Multiple Issues With Comodo

[chales]

Hi there,

Our clients are really unsatisfied with using comodo antivirus. And we get the hit. Something keeps breaking. Either proxy settings don’t work, or the antivirus just stops working. I have a client with multiple issues and this has been escalated…we’re getting hits too!

See the attached:

I really wish we could have a remote session with the client to resolve the issue and appease them.

[Jimmy]

@chales ,

We are saddened to see the list you have posted on the images concerning challenges on utilizing C1 effectively and we want to ensure we can be of assistance. We will create a support ticket for investigating and resolving your reported issues. We will communicate with you via email shortly.

[monster-it]

I had this. the only way forward is to remove and completly remove all traces from the registry manually or reinstall windows!!! took me around 1 week to do 18 machines. There was a conflict with Norton (symantec) previously being installed. Since that was removed it worked fine afterwards.

[Jay]

Hello @monster-it ,

Thank you for your input.
Please tell us if there is anything else we can help you with on this case.

Regards.
Jay

[dittoit]

A agree there must be a conflict some where. I don’t have any of these problems. And I know some companies have >700 endpoints with very few problems.

[nct]

@dittoit

A agree there must be a conflict some where. I don’t have any of these problems. And I know some companies have >700 endpoints with very few problems.

We have near 1000 end points running the anti virus client, quite successfully at the moment.

[mbarrett]

I have dealt with all the issues that OP posted as well. Our deployment of C1 has not been smooth at all.

Can someone post a blank template profile they are using for HIPS etc? I’ve whitelisted everything (path, executable etc) in AV, HIPS but to no avail.

Have gone through with support multiple times but would like to compare with you guys that aren’t having issues.

[BOSS]

I also have troubles with the AV, I am always getting systems that show a yellow triangle in RMM, shoe communication error. This has been on going, I will use the uninstall tool from comodo, it will work for a while, then seem to mess up again, sometimes on the same systems, sometimes on other systems. It also seems that, even if the system had previously showed AV version 10, when communication error occurs the RMM reports version 8 something. I have it deployed on a couple hundred systems, and would like to go more, but I still feel that I have to tinker with the software too much to be really efficient, and be able to balance everything.

[BOSS]

@mbarrett

I have dealt with all the issues that OP posted as well. Our deployment of C1 has not been smooth at all.

Can someone post a blank template profile they are using for HIPS etc? I’ve whitelisted everything (path, executable etc) in AV, HIPS but to no avail.

Have gone through with support multiple times but would like to compare with you guys that aren’t having issues.

I just totally disables HIPS, seemed to of gave me more hassle than I felt it was worth. I also disabled containment on many systems, as it always made stuff so it would not work right. I have said it before, I have never had containment stop anything legit, what caught the bad stuff, was the fact that I do not allow users admin rights, and I was tipped off by elevated prompts.

[BOSS]

@Damon C

Usually, it happens when a .old or .update folder is existing inside the Comodo Security installation folder. I suggest that before removing the Comodo Security better to check both c:\Program files and c:\Program Files(86x) if those are existing.

Great, that’s the first I have heard about this, and I have some threads about this!!!

[nct]

@BOSS

I just totally disables HIPS, seemed to of gave me more hassle than I felt it was worth. I also disabled containment on many systems, as it always made stuff so it would not work right. I have said it before, I have never had containment stop anything legit, what caught the bad stuff, was the fact that I do not allow users admin rights, and I was tipped off by elevated prompts.

Disabling containment is a big mistake, it is probably the best/most important module within Comodo Client Security.

[BOSS]

@nct

Disabling containment is a big mistake, it is probably the best/most important module within Comodo Client Security.

I have not disabled it on every system, and it has never kept me from getting an infection, not once. Not saying it won’t, but has not yet, that I know of. What it did do, was keep a bunch of LOB applications from running. Granted, that was a long time ago, and I plan to re-enable it soon, as I want to use it, and I am sure there has been some improvements made in it, but it was blocking several appications from running.

[mbarrett]

I experimented with disabling HIPS and Containment but had/have ongoing issues with Microsoft Office and Remote Desktop being slow.

Just as you other guys will have my businesses have a variety of LOB applications which I need to whitelist and I find that process almost just as confusing since it seems there are multiple places/modules where you can whitelist.

Comodo deploys nice enough for me but configuration initially and going forward seems like a bit of a nightmare compared to my previous dealings with RMM products.

Can someone export their current production profile and post it up?

[nct]

@Can

Hi @mbarrett ,
In order to whitelist your applications, you can simply follow the steps below:
1-Create a new File Group under System Templates->File Groups Variables
2-Add application paths in that group (you can use environment variables to create generic paths e.g. ?:\Users*\Desktop*|)
3-Go to profiles and using the file group you create, add an exclusion rule under the security component which blocks the application
You can check How to White List files based on File group wiki below for more details.

Regards,
Can

i would suggest you try trusting applications first, before excluding with the File Variable Group.

[RT-AMS-ITarian]

Unfortunately you have to whitelist the application in many places as the different engines could stop it.

The main engines people seem to have problems with are Containment, Hips and firewall.

We spent a long time after V10 was released having major issues and put most clients back to V8.

​​​​​​We are currently testing V10. 2.x and V10. 3.x, so far they seem good that you can enable all features with no issues and whitelist works.

[RT-AMS-ITarian]

@chales

Hi there,

Our clients are really unsatisfied with using comodo antivirus. And we get the hit. Something keeps breaking. Either proxy settings don’t work, or the antivirus just stops working. I have a client with multiple issues and this has been escalated…we’re getting hits too!

See the attached:

I really wish we could have a remote session with the client to resolve the issue and appease them.

The list of issues you have experienced is identical to what we experienced. We have managed to have profiles created solving the issues to which v10.2.x and greater now seen to be working but we have not fully tested yet.