Reply to thread

Message

<blockquote data-quote="Terry Ganzi" data-source="post: 899695" data-attributes="member: 18831">For any Comodo newbies that may read this post, please know that the heart of Comodo&#039;s protection mechanism is Auto-containment- and this at ANY other setting than default. I suggest Restricted. Also, personally I don&#039;t feel that the HIPS is needed (except as Easter has stated above to track what a malicious file is doing for amusement) with Containment set properly.The reason for the above statement is that both the default Containment setting and the HIPS module (even at Paranoid Mode) can result in system changes being made- which for me is unacceptable. Although the most common and most trivial can be the desktop background being changed (easy enough to rectify), a more serious (and greater pain to fix) is the inability of default Containment and Paranoid HIPS to prevent a malware file to utilize Windows Management Instrumentation (wmic.exe). This can lead to things like a System Reserved partition being created (a relatively current example of this sort of thingy is the Avaddon ransomware).WMIC can (and has) be used for other nasty things, but setting up CF with the configuration that I have suggested will just laugh at stuff like this, which needless to say is Optimal.M cruelsister[URL unfurl=&quot;true&quot;]https://www.wilderssecurity.com/threads/comodo-auto-containment-comparable-to-sandboxie.425260/[/URL]</blockquote>

[QUOTE="Terry Ganzi, post: 899695, member: 18831"] For any Comodo newbies that may read this post, please know that the heart of Comodo's protection mechanism is Auto-containment- and this at ANY other setting than default. I suggest Restricted. Also, personally I don't feel that the HIPS is needed (except as Easter has stated above to track what a malicious file is doing for amusement) with Containment set properly. The reason for the above statement is that both the default Containment setting and the HIPS module (even at Paranoid Mode) can result in system changes being made- which for me is unacceptable. Although the most common and most trivial can be the desktop background being changed (easy enough to rectify), a more serious (and greater pain to fix) is the inability of default Containment and Paranoid HIPS to prevent a malware file to utilize Windows Management Instrumentation (wmic.exe). This can lead to things like a System Reserved partition being created (a relatively current example of this sort of thingy is the Avaddon ransomware). WMIC can (and has) be used for other nasty things, but setting up CF with the configuration that I have suggested will just laugh at stuff like this, which needless to say is Optimal. M cruelsister [URL unfurl="true"]https://www.wilderssecurity.com/threads/comodo-auto-containment-comparable-to-sandboxie.425260/[/URL] [/QUOTE]

Verification