100% apps trusted, still sandboxing stuff

Status
Not open for further replies.

RejZoR

Level 15
Thread author
Verified
Top Poster
Well-known
Nov 26, 2016
699
I just don't get it what's Comodo doing. Testing CIS10 again, File Rating scan says 100% of apps is trusted. Then I run ASUS RealBench and bam, it sandboxes it. Are you dumb Comodo? Seems like yet another part of it is broken...
 

RejZoR

Level 15
Thread author
Verified
Top Poster
Well-known
Nov 26, 2016
699
The files that were already on drive BEFORE I've even installed CIS10. Usually File Rating Scan showed anything that wasn't yet trusted, but now it just says 100% trusted, but still sandboxes this stuff. Makes no sense.
 

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,153
I find that COMODO doesn't automatically read all the apps on the system. It misses a lot of them, until you run them. If you want to whitelist everything in your various program folders, you have to do exactly that.
 
D

Deleted member 2913

The files that were already on drive BEFORE I've even installed CIS10. Usually File Rating Scan showed anything that wasn't yet trusted, but now it just says 100% trusted, but still sandboxes this stuff. Makes no sense.
I think & as shmu26 mentioned, "Rating Scan" is not for each & every files on your system.

And files already on system before CIS install is treated as "Trusted" with "Internet Security" config only, are you running IS config?
 

RejZoR

Level 15
Thread author
Verified
Top Poster
Well-known
Nov 26, 2016
699
Clearly it is NOT trusted, but it was on the drive before I installed CIS10. Also, what's the point of rating scan if it doesn't check every EXE file on disk like old CIS versions did?
 
  • Like
Reactions: AtlBo

AtlBo

Level 28
Verified
Top Poster
Content Creator
Well-known
Dec 29, 2014
1,716
Somewhat off topic, but I was wondering who if anyone could say how Comodo handles purging in the files list. o/c manual purge is there, but does Comodo auto-purge ever. List grows in size very quickly it seems.
 

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,153
Clearly it is NOT trusted, but it was on the drive before I installed CIS10. Also, what's the point of rating scan if it doesn't check every EXE file on disk like old CIS versions did?
I found that CIS 8 also missed a lot of exe files on the disk, and only noticed them when I ran them.
 
D

Deleted member 2913

Somewhat off topic, but I was wondering who if anyone could say how Comodo handles purging in the files list. o/c manual purge is there, but does Comodo auto-purge ever. List grows in size very quickly it seems.
No auto-purge.
 
  • Like
Reactions: Venustus and AtlBo
5

509322

I just don't get it what's Comodo doing. Testing CIS10 again, File Rating scan says 100% of apps is trusted. Then I run ASUS RealBench and bam, it sandboxes it. Are you dumb Comodo? Seems like yet another part of it is broken...

Rating Scan checks the same directories as the antivirus Quick Scan + modules loaded into active memory at the time of the Rating Scan.

A user, if they so choose, can manually whitelist the entire system by adding C:\ to the File Rating list and changing the rating of any files rated as Unrecognized to Trusted. Doing this is not recommended both in terms of security and a known issue. The more you add to the local config database, the more unstable the GUI becomes and it will open more slowly and\or mis-behave.

Someone had reported a potential conflict between AppGuard and CIS. As it turns out it wasn't AppGuard, but instead due to the known issue above which Haibo Zhang - Director of Comodo Engineering confirmed last year.
 
Last edited by a moderator:

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,153
Rating Scan checks the same directories as the antivirus Quick Scan + modules loaded into active memory at the time of the Rating Scan.

A user, if they so choose, can manually whitelist the entire system by adding C:\ to the File Rating list and changing the rating of any files rated as Unrecognized to Trusted. Doing this is not recommended both in terms of security and a known issue. The more you add to the local config database, the more unstable the GUI becomes and it will open more slowly and\or mis-behave.

Someone had reported a potential conflict between AppGuard and CIS. As it turns out it wasn't AppGuard, but instead due to the known issue above which Haibo Zhang - Director of Comodo Engineering confirmed last year.
thanks for clearing that up!
 

RejZoR

Level 15
Thread author
Verified
Top Poster
Well-known
Nov 26, 2016
699
It doesn't need a digital signature to be whitelisted. And the change they made to only whitelist limited spectrum of EXE files is idiotic. It basically makes rating tool useless. And I thought they just improved their whitelist database so much that they managed to whitelist all my apps. Why do I want to like Comodo so much and they keep f**king things up with such moronic design decisions which they of course always miraculously forget to document, but they are always sure to mention they fixed 30 billion bugs... *sigh*
 

AtlBo

Level 28
Verified
Top Poster
Content Creator
Well-known
Dec 29, 2014
1,716
And the change they made to only whitelist limited spectrum of EXE file

Is this new to this version? I mean, what kind of security program would have a hole punched in its side by its devs before it's even launched who then expect it to float? I really just want to know more about this and what they must be thinking or if I am just wrong about the issue.
 

RejZoR

Level 15
Thread author
Verified
Top Poster
Well-known
Nov 26, 2016
699
I'm certain CIS 8.4 scanned all EXE files on ALL partitions. CIS 10 apparently only scans Windows folder and memory and that's it. I just knew something was wrong with the speed of the files rating scan...
 
  • Like
Reactions: AtlBo

AtlBo

Level 28
Verified
Top Poster
Content Creator
Well-known
Dec 29, 2014
1,716
Apologies, I had it backwards. I was thinking in terms of protected files, not trusted or unknown. In File Rating->File Groups, CF list of Executables (and in HIPS Protected Objects) doesn't include ps1 files, and I don't see anything java. I'm confused on this issue unfortunately. Can't tell if CF blanket allows the missing executable file types or if it's just not possible to protect them. I guess I wouldn't hate that so much.
 
  • Like
Reactions: Deleted member 2913

Brahman

Level 18
Verified
Top Poster
Well-known
Aug 22, 2013
886
It doesn't need a digital signature to be whitelisted. And the change they made to only whitelist limited spectrum of EXE files is idiotic. It basically makes rating tool useless. And I thought they just improved their whitelist database so much that they managed to whitelist all my apps. Why do I want to like Comodo so much and they keep f**king things up with such moronic design decisions which they of course always miraculously forget to document, but they are always sure to mention they fixed 30 billion bugs... *sigh*
If we start to complain there will be no end to any thing. No program is error free, that is why we are getting updates and bear in mind comodo is free and that leave little room for such harsh words.
 

RejZoR

Level 15
Thread author
Verified
Top Poster
Well-known
Nov 26, 2016
699
Excuses, excuses and more excuses. It feels almost like I've come to official Comodo forum... There are many free programs which don't have such design nonsense...
 
  • Like
Reactions: nikos200 and AtlBo
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top