Updated to 10.1.0.6476... can no longer remove blocked applications[M2339]

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
#1

Before today’s update (10.1.0.6476), I could mark blocked applications for removal. No marking them has no effect.

Now if I unblock an application it shows up as a custom rule (as expected). If I delete that custom rule, the application reappears under Blocked Applications.

Bottom line… the “Remove” function seems broken.

Is this just me? Suggestions?

#2

Same case
Today with the last update 10.1.0.6476
Many messages “Operating system blocked” by “Firewall”
But much more by “Containment” !
Trying everything : first with “Auto-Containment” panel, then uninstall the EXE => still this errors
when go back to “Unblock application”.
Sometimes a refresh seems to work, and then after a few seconds it appears again
“Purge” button still saying all is OK
Important : all was clean before the update, and nothing was installed !

#3

I noticed that I can remove new entries, in fact the one that I cannot remove appears twice. Apparently, it got stuck (nonresponsive) in place during the upgrade.

I deleted the underlying program and the purge identified it to be removed but was unable to do so.

EDIT1: Since new events in the blocked application log can be removed, I uninstalled/reinstalled cfw to clear the “stuck” log entry. Quite a doing, but I like my logs cleared when all actions have been taken.

#4

reported this from the first RC , but got no response. Somehow it got broken with the updates.

#5

Hi All,

Sorry, we are not able to reproduce the issue. can anyone please record the video showing issue which will help us to understand better.
Thanks in advance.

Kind Regards,
PremJK

#6

Recorded short video showing this issue.

#7

I was able to replicate with having entries in UBA task before upgrading to a newer CIS version. So it seems if you have apps listed before updating, then after updating those pre-existing apps can’t be purged or removed from the list and only newly add apps can. Bug 2339

#8

I am running Comodo 10.1.0.6476 on windows 10. I’m hoping someone can shed some light an issue I am experiencing.

When running a game Fortnite I am spamed with multiple HIPS events for the games exe in blocked intrusions:

Exe name: FortniteClient-Win64-Shipping.exe

These are the things I have attempted but everytime the game is restarted there multiple entries occur during the period I am playing the game:

  • In the ‘Unblock applications’ I have unblocked the exe but it still causes events (done this muitple times)

  • Placed an entries in the ‘Scanned exclusions’ for both tabs: ‘Excluded paths’ and ‘Excluded applications’

No matter what I do I can’t stop it from scanning/recording this games activity apart from disabling HIPS which I do not want to do. This does not occur with other games I run. I am conscious of addressing this issue as I want to minimise uncessary resources going to the antivirus. Placing comodo in silent mode does not help.

Any advice would be appreciated.

(Apologies if this is in a wrong forum section)

JM

#9

What action is being blocked? In order to make the create HIPS rule to prevent log spam you need to say exactly what activity is being blocked by looking at the action and target columns.

#10

I have attached a screenshot of the mutiple entries that take place when I run this game. How may I stop these entries appearing? All these events are counted as ‘Blocked intrusions’

JM

#11

You need to add that application to the protection settings of the CIS HIPS rule for interprocess memory access.

#12

I’ve attempted to do what you’ve advised, however, it doesn’t do anything - its still logging as ‘Blocked intrusions’. Any other things I can try out?

(I appreciate your help, many thanks)

Jm

#13

Hi, we have checked this problem and on our side with CIS default settings, game seems to install/run fine without any alerts since all vendor files are signed and certificate is part of TVL. Can you please provide further details regarding your issue as:

  1. CIS settings (default or are there any user made changes within settings, policies,tvl etc)
  2. When are the alerts occuring? Is there a particular stage of the game when this happens?
  3. Your O.S details (version, type )
  4. Are your game files which cause this issue signed and is certificate valid? (right click on the file then go to /properties/digital signature - click on displayed cert then on details - see if it shows this digital signature is OK).
  5. Is the “Epic Games Inc.” certificate present in your tvl list? (go to CIS settings/file rating/trusted vendors, press on the magnifier icon from right, input vendor name(without quotes) and see if it is present

Thanks,
Bogdan

#14

Hi Jm1,
The behavior you see is due to the fact that CIS has self protection and even if you are in Safe mode, unless application is in Exclusions list, as shown in enclosed snap, it can trigger HIPS blocking event. These events can occur when some application may be trying to use some Windows API that access one of CIS processes, in your case, from snap you shared, it seems cistray.exe

As suggested by futuretech, you need to add application into exclusion list.
May you please attach snapshot of rule you added?

Thanks
-umesh

#15

Hi Jm1 - this is the step by step to add the application rule. I has the exact same thing with the Logitech SetPoint software, so just add the executable FortniteClient-Win64-Shipping.exe with the steps as set out:

Open up HIPS rules and edit the rule for COMODO Internet Security, then go to the Protection Settings tab, in the Protection Settings list to the very right of Interprocess Memory Access choose Modify, when a new window appears alt-click/right-click in the empty area and choose Add > Running Process and from the running process list select the FortniteClient-Win64-Shipping.exe executable. Press OK for each window to accept the settings change

#16

Feedback on the advice suggested:

Re: Bogdanr

  1. CIS settings (default or are there any user made changes within settings, policies,tvl etc)

Settings were default I had made no prior changes, however, to solve this problem I did make some changes (see below)

  1. When are the alerts occuring? Is there a particular stage of the game when this happens?

The particular point when the alerts happen is when you are actually in the map playing. It doesn’t happen when you are in lobby.

  1. Your O.S details (version, type )

Windows 10 Pro, 64-bit

  1. Are your game files which cause this issue signed and is certificate valid? (right click on the file then go to /properties/digital signature - click on displayed cert then on details - see if it shows this digital signature is OK).

As per your screenshot all the digital signatures were fine.

  1. Is the “Epic Games Inc.” certificate present in your tvl list? (go to CIS settings/file rating/trusted vendors, press on the magnifier icon from right, input vendor name(without quotes) and see if it is present

Yes, “Epic Games Inc.” was present.

Re: Ploget

I followed your instructions and they did indeed seem to have stopped the alerts. Please find attached a screen shot of settings made. However, it did seem that there was another running exe running “FortniteClient-Win64-Shipping_BE.exe” so I also also included this.

There is one thing which is still an annoyance, after all the alerts stopped there is still an entry which always keeps reappearing in the ‘Unblock applications’ (screenshot provided)…Everytime I unblock it, it comes back when the game is running, any ideas?

#17

Hi Jm1,
Can you please go to Logs and select HIPS Events and show us snapshot for this entry that keeps re-appearing?

Thanks
-umesh

#18

The snapshot of the entry that reappears everytime I unblock it while the game is running is the snapshot labelled comodo3.jpg in my previous post.

Here is a snapshot of the hips events before the changes made.

#19

Thanks, we will check.

#20

Hi, Jm1.

Could you please provide your active CIS config:

  1. Open CIS UI.
  2. Open ‘Settings’ → ‘Configuration’.
  3. Select active profile and click ‘Export’.
  4. Save configuration file in any folder.

Also please provide cislogs.sdb file from %programdata%\Comodo\Firewall Pro folder.

Kind Regards,
Sergey.