Unrecognized files aren't added to Unrecognized Files List when BB Off [M1038]

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
21

Thanks very much Sanya and BigMike. That makes it clear. A functionality issue then, and a loss from 6.x, and so a bug not a wish.

I think this can go forward now citing the help file, flagged as ‘lost’, and amended by clarifications, Chiron if you agree.

Best wishes

Mouse

22

Perhaps wait for BigMike to confirm what I said is the core issue, just in case, maybe I’m the one misunderstanding, you never know. 88)

23

OK I think it’s what he was saying but lets see. It makes sense that it treats as urecognised but not adds them - else there would have been other reports.

I assume you were using your test file? So no chance that CIS knows it in any way?

24

Indeed I used my test file and even made changes to it to change the hash, meaning the hash was less than 2 minutes old when I was performing the test. Besides that I’ve always used HIPS and since CIS 7 I’ve never had an entry in the Unrecognized Files List, honestly I can’t remember how it worked for me in CIS 6 though. :embarassed: My memory isn’t that good… Either way unrecognized files should be added to the Unrecognized Files List even when using HIPS, there’s no reason that I can think of to not have this behavior, it just makes sense to add them to that list, and the help file even says so should be the case.

25

I agree totally. By makes sense I just meant ‘is consistent with observations’ not ‘is desirable’.

And I cannot remember either… Comes with age… !

26

So is the consensus that what is causing this is that Unrecognized files aren’t added to the Unrecognized Files List when HIPS is ON and BB is OFF? Does that correctly sum up the issue, or is it more complicated than I’m thinking?

Thanks.

27

Yes but they are run as unrecognised, and this happens whether on not cloud lookup is on. We are just waiting for BigMike to confirm that our understanding is correct.

28

I observed, that the files are not added to the “unrecognized files list”, when they were newly introduced to the system. This was dependent on a file’s hash and worked this way, since version 3.
I can’t tell, if the files are handled as “unrecognized” in spite of not being added.
Having “unrecognized files”, which are not on the “unrecognized files list” makes the whole thing even worse. It makes the behaviour of CIS kind of unpredictable. And this is a no go for a security software.

29

Thanks BigMike

I think that confirms our understanding Chiron, so it can be logged now.

30

Thank you very much for your report in standard format, with all information supplied. The care you have taken is much appreciated by Comodo, and will increase the likelihood that this bug can be fixed.

Developers may or may not communicate with you in the forum or by PM/IM, depending on time, availability, and need. Because you have supplied complete information they may be able to replicate and fix the bug without doing so.

Many thanks again.

31

The devs are not able to reproduce this. BigMike, could either you or Sanya create a video showing how to replicate this issue? The devs have requested that so they can investigate this further.

Thank you.

32

I would like to begin with apologizing for not being very good at testing earlier, I just realized I never tested the settings BigMike talked about, or more specifically Clean PC Mode.

In Clean PC Mode, new executables are added to the Unrecognized Files List for me, even with the extra settings BigMike mentioned, disable Cloud Lookup etc.

In HIPS Paranoid and Safe Mode, new executables are NOT added to the unrecognized files list for me, even though the help file mentions that it should be enabled for HIPS and that’s it’s specifically needed for Clean PC Mode, however it does not mention that it’s exclusive to the Clean PC Mode.

Having said that, I can not replicate the bug reported either, and the bug or issue that I am experiencing is off-topic, Sorry.

33

I can’t make a video. I’ve downgraded to CIS6.

34

Hi Big Mike. Any insights into Sanya’s findings above. Were you in Clean PC mode for sure?

35

Yes, I’m sure. Just to clarify - some files appeared in the “unrecognized files list”. I realized, that some files - which in my opinion should be added and are added in version 6 - were not added, while I installed the mentioned ClamAV MSI package.

36

Can anyone replicate this issue at this time? The devs are not able to replicate, and unless someone else can replicate I will be forced to move this to Resolved.

Please let me know if you’re still experiencing this issue.

Thanks.

37

I still can’t, since I’ve no machine with CIS7 at the moment. But I’m not happy about closing this issue. Basically, this means I have to stay with CIS6 :frowning:

38

I understand. However, the devs are not able to replicate it, and it seems that it may be specific to something about your machine. Thus, they need more information.

If you don’t mind, please try V7 again. Then, if the same issue occurs, please create a video showing what happens. Once this is provided I can re-open this in the tracker. However, without that I will have no option but to close this as they cannot replicate it from the information currently provided. If you have any questions about how to do this please feel free to ask.

Thank you.

39

Test

40

Hi,

since I was planning for some time, to set up a test system for Windows 8.1 I’ve done this today and have made a video with this setup.

  1. This was a new installation on hardware. No additional software was ever installed.
  2. All changes in the CIS settings (which I mentioned in my bug report) are in the video. The base configuration was Comodo Internet Security (the one active after a new installation)
  3. The system has no connection to the internet, so I can exclude cloud lookup and white listing (since this ClamAV version was published after the CIS version)
  4. It’s a Windows 8.1 32bit, so it differs pretty much from my productive system and I’d say I can exclude, that it’s system specific, too.
  5. The camstudio msi was added with hips disabled while installing the software, since it was unknown to CIS. As you can see, while a msi file was added in clean pc mode, while installing ClamAV, no exe files from this installation are added. Neither the msi nor the exe files are digitally signed.

Sorry, this is not meant to insult you. I know you’re a volunteer moderator and you’re doing your best. But I’m pretty ■■■■■■. From my point, the only possibility why the devs could not reproduce the problem is, that they never tried!
I reproduced the problem with a few clicks, all contained in my original bug report on a completely different os (version and architecture).
As we had a longer discussion in this thread, we came to the conclusion, that this is definitely not the expected behavior as described in the help. If we were wrong here, the devs should have told you.
You (on behalf of the devs) demand these time consuming bug reports from your users. But if I’m looking on the results, this is just a waste of (my) time.