Reply to thread

Message

<blockquote data-quote="AtlBo" data-source="post: 810085" data-attributes="member: 32547">Not 100% conclusive, however, here is my surprise finding.&nbsp; I switched to firewall mode, HIPs and containment disabled, and NO alert for the .bat.&nbsp; Then I activated containment to see if that would respond by itself-&gt;again NO alert.&nbsp; So then I turned on HIPs in Safe Mode and voila-&gt;normal alerts.One note, I did NOT see an alert for containment, even with Auto-contain enabled.&nbsp; OK, this causes me to question whether there are deeper settings in the &quot;Firewall&quot; profile configuration which are different than &quot;Proactive&quot;.&nbsp; Also, maybe it is due to system/settings lag, idk.&nbsp; BTW, I am running version 10 still on this PC, while testing 11 on another.&nbsp; Don&#039;t think there is a difference, but...If this is the way HIPs works in all profile configurations, it&#039;s clumsy.&nbsp; If it HIPs is required for heuristics, that would be in another direction clumsy and ugly too.&nbsp; Running Comodo without HIPs would be almost impossible.&nbsp; I would have to enable HIPs and then create a rule to allow without an alert all activity except command line in order to stop the module from blocking.&nbsp; I don&#039;t think that would be a simple matter, if even possible.Something else crosses my mind.&nbsp; The container works for Cruelsister in Proactive mode with HIPs off.&nbsp; There must be a very deep difference between the default &quot;Firewall&quot; and &quot;Proactive&quot; settings profiles.&nbsp; Need to come up with another way to test in &quot;Proactive&quot;.&nbsp; I&#039;ll look into saving settings and see if I can restore to defaults without too much trouble.</blockquote>

[QUOTE="AtlBo, post: 810085, member: 32547"] Not 100% conclusive, however, here is my surprise finding. I switched to firewall mode, HIPs and containment disabled, and NO alert for the .bat. Then I activated containment to see if that would respond by itself->again NO alert. So then I turned on HIPs in Safe Mode and voila->normal alerts. One note, I did NOT see an alert for containment, even with Auto-contain enabled. OK, this causes me to question whether there are deeper settings in the "Firewall" profile configuration which are different than "Proactive". Also, maybe it is due to system/settings lag, idk. BTW, I am running version 10 still on this PC, while testing 11 on another. Don't think there is a difference, but... If this is the way HIPs works in all profile configurations, it's clumsy. If it HIPs is required for heuristics, that would be in another direction clumsy and ugly too. Running Comodo without HIPs would be almost impossible. I would have to enable HIPs and then create a rule to allow without an alert all activity except command line in order to stop the module from blocking. I don't think that would be a simple matter, if even possible. Something else crosses my mind. The container works for Cruelsister in Proactive mode with HIPs off. There must be a very deep difference between the default "Firewall" and "Proactive" settings profiles. Need to come up with another way to test in "Proactive". I'll look into saving settings and see if I can restore to defaults without too much trouble. [/QUOTE]

Verification