Why is CPF 3.0.16.295 - Defense+ Blocking these items?

[ejmarkow]

@adric post:13

In 277 all you needed to do was

D+ → Advanced ->Comodo Firewall Pro (Allow for Protection Settings → Memory Access) → Add the
executable(s) in the exception list

This looks like it is broken or no longer allowed in 295. You can add stuff but it is ignored and disappears after applying the changes. Can someone verify this?

Al

Adric, yes, it appears to be broken. In my original post I mentioned exactly what you have just described. Please read it carefully. In version 277, it was possible to adjust the “Access Rights” and “Protection Settings” for “Comodo Firewall Pro”. In version 295 this is no longer possible. Indeed, it was fairly sloppy to leave the fields ‘enabled’ when in fact it isn’t possible to make any adjustments. A fix is needed for this. The question now is, in the next version, will it be possible to make changes to the “Custom Policy” settings for “Comodo Firewall Pro”, or not?

[adric]

@ejmarkow post:21

Please read it carefully.

Go easy on me. I have a hard time remembering what I read from one minute to the next. ;D

The more people that verify this, the more chance we will have of it being addressed in some way or another and not be ignored.

Al

[salmonela]

Workaround would be to put that Logitech .exe in Windows System Application Group of My Protected Files…
But this is not very smart thing to do…

[salmonela]

Hmm… it seems if you try to edit exceptions in any way but above one, CFP will show you nothing in exceptions window, I think we have bug here…

[ejmarkow]

@adric post:19

I previously had SAS, AVG, A-Squared, etc. in the exception list to keep the Access Memory warnings out of the D+ event log when running scans.

Al

I also had several programs in the exception list, such as Nvidia, BOClean, and others, to avoid the memory warnings, etc. Now it isn’t possible to add anything to the “Custom Policy” for CFP. I’ve tested it numerous times already and it doesn’t accept anything. I got rid of the BOClean warnings in this latest version by inserting CFP.exe and CMDAGENT.exe in BOClean’s ‘Program Excluder’ list.

The above example also brings up the issue of CFP’s ‘Trusted Application’ list. BOClean is programmed by Comodo, so why is there a memory exception warning at all?

@adric post:22

Go easy on me. I have a hard time remembering what I read from one minute to the next. ;D

The more people that verify this, the more chance we will have of it being addressed in some way or another and not be ignored.

Al

Sorry, I didn’t mean to sound harsh as it was only a reminder, since you asked, “Can someone verify this?”.

[Blas]

I personally only had problems with nvidia and boclean when there was an issue with 8.3 naming format (long long time ago). Right now I don’t have boclean installed and I have no log entries regarding the nvidia exe’s. I heard somewhere that cleanpc mode doesn’t respect fully custom settings. People reported that if they set something to trusted, cfp will revert it back to ‘custom’. (in clean pc mode) Can you try marking boclean as trusted in non-training modes of defense+? ie: paranoid? or maybe train with safe mode.

[salmonela]

Comodo crew should see this thread, this is serious bugs here and action should be applied in short terms, I expect build 17 in short term…

[goodbrazer]

Those who want to report about bug in protection settings of Defense+ (CFP v3.0.16.295, 32 bit), please join this thread: Exceptions do not work in Protection Settings of Defense+ (v3.0.16.295 x32).

[adric]

@riggers post:5

You beat me to it sded,it looks fishy does that CSRSS.EXE cant see why that would be trying to terminate cfp.exe.

This happens when you logoff or shutdown your system. In this case it is normal behavior for CSRSS

Al

[system]

Right adric, but he says that this is happening at boot time-which does seem suspicious.