Indeed I used my test file and even made changes to it to change the hash, meaning the hash was less than 2 minutes old when I was performing the test. Besides that I’ve always used HIPS and since CIS 7 I’ve never had an entry in the Unrecognized Files List, honestly I can’t remember how it worked for me in CIS 6 though. :embarassed: My memory isn’t that good… Either way unrecognized files should be added to the Unrecognized Files List even when using HIPS, there’s no reason that I can think of to not have this behavior, it just makes sense to add them to that list, and the help file even says so should be the case.
So is the consensus that what is causing this is that Unrecognized files aren’t added to the Unrecognized Files List when HIPS is ON and BB is OFF? Does that correctly sum up the issue, or is it more complicated than I’m thinking?
I observed, that the files are not added to the “unrecognized files list”, when they were newly introduced to the system. This was dependent on a file’s hash and worked this way, since version 3.
I can’t tell, if the files are handled as “unrecognized” in spite of not being added.
Having “unrecognized files”, which are not on the “unrecognized files list” makes the whole thing even worse. It makes the behaviour of CIS kind of unpredictable. And this is a no go for a security software.
Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.
Developers may or may not communicate with you in the forum or by PM/IM, depending on time, availability, and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.
I would like to begin with apologizing for not being very good at testing earlier, I just realized I never tested the settings BigMike talked about, or more specifically Clean PC Mode.
In Clean PC Mode, new executables are added to the Unrecognized Files List for me, even with the extra settings BigMike mentioned, disable Cloud Lookup etc.
In HIPS Paranoid and Safe Mode, new executables are NOT added to the unrecognized files list for me, even though the help file mentions that it should be enabled for HIPS and that’s it’s specifically needed for Clean PC Mode, however it does not mention that it’s exclusive to the Clean PC Mode.
Having said that, I can not replicate the bug reported either, and the bug or issue that I am experiencing is off-topic, Sorry.
Yes, I’m sure. Just to clarify - some files appeared in the “unrecognized files list”. I realized, that some files - which in my opinion should be added and are added in version 6 - were not added, while I installed the mentioned ClamAV MSI package.
I understand. However, the devs are not able to replicate it, and it seems that it may be specific to something about your machine. Thus, they need more information.
If you don’t mind, please try V7 again. Then, if the same issue occurs, please create a video showing what happens. Once this is provided I can re-open this in the tracker. However, without that I will have no option but to close this as they cannot replicate it from the information currently provided. If you have any questions about how to do this please feel free to ask.
since I was planning for some time, to set up a test system for Windows 8.1 I’ve done this today and have made a video with this setup.
This was a new installation on hardware. No additional software was ever installed.
All changes in the CIS settings (which I mentioned in my bug report) are in the video. The base configuration was Comodo Internet Security (the one active after a new installation)
The system has no connection to the internet, so I can exclude cloud lookup and white listing (since this ClamAV version was published after the CIS version)
It’s a Windows 8.1 32bit, so it differs pretty much from my productive system and I’d say I can exclude, that it’s system specific, too.
The camstudio msi was added with hips disabled while installing the software, since it was unknown to CIS. As you can see, while a msi file was added in clean pc mode, while installing ClamAV, no exe files from this installation are added. Neither the msi nor the exe files are digitally signed.
Sorry, this is not meant to insult you. I know you’re a volunteer moderator and you’re doing your best. But I’m pretty ■■■■■■. From my point, the only possibility why the devs could not reproduce the problem is, that they never tried!
I reproduced the problem with a few clicks, all contained in my original bug report on a completely different os (version and architecture).
As we had a longer discussion in this thread, we came to the conclusion, that this is definitely not the expected behavior as described in the help. If we were wrong here, the devs should have told you.
You (on behalf of the devs) demand these time consuming bug reports from your users. But if I’m looking on the results, this is just a waste of (my) time.