Task Manager and Defense+

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
1

I’m a retired programmer who has been using Comodo products at home for about a year and a half.

Platform: Vista x64
CIS version: 4.1.150349.920

A few days ago I bumped Defense+ up to Paranoid Mode and began receiving the following error when I attempt to open my Windows Task Manager.

Title: C:\Windows\system32\taskmgr.exe
Msg: Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

Unfortunately I continue to receive this error even after returning to Safe Mode, Clean PC Mode, and even Training Mode. Completely disabling Defense+ allows me to access the Windows Task Manager normally once more.

I’ve checked the Defense+ > Advanced > Computer Security Policy entry for taskmgr.exe which does not appear to have changed. I’ve also attempted to make taskmgr.exe a Trusted Application using the predefined policy to no avail.

I’ve tried adding taskmgr.exe to the “My Own Safe Files” list, however i’m greeted with a message indicating that “taskmgr.exe is already a safe file.” Reviewing the existing “My Own Safe Files” list, taskmgr.exe does not appear.

The only Defense+ log even that shows up indicates that explorer.exe has attempted to perform “Create Process” on taskmgr.exe.

Any suggestions would be greatly appreciated.

2

Welcome to the forum drynn :slight_smile:

Please check Defense+ / Advanced / Explorer.exe / Screenshot

Dennis

[attachment deleted by admin]

3

Bingo! Tell your boss that you deserve a raise. I must have made the selection error without realizing it when the dialog had originally popped up.

4

Glad this fixed it for you.

No raise all Moderators do this for free, all Staff members have a special avatar showing there status.

Thank you
Dennis

5

Hi there,
I just found out about this issue after trying loads of fixes with the registry, running loads of virus scans etc then happened to find another forum which mentioned this issue. I noticed this was posted in August last year but I’m having this problem nearly 5 months later so a bit surprised this issue hasn’t been fixed.
I tried the fix you mentioned but it didn’t really apply to me, I’m using just the firewall version 5.9.219863.2196. What I did was:

Defense+ → Defense+ Settings → Execution Control Settings → Exceptions → Add
Then added c:\windows\system32\taskmgr.exe from running processes
I could then kill running processes again fine.
I also noticed that it affected msconfig when I tried to select diagnostic startup it came back with an access denied error.
This issue baffled me as I was using an account with admin priviliges…

Is it possible these exclusions could be added to a future update or could at least be considered. I could try reinstalling the Comodo firewall if this is something that shouldn’t be happening?
It’s running defense+ in safe mode by the way.

6

Sorry, this isn’t sorted… after loading my laptop up today I had the same issue…
Task manager gives access denied for any process all the while Defense+ is set to Safe Mode.
When I set it to disabled then task manager works fine…

Is this normal? Should I try reinstalling the Comodo Firewall or is there something else I need to change? Or should I have it set to something lower than Safe mode?

7

Normally D+ should not interfere with Task Manager like this.

Can you show a screenshot of the D+ logs of around the time you start Task Manager? They are under View Defense +Events. What OS are you on?

8

Hi EricJH,
Sorry I had problems accessing the forums recently then there was a national broadband failure for my ISP!
Please see the screenshot below:

http://farm8.staticflickr.com/7150/6715724187_ea346ac7b9_b.jpg

I’m using Windows XP 32bit SP3 with all the latest updates.

9

What you are showing is that Task Manager is not allowed to access Protected Files in memory. That is nothing to worry about it will not interfere with how task manager functions.

Protected Files have an extra layer of protection and that is what you are witnessing.

10

Hi EricJH,
Many thanks for your reply, but isn’t one of the uses of task manager to be able to kill active processes in memory by doing end task? It won’t allow me to end task any running process even if it’s an application I have loaded on my account.

11

It should be able to do that.

Can you show us a screenshot of your Defense + Rules? May be there is a rule there that is interfering.

12

Hi EricJH,
sorry, where can I find the rules?
Under Defense+ I have:
View Defense+ Events
View Active process list
Trusted files
Run a program in the sandbox
Unrecognised files
Defense+ Settings
Computer security policy

13

The Defense + Rules are under Defense + → Computer Security.

14

Hi EricJH,
Please see below. It said that Taskmgr.exe had a custom policy so I opened that for the screenshot as well and am thinking that’s where the issue might lie as it seems to be blocked from most things? Shouldn’t it by default be able to terminate running processes in memory?

http://farm8.staticflickr.com/7005/6733299089_7d4ce57018_b.jpg

15

It is blocked from Process Termination among other things. That’s why Task Manager can’t terminate programs.

16

Thanks EricJH,
Do you know why it would be set to this? Is this the default setting? I also noticed it blocked msconfig from allowing me to set diagnostic startup?

17

I can only guess what happened. Did you ever change the default settings of the “All Applications” rule in D+?

18

Hi EricJH,
I hadn’t made any changes at all, I installed the software and then would just click to allow files etc as it popped up and added a few things to trusted files and that was about it.
I deleted that rule for Task manager and it seems to be working fine now.
I can’t find any entries in there for msconfig, I’ll try setting that to diagnostic startup again where I got the access denied issue and see what comes up in the log…