Undetected Parent Launching a Running Browser Instance [Resolved]

If I click on the Join the Comodo Forums link that’s underneath the Highlists > News section on CFP’s main Summary interface, of course I’m alerted that that there’s a new parent (cpf.exe) for Opera browser. I allow it without remembering. Perfect.

If I click on the same link while Opera is already opened, I’m not alerted at all. It just opens a new tab. Why ???. (I even closed Opera during the process to test it)

Hi there, and welcome to the forum :wink:

Have you tried reboot? It’s possible that your “allow” is still in effect.

Thanks for the warm welcome, Someone (L). As you can see, I’m still relatively new. (B)

Nope. Not that because when I closed Opera and clicked on that link, it successfully alerted me with cpf.exe as the new parent again. It doesn’t matter how I started Opera - as long as Opera is already started, it won’t alert that cpf.exe is a new parent.

Well, if you allowed that, and Opera is still open, i figure Comodo’s temporary allow is still in effect. You allowed that parent for that Opera session/instance.

Oh, and stop giving me the finger!

Edit: now that i look at it, it seems that it’s not the finger, but performing some magic lol

  1. Launch Opera via cpf
  2. Alerts for new parent
  3. Allow
  4. Close Opera
  5. Repeat Step 1 and I get Step 2 as desired because I want to be alerted.

However, let’s say if I started Opera from the desktop (explorer.exe) first, I won’t be alerted when launching it via cpf afterwards. Why would CFP skip the parent check even though they’re different, just because Opera is running already? Doesn’t seem right.

Something else: If I denied cpf as parent, the second tab that’s attempting to open will eventually timeout as expected, while the first tab (which I had running fine) still works.

PS: You’ll have to watch anime to know what that is :stuck_out_tongue: ;D

Guess what? I closed the Opera tab and just rebooted to confirm your theory about temporary hold. Still no go.

I started Opera from the desktop first (which doesn’t alert because I’ve allowed it in Application Monitor for TCP/UDP Out), and then was able to open a new tab after launching within CFP GUI.

If it were anyone else, i’d say: are you sure you didn’t set to remember?
Other than that, i’m lost… i’m not a programer.

Maybe a mod can help you ;D

Think of this as a clever bump if you will :D, but I found out that it’s not just cpf.exe launching a new browser tab undetected. It seems that any program can do this as long as it’s already running because I tested it with uTorrent.

So no one else can replicate this or is my question too complicated >:( ;D?

Well, my Summary page doesn’t have that link to the forums…

However, if I click the link that is there (with FF open), I don’t get an alert; it just connects (opens a new tab). No apparent change in Parent application.

Not sure exactly what you mean by

If I click a link within an MS Office app (which is about the only other way I do it), it alerts me. I just tried it with some other applications (to reach their websites) and was alerted as well.

I have not yet tried the first check starting with FF closed. I guess I’ll do that.

LM

I’ve always had this link since I first installed 2.3.6.18. (I will post a screenshot of it later)

Same here, but the parent is not explorer.exe, it’s obviously cpf.exe as expected.

This happened without any alerts when I launched Opera through click on an option or link from within uTorrent or CPF that has some kind of way to connect out, launching Opera (more accurately, it opens a new tab) with an instance of Opera already running. If there is no instance of Opera running and I launch it with uTorrent or CFP, I am alerted of the new parent.

I really see no reason why this would have any relevance, but here’s a screenshot of the link I referred to: “Join the Comodo Forums…”

[attachment deleted by admin]

And of even less relevance is mine…

I wonder why they’re different? Are you special, or am I?

LM

[attachment deleted by admin]

ooh ooh! I can answer that since it’s a multiple choice: one of ours must be malware-infected. :o :cry:

To make it slightly more confusing: http://www.matousec.com/projects/windows-personal-firewall-analysis/Comodo-Personal-Firewall-2.3.6.81/img/main-summary.png (v2.3.6.81)

I have the link to the forums too :slight_smile: 2.4.18.184

This is probably not relevant, but… Did you both auto-update from a previous version, or did either of you do a fresh install?

What level is your alert frequency set to Soyabeaner?

The last 2.4 version was through the updater (remember it was just the help file update?), manually performed by me because my auto options are off. The one before that was 2.3.6.18 and the transition to 2.4 was a clean installation.

My alert level is the default Low. Thanks for giving me this idea. I forgot about that.

Update: I just tested it with High and still no difference.

With firefox open and several tabs loaded, I clicked on the ‘join forums’ link from the summary page of CFP. I didn’t receive a prompt for a new parent. I have alert frequency set at Very High, and the only parents I have defined for firefox are:

Y’z Dock.exe
firefox.exe

One thing though, I have had to define firefox as an ‘invisible’ (trusted) application to stop receiving loopback prompts from CFP. Can’t say I like the idea, but its the only way it works.

Thank you, Toggie. At least I know it’s not my system being weird.

I didn’t still didn’t receive any alerts with both loopback check options on, but I know that’s not a concern for me. It would be a different kind of alert (acting as a server) vs this one about parent check anyway. I wonder if we discovered a bug or is there some purpose behind this?

Closed firefox, but did not clear the cache. Clicked on the link from summary page and received a prompt for new parent. It didn’t matter how high or low alert frequency was set.

I also tried other applications, and the behaviour is the same, with the browser open no prompt, browser closed, prompt.

Curious

Maybe we should move this topic to Firewall Leak Testing and say we found a new leak ;D.

Its a bit strange…

I hope my interpretation is wrong, but it does seem that something can use an open browser to make a connection, without invoking a prompt.

I need to think about this some more…

Maybe the leak test forum would be a place to start…