It should also be prevented by a path other than C:\Windows\System32. Because in the .cfgx file:
Code:
<Rules />
</PolicyItem>
<PolicyItem UID="{63870DEE-7851-4E34-A024-59F76402B328}" Flags="0" Filename="C:\Windows\System32\svchost.exe"
You're right. However, please allow me some clarifications:
As you know, at Comodo one module is the Containment, and another module is the Firewall.
Containment is a dumb blocker, based on a "known"/"unknown" list. Since that list has not been updated for 15 years, Comodo tends to block tons of valid executables. Still, it has been proven many times that Containment is vulnerable and can be bypassed. Even in the past, Comodo itself labeled as "known" (valid) executables that were viruses/malware, and obviously bypassed Containment. But as you rightly say, at first you expect a blocker, no matter how dumb it is, to block all files that are "unknown". And in this context, making a video showing a fake svchost ("unknown") blocked by Containment... makes no sense.
Now, the Firewall module in Comodo by default considers hundreds of files as "safe"/"trusted", allowing free comms. As you rightly say, C:\Windows\System32\Svchost is one of those hundreds of files considered "safe"/"trusted", therefore at Comodo it has free comms. Therefore at Comodo, a virus/malware can hijack svchost, and the Firewall will be bypassed. This is not a bug, it is a design flaw, because Comodo Firewall does not allow customization of "safe"/"trusted" files, and "safe"/"trusted" is an arbitrary outdated list of hundreds of files. Therefore, Comodo Firewall is a placebo.
In this context, it is a fallacy to make a video showing that Containment blocked a virus/malware, for three reasons:
1. With Containment disabled, the Firewall would allow the virus/malware to hijack svchost, and worse, the Firewall would allow free comms. No honest video can hide Comodo Firewall's flaw;
2. If the fake argument here is "Firewall worked because comms were containerized/sandboxed", then you can eliminate the Firewall because this fake argument implies that everything can be done just with the Containment;
3. With Containment enabled, if the virus/malware is blocked, it proves nothing about the Firewall!
Containment cannot tell you anything about the Firewall, that's a fallacy!
And even if a video shows a blocked virus/malware by Containment, that's a manipulation, because for every virus/malware blocked by Containment there are other viruses/malwares that are NOT blocked. No software is perfect, none blocks 100%, just as no antivirus/antimalware is 100% efficient. It's an irresponsible dishonest selective manipulation to show whatever Comodo Containment blocks, when there are always viruses/malware that are not blocked and can bypass Comodo Containment.
