something? :o
Thank you for any tips.

#2

Hello? Somebody?

#3

… :-X

#4

Really? No one can answer me?

#5

The reason no one has answer, is this is not something that has occurred for anyone :slight_smile:

Reason:- System is part of the group Windows System Applications which are allow to do anything everything is allowed.

So either you have changed the default groups or changed protections of files.

Or your System is not the correct one.

Dennis

PS I run Hips in Paranoid mode and have never had any alerts for System.

#6

My System is the correct one. I never made any changes to the groups of HIPS. When this occurred, I went to check on the spot the rules of HIPS and on the list both Windows Important Files and Windows Updater Files were missing. I had to create them again.
I created this thread to ask for some advise.
This never happened before…
It looks like it HIPS groups have been reseted when I got this alert. If this really happened I don’t have any idea how.

#7

I’ve seen this happen before. Many times in fact.

Its just that the circumstances are quite bizarre and never reproducible.

Are you O/C in any way whatsoever? Try backing the O/C off by a tick.

You’re off on the O/C by one tick on a particular parameter.

Try to run the 7-zip ‘benchmark’ util, or the Prime-95 memory test. Neither of those should EVER fail no matter how long they run.

If you’ve never deliberately done anything to O/C your system, then one of your RAM sticks are faulty, or the CPU isn’t snugged in properly into its socket. You should have a component reseat be done by a qualified expert…

#8

Wow. No, my RAM is just fine and I didn’t made OC.

#9

It happened to me some years ago on a family windows vista pc.
I use CIS in italian and in HIPS rules all group and files where named in italian.
System too was named “sistema” (italian world) but that was the problem.
I checked and was sure that system was not infected or tampered than i tried
to answer “allow” to the alert and “remember my answer” to create a new rule.
The rule was created equal to “sistema” but named “system”.
If I deleted the rule named “system” than alerts started to appear again.
If i deleted the rules named “sistema” all was working fine.
Maybe you can see if this hypothesis occurs in your case.

#10

That was kinda weird, huh?
No, this isn’t happening to me. My System is called “System”. I think that CIS HIPS Rules must be reseted for some reason.