3 replies to this topic

[LavaJ431]

Using the installer based on the build of 4/19/11, the installation appears to go smoothly and quickly. However, instead of being finished when it says it is finished, it then launches into an updating operation, which runs for many minutes. The updating appeared to have finished successfully, and I was waiting for the reboot to start, when the system produced a BSOD.

The message identified lbd.sys as the probable cause, and said that "The driver unloaded without cancelling pending operations." STOP: 0x000000D4 (0xADE26234, 0X0000001C, 0X00000000, 0X880502337)

This has happened 3 times. The last two times, I had manually closed all running processes except Comodo before starting the installation. Comodo is installed without the anti-virus component, and only has the firewall and Defense + operating. After the installation had "finished," and before the updating had begun, I set Comodo to ignore all drivers and executables in the Ad-Aware installation folder.

Edited by CeciliaB, 24 April 2011 - 03:23 PM.
Corrected driver name in topic title /Cecilia

[CeciliaB]

Hi LavaJ431,

Maybe you have to tell Comodo to ignore more since drivers, as LBD.sys, are not installed in the program folder but in a Windows folder.

[LavaJ431]

Hi LavaJ431,

Maybe you have to tell Comodo to ignore more since drivers, as LBD.sys, are not installed in the program folder but in a Windows folder.

That's a good thought. At the time that I made the Comodo exclusions during the installation, I didn't know anything about LBD.sys, or where it might be installed.

I've successfully installed Panda Cloud, AVG, Avast, and Antivir at various times without even making any adjustments to Comodo, so Ad-Aware may be particularly sensitive--or, that may not have been the cause of the failures at all.

If Comodo was the cause of the install failures, however, it would probably be because the LBD driver is installed at the most privileged level--kernel-mode during the boot phase. I don't believe any of the other drivers operated at that level. Comodo could have blocked that automatically, without issuing the usual prompt asking me to allow or block.

In any event, I can assure you that I won't be going through another install attempt in order to test these hypotheses.

[CeciliaB]

It is rather common that antivirus programs have a driver on the most privileged level for best possibilities to detect and remove rootkits, but I don't know if that is the case for the four you mention. It might also be possible that Comodo has special treatment of the most common antivirus programs but not for Ad-Aware.