Unblock feature inconsistency

In the manual it is clearly stated that:

Once you release an item from the blocked files list, [b]a rule[/b] will be created [b]for the respective component[/b] so that the same application will not be blocked in future.

For me it is ONE rule for ONE module…

and if it would work that way I would be happy… but it works in another way !!!

after clicking “unblock” CIS creates couple of rules in every CIS module… even in disabled ones…

I got application blocked by antivirus module… clicked “unblock” in hope it will create rule only for antivirus module… instead I got rules for antivirus, firewall, HIPS, sandbox and in file rating… I ask WHY ???

I think it is a serious BUG

Good point. I think it’s a help issue.

Thanks.

WHAT ??? Are You trying to say that help has wrong statement and CIS works flawlessly here ??? :o :o :o

For me it is obvious this feature should work as mentioned in manual… I do not want this “unblock” feature in actual version at all (log info about block action is enough info for me)… There is no “remove and do nothing” button… the only way to clear this list is to do “unblock” and mess up all rule sets in every CIS module :frowning:

Why is it obvious? It was designed for newbies based on my understanding.

Last column with title “Blocked by” strongly suggest that when I press “Unblock” button CIS will make exception rule only and the only in that particular module…

I do not understand why there is no other way to clean/purge “blocked app” list than “unblock” by generating rules in every CIS module…

I also thought this was strange,
so i sent feedback’s to BuketB about this a few days ago

He/She said: I will be processing them.

so Fingers crossed :slight_smile:

Last column with title “Blocked by” strongly suggest that when I press “Unblock” button CIS will make exception rule only and the only in that particular module…

I do not understand why there is no other way to clean/purge “blocked app” list than “unblock” by generating rules in every CIS module… (PLEASE ADD REMOVE BUTTON/OPTION BESIDE UNBLOCK!!!)

I see two good possibilities for this module…

“unblock” button generates one exception rule for particular module (or multiple rules in chosen modules by the user as BlueTesta proposed)

or

“unblock” button generate one “trusted” entry in “file rating module” which I am guessing every other module use it

At the moment, in its current form, Unblock is very dangerous option. It is basically Disable CIS for this file.

Newbies are most likely to be bitten if you have one easily accessible button that disables all protections.

As I said in the main topic about CIS 10, in my opinion at least the AV part should not be included in the unblock feature. It is dangerous for newbies and there is already the quarantine section where you can exclude files from the Av detection.

Why there is only one possible action → “unblock” ??? I please politely for adding “remove/purge and do nothing” feature… when I am 100% sure there was false positive reaction on some downloaded “exe”.

“Unblock” should add only one “trusted” entry to “Filer Rating” module or let user to choose in which module/modules create exception rule… from every module list

I absolutely agree, in its present form the unblock button is extremely dangerous. IMO when you click unblock the only change that should be made is to whichever component is shown as blocking the file. So, for example, if a file is shown as blocked by HIPS then clicking unblock should do only as much as is required to remove that particular HIPS block. That does mean that the file may be blocked again by some other HIPS feature or by some other CIS feature. In that case I’d like to see two options; unblock and unblock all. The unblock all button should unblock ONLY those CIS features that cause this file to be blocked, but it should unblock all of them.

:-TU :-TU :-TU

I couldn’t agree more. I can see an awful lot of potential problems leaving it like it is right now

Unblock add’s rules to components by which it was not unblocked e.g. if blocked by HIPS then if unblock used rule added to firewall, AV File list exclusion etc.

Can you reproduce the problem & if so how reliably?:
Consistently, also reported multiple times including in this section.
Seems Buket has been intimated but I believe the post is not in the right format its still in the waiting area.
Kindly refer posts below
https://forums.comodo.com/news-announcements-feedback-cis/brand-new-comodo-internet-security-10-hotfix-version-is-released-t117645.0.html;msg849950#msg849950
https://forums.comodo.com/bug-reports-cis/unblock-feature-totally-broken-t117868.0.html;msg849103#msg849103

If you can, exact steps to reproduce. If not, exactly what you did & what happened:
1: Allow a file to be blocked by CIS
2: Right click and press the unblock button
3: Rules that didn’t exist earlier in Firewall, AV, Sandbox etc. now added even though the component was blocked only by HIPS

One or two sentences explaining what actually happened:
Rules that didn’t exist earlier in Firewall, AV, Sandbox etc. now added even though the component was blocked only by HIPS when using the Unblock button on Blocked Applications.

One or two sentences explaining what you expected to happen:
Rule should have got added only to the component(s) which blocked it.

If a software compatibility problem have you tried the advice to make programs work with CIS?:
NA

Any software except CIS/OS involved? If so - name, & exact version:
NA

Any other information, eg your guess at the cause, how you tried to fix it etc:

I assume Comodo meant the “Blocked Applications” area as a quick and easy indicator by which users can go into that section and unblock. Unfortunately it seems this feature hasn’t been implemented as per this and creates more effort than reduces.

Me griping here :wink: - I think the OP requesting for the Purge button should have instead requested for a Remove that way at least this list could be cleant from the Windows registry; otherwise just seems to be a bothersome feature that exists only to peeve users knowing in more detail intricacies.

This leads me to an improvement. Allow contextual unblock. So if file is blocked by more than one component then allow a radio button popup to only unblock in the component in which we’d like to unblock. Wishlist item raised.

B. YOUR SETUP
Exact CIS version & configuration:
10.0.0.6092

Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:

Enabled

  • HIPS - Paranoid
  • Autosandbox
  • Firewall - Custom
  • File rating - Do not trust either vendors / trusted installers
    Disabled
  • Virusscope
  • AV
  • Website filtering

Have you made any other changes to the default config? (egs here.):
No

Have you updated (without uninstall) from CIS 5, 6 or 7?:
No

 [b]if so, have you tried a a a clean reinstall - if not please do?[/b]:
 Yes

Have you imported a config from a previous version of CIS:
No

 [b]if so, have you tried a standard config - if not please do[/b]:
 NA

Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:

Enabled

  • HIPS - Enabled - Paranoid
  • Auto-Containment - Enabled
  • Firewall - Enabled - Custom
    [list]- Virusscope - Enabled
  • Website filtering - Enabled, Monitor only applications in the container
    Disabled
  • AntiVirus - Disabled
  • File rating - Disabled cloud lookup, Do not trust either vendors / trusted installers
    [/list]

Have you made any other changes to the default config? (egs here.):
No

Have you updated (without uninstall) from CIS 5, 6 or 7?:
No

 [b]if so, have you tried a a a clean reinstall - if not please do?[/b]:
 Yes

Have you imported a config from a previous version of CIS:
No

 [b]if so, have you tried a standard config - if not please do[/b]:
 NA

OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
Windows 10 64 bit, UAC enabled, Non Administrator, CIS running on host and not in VM though I use Virtualbox for other reasons

Other security/s’box software a) currently installed b) installed since OS, including initial trial security software included with system:
a=Avast Free Antivirus 17.3.2291 only AV(File System, Mail and Web) Shields enabled. No Behavior / Firewall etc.
Malwarebytes Anti-Malware Free 3.0.6.1469 executed only as on-demand scanner
Super Anti Spyware 6.0.1236 executed only as on-demand scanner
b=None
c=No files / diagnostics shared as this is not a crash

Please check Comodo Internet Security v10.0.2.6346 - BETA which contains improvements to unblock application functionality.