Advice Request COMODO blocks Windows Updates with error 0x80070005

Please provide comments and solutions that are helpful to the author of this topic.
Pico said:
Then the test does not cover the containment rule.
Click to expand...
Yes. However, there is no reason to believe that with HIPS OFF, this rule will work differently in the sandbox and start to protect files in the virtualized %windir%.
 
  • +Reputation
Reactions: simmerskool
Andy Ful said:
Yes. However, there is no reason to believe that with HIPS OFF, this rule will work differently in the sandbox and start to protect files in the virtualized %windir%.
Click to expand...
There are more special rules which end on |.
All those special rules are crafted for containment operation.

Tamper with these special rules at own risk.
 
Pico said:
Tamper with these special rules at own risk.
Click to expand...

The default Autocontainment settings in the Proactive Security config, with disabled HIPS and removed rule %windir%\*|, allow running my test.exe with Administrator or System privileges, but prevent running it with Trusted Installer privileges. So, the contained test.exe cannot get Trusted Installer privileges and cannot do any harm in the %windir% folder.

All of this suggests that in @cruelsister's settings (Proactive config with disabled HIPS), the rule %windir%\*| can be deleted. To be sure if there are no side effects, this should be discussed on the Comodo forum in the context of Windows Update failures.
 
  • +Reputation
Reactions: simmerskool
Andy Ful said:
The default Autocontainment settings in the Proactive Security config, with disabled HIPS and removed rule %windir%\*|, allow running my test.exe with Administrator or System privileges, but prevent running it with Trusted Installer privileges. So, the contained test.exe cannot get Trusted Installer privileges and cannot do any harm in the %windir% folder.

All of this suggests that in @cruelsister's settings (Proactive config with disabled HIPS), the rule %windir%\*| can be deleted. To be sure if there are no side effects, this should be discussed on the Comodo forum in the context of Windows Update failures.
Click to expand...
Why do you think so?
To my knowledge CF setting uses "run restricted" containment level and the special rules ending with | are being used in that case.
Removing the special rule weakens CF settings.
 
Pico said:
Why do you think so?
To my knowledge CF setting uses "run restricted" containment level and the special rules ending with | are being used in that case.
Removing the special rule weakens CF settings.
Click to expand...

If I recall correctly, HIPS is OFF in @cruelsister's Comodo Firewall settings.
As you can see from my posts, the rule %windir%\*| works as intended only when HIPS is ON. Otherwise, it does not protect system executables in %windir% (which is a main reason for using it). This is expected behavior for a HIPS rule (when HIPS is disabled).
Deleting this rule seems to improve the Windows Updates when Microsoft Defender is enabled.

Bearing in mind the reports in this thread, using the %windir%\*| rule can cause problems with Windows Updates when Microsoft Defender is enabled. I do not insist on what to do. The problem (probably related to Windows 25H2) should be discussed with the Comodo staff. I did not encounter such problems with Windows Updates on Windows 23H2.
 
Last edited:
  • +Reputation
Reactions: simmerskool
Andy Ful said:
If I recall correctly, HIPS is OFF in @cruelsister's Comodo Firewall settings.
As you can see from my posts, the rule %windir%\*| works as intended only when HIPS is ON. Otherwise, it does not protect system executables in %windir% (which is a main reason for using it). This is expected behavior for a HIPS rule (when HIPS is disabled).
Deleting this rule seems to improve the Windows Updates when Microsoft Defender is enabled.

Bearing in mind the reports in this thread, using the %windir%\*| rule can cause problems with Windows Updates when Microsoft Defender is enabled. I do not insist on what to do. The problem (probably related to Windows 25H2) should be discussed with the Comodo staff. I did not encounter such problems with Windows Updates on Windows 23H2.
Click to expand...
Don't ignore the functionality of the | character in the rule which is meant for containment operation even with HIPS turned off.
 
Pico said:
Don't ignore the functionality of the | character in the rule which is meant for containment operation even with HIPS turned off.
Click to expand...

Why do you think so? Is there some info about it? I only found this:

1765199854122.png


From that post, it does not follow that the rule can work when HIPS is OFF.
In the same thread we can see:

1765200628826.png


So HIPS must be ON, and Autocontainment cannot be set to "Run virtually". Furthermore, the rule can be useful when Autocontainment is set to partially limited.
Two of the predefined Comodo configurations (Comodo - Internet Security and Comodo Proactive Security) use Autocontainment as "Run virtually", so the rules with pipes ("|") do not work for contained processes even when HIPS is ON.
 
Last edited:
  • +Reputation
Reactions: simmerskool
The | character usage is undocumented, not explained in CIS User Guide and on Comodo forum info about | is very hard to find.
Below is a link to info about all wildcard characters including the | character used by CIS.
One user attempted to test / verify the | function but the test failed.

The | character has been used in CIS rules since version 5 and may be still in use by current CIS versions.
It's a good kept secret how this | character exactly works
I would strongly recommend to not remove it from the standard rules that get installed by CIS.

Here's is the link with all collected / available info around | character (and other characters like ? and * as well).

CIS Wildcard Help


Edit: I just saw you found the same info
 
  • Like
Reactions: simmerskool
Pico said:
I would strongly recommend to not remove it from the standard rules that get installed by CIS.
Click to expand...

I strongly recommend asking the Comodo staff before posting such a strong recommendation.(y)
It is an open question whether this rule can bring more gain than trouble.

Edit.
There are some cons of temporarily deleting the HIPS rules with pipes. They cannot be recovered manually, because the rule editor does not accept pipes!
The awkward solution is exporting the Comodo configuration and then importing it with a custom name. After activating the imported configuration, the rule with a pipe can be deleted. This custom configuration can be temporarily used if necessary.
 
Last edited:
  • +Reputation
Reactions: simmerskool
Make sure your not running a windows full of lolbin which would break wintrust so I suggest to use virustotal to see if windows files are properly signed.
It could be a malicious update or an attempt to downgrade your system. numerous way like this one exist for windows.
 
What is "Helen" for error-0x80070005?

The solutions posted in this thread are strange. I do not have an idea why they work. So, I tried something closer to standard procedure.
I used VirtualBox VM (Windows 11 Home 25H2) + Comodo Firewall (Proactive config + HIPS OFF) + Microsoft Defender (default settings) to install the latest Preview Update (KB5070311) (26200.7309). The update failed as usual with error 0x80070005. Instead of using the solutions mentioned in this thread, I did as follows:
  1. Windows restart.
  2. Windows Updates healing.
  3. Windows restart.
  4. Windows Update ---> failed with error 0x800f0991 (different from initial error)
  5. Windows restart.
  6. Windows Update healing.
  7. Windows Update ---> installed successfully.
Windows Update healing (copy/paste the below code into Admin PowerShell console):
Code: 
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
del C:\Windows\SoftwareDistribution.old
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
del C:\Windows\System32\catroot2.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver
netsh winsock reset

Conclusion.
In my case, the "Helen" (primary source of trouble) was probably some artifact left after previous updates/upgrades to Windows 25H2.
 
Last edited:
  • +Reputation
Reactions: simmerskool
It seems that a similar (as in my case) issue could have happened a few years ago to some users with Comodo Firewall + Kaspersky:

KFA e COMODO Firewall - Erro 0x80070005 Windows Update

Quando instalado o KFA 2019 e o COMODO Firewall, o Windows Update na instalação de atualizações cumulativas dá o erro 0x80070005. Apenas com o KFA 2019 instalado o erro não aparece e a instalação é feita normalmente, apenas com o COMODO Firewall o erro também não aparece. E com o COMODO Firewall ...
forum.kaspersky.com forum.kaspersky.com

Kaspersky alone ---> Windows Update OK
Comodo Firewall (no Kaspersky) ---> Windows Update OK
Comodo Firewall + Kaspersky ---> error 0x80070005
 
  • Like
Reactions: rashmi
Issue came back on 1 machine out of 2. What was the other proposed solution? Removing windir under protected HIPS files?
 
TheMalwareMaster said:
Issue came back on 1 machine out of 2. What was the other proposed solution? Removing windir under protected HIPS files?
Click to expand...

You have a few solutions to try. If you want to delete the %windir% rule, temporarily use a custom configuration as explained here:
Andy Ful

Advice Request Post in thread 'COMODO blocks Windows Updates with error 0x80070005'

Pico said:
I would strongly recommend to not remove it from the standard rules that get installed by CIS.
Click to expand...

I strongly recommend asking the Comodo staff before posting such a strong recommendation.(y)
It is an open question whether this rule can bring more gain than trouble.

Edit.
There are some cons of temporarily deleting the HIPS rules with pipes. They cannot be recovered manually, because the rule editor does not accept pipes!
The awkward solution is exporting the Comodo configuration and then importing it with a custom name. After activating the imported configuration, the rule with a...
  • +Reputation

You can also try the last solution:
Andy Ful

Advice Request Post in thread 'COMODO blocks Windows Updates with error 0x80070005'

What is "Helen" for error-0x80070005?

The solutions posted in this thread are strange. I do not have an idea why they work. So, I tried something closer to standard procedure.
I used VirtualBox VM (Windows 11 Home 25H2) + Comodo Firewall (Proactive config + HIPS OFF) + Microsoft Defender (default settings) to install the latest Preview Update (KB5070311) (26200.7309). The update failed as usual with error 0x80070005. Instead of using the solutions mentioned in this thread, I did as follows:
  1. Windows restart.
  2. Windows Updates healing.
  3. Windows restart.
  4. Windows...
  • +Reputation
 
  • +Reputation
  • Like
Reactions: rashmi and simmerskool

You may also like...