A few months back I had an issue when I was rolling out the Comodo Security Client to all of my machines, about 25% of them had issues with starting programs after the installation of the client. These were all Windows 7 SP1 machines that had the issue.
For example of what was happening, one test I would do to verify if the machine was affected was to open a command prompt (cmd.exe) window and it would just sit there with a blank window never fully initializing.
Strangely enough, one program that was not affected by the installation was Mozilla Firefox. For some reason, it would start up without issue.
In the end, I had to perform a system restore to before the installation of the Comodo Security Client to get the computer responding again.
I have slowly been installing the Security Client back onto those computers that had the issue; I have been making sure that I have gotten all Windows Updates and driver updates done before doing the installation, and it seemed to have been working.
However, I tried a machine recently and it had the same issue, so I am trying to figure out if anyone knows of a base cause.
Some other info:
When I stop all of the services that Comodo has within the Services (services.msc) panel in Windows, it makes no change.
When I boot into Safe Mode, programs do respond as expected.
The antivirus we were using before, TrendMicro OfficeScan, has been uninstalled before the installation of the Comodo Security Client.
Looks like I may have forgotten my own troubleshooting steps.
I checked my old support ticket and saw that I noted that the issue went away after I had uninstalled a program called “Print Audit 6.”
I see that this program is installed on the computer that ran into the problem.
I will see about uninstalling it and then reinstalling the Comodo Client Security software.
Luckily, it isn’t a program we were using (I think it got installed by our copier company to assess print job quantities), so uninstalling does make sense in the long run anyway.
However, anyone have any idea why this program, Print Audit 6, would cause this issue?
We thank you for providing the outputs of your test. We would like to investigate as well as to why the Client Security would interfere with most of your applications. We optimistically assume that you have properly set up the cloned profile on the ITSM profile and made necessary exclusions for any (in-house, legacy or company related applications that Comodo might deem as “unknown”). What are the applications that are affected by the Client Security Installation? Previous false positive flaggings have been resolved by our last releases.
Current
Client - Communication 6.19.12672.18060
Client - Security 10.6.0.6727
We are not certain as to why “Print Audit 6.” would be interfered with by CCS (Comodo Client Security). If the issue can be replicated on an endpoint, we can conduct an investigation by acquiring logs from the CCS present on the machine to determine the Security’s interaction with the software.
I’ve never felt the need to put a 3rd party firewall on top of the Windows Firewall, especially on Windows 10. Not just Comodo, I put Bitdefender in the same boat.
The firewall is an interesting module to be honest. As like @dittoit we do not have any issues with it except on medium spec machines which you notice a performance hit.
We do however have many issues with the firewall for the following situations to which we have a dedicate profile with this disabled on: -
Peer-to-Peer SMB File Sharing
Peer-to-Peer SMB Printer Sharing
DOS based network applications
Drinks machines and other similar device programming tools (GUI and CMD)
I will say that I created an “empty” profile to try to turn off all of the functions of the Comodo antivirus and firewall and it didn’t change the behavior.
To give more info on my findings from below, the specific Print Audit 6 version seems to be Print Audit 6.6.1. I tried installing 6.13.0 just now and it did not give same behavior, but I did install Print Audit AFTER Comodo in this troubleshooting try.
However, I decided to look at their release notes and found that in 6.7.0 that they appeared to have updated a few issues, namely:
> Client - Fixed issue where the Client would trigger false anti-virus warnings
> in some Antivirus programs on Windows Vista and Windows 7 32-bit.
Now… Comodo Client Security never logged any interactions with the program, so I am not sure if this actually would be the fix.
Trying to find a computer that I can play with during the day that still has this 6.6.1 program installed, but typically they are all in use during business hours.
If I could effectively disable the Windows Firewall (which is such a gamble to do on Win 10) then I would definitely replace it with the Comodo Firewall and management it from the RMM. But because I can’t effectively disable the Windows Firewall on most Win 10 machines without causing some sort of issue (initially or down the road with a feature update) then I prefer to refrain from having two firewalls since that adds to complexity and little additional value.
Also, the first bulletin is not accurate, a lot of MSPs use PolicyPak to manage AD GPOs from the cloud. PolicyPak doesn’t 100% cover all of the AD GPO settings but does cover a lot.
The problem with PolicyPak is the following: -
Not an MSP product as you can only use one domain controller with your cloud license (As far as I can tell from all the training videos)
No GPO editing via the website, you have to edit them on your DC and export them as XML and upload them to PolicyPak cloud if you want your non-domain joined devices to act in the same way
I like the idea, but other than adding in other desktop application settings it is just a tool to enable you to use GPO over some MDM suites.
More information on the original issue; these are programs on Windows 7 Pro SP1 x64.
PROGRAMS THAT DON"T LOAD PROPERLY (DON"T SHOW A GUI)
cmd.exe
mmc.exe
regedit.exe
taskmgr.exe (Task Manager) Google Chrome
Adobe Reader DC
Internet Explorer
HP Support Assistant
Comodo KillSwitch
Paint
Notepad Remote Desktop Connection Client
Snipping Tool
Calculator
XPS Reader
PROGRAMS THAT DO WORK:
Firefox 61.0
Skype
Dropbox 52.4.60
GoToMeeting
PROMAS6 for Associations (Property Management Software)
Namo WebEditor5
Windows Media Player
Microsoft Word 2010
I found that by disabling the service that ran “pa6clhlp64.exe” that it would allow all programs to work just fine. For my experience, this was specifically with Print Audit 6.6.0. I would end up disabling the service while in safe-mode.
Luckily, after figuring this out, I didn’t have to do system restores anymore when running into the problems.
As for the firewall suggestion, I created a Profile that was “Empty” in that it told every service for the Comodo Client Security to be turned OFF. Therefore, I don’t believe that the suggestion was a fix. Also, I was unable to check on Windows Firewall since it blocked me while in Windows of viewing it, but I did see that Windows Action Center was alerting me to either turn on the firewall or find a 3rd party one, so I believe it was off.
I was finally able to reproduce on a machine that has been working fine with Comodo Client Security and never had the Print Audit 6 software.
To replicate, I installed Print Audit 6.6.0 onto the machine. After restart on Windows 7 Pro SP1 x64 I started running into the issues; on Windows 10 Pro x64, I did not see the issues.
However, I then updated to Print Audit 6.13.0 and found that the issues no longer showed.
So… in the end, I think it is specific to the version installed.
However, at the start of it all, I had no idea what was behind the annoying issue and had to perform a system restore on multiple machines when I was pushing the Client Security client out; but luckily, now I will not have to do that anymore.
We thank you for giving more details of your presented issue. We have sent a support email for investigating your reported issue with needed account details via your forum registered email. Please do check yourmailbxx at your convenience.
Well done for finding this, sometimes it is hard to find what is being blocked / upset by Comodo which I believe the team are working on better reporting to help.