Reply to thread

Message

<blockquote data-quote="Decopi" data-source="post: 1101292" data-attributes="member: 67091">At Comodo default settings, the Firewall is on &quot;safe&quot; mode, so no user here, it&#039;s automatic, Comodo uses an arbitrary list (not updated in 15 years) to identify what&#039;s &quot;know&quot;/&quot;unknown&quot;... that&#039;s all. And at Comodo the svchost is always identified as &quot;safe&quot;/&quot;trusted&quot;, therefore at Comodo any file using svchost always will have free comms.That said, if user changes Comodo default to &quot;custom rules&quot;, &quot;ask first&quot;, &quot;deny all&quot; or similar... then it becomes a nightmare, because in the best scenario an user can allow/block few apps, but 99,99% of the users never will know how to manage hundreds of Windows connections. Unfeasible and unreal! Not to mention that virus/malware connecting through svchost they will appear as requesting comms under the name of svchost, so 99,99% of the users will allow it.It&#039;s important always to talk about real world!Comodo is a blocker, and blockers in essence can block anything. However:1. A blocking function is not an identification/detection of virus/malware2&nbsp; Blocking is a trade-off, as long as you block more and more, you will have less and less usabilityThat said, 99,99% of the users in normal world, if they use Comodo, then they will use &quot;safe&quot; settings, which means that Windows Services files, svchost, and a long list of another files... all them will have free comms. Therefore, if a virus/malware hijacks one of these &quot;safe&quot;/&quot;trusted&quot; files... then the virus/malware will have comms. Period.PS: At Comodo (default settings) browsers work under several firewall rules, not just one rule. That said, not every browser uses svchost! It depends on the browser.</blockquote>

[QUOTE="Decopi, post: 1101292, member: 67091"] At Comodo default settings, the Firewall is on "safe" mode, so no user here, it's automatic, Comodo uses an arbitrary list (not updated in 15 years) to identify what's "know"/"unknown"... that's all. And at Comodo the svchost is always identified as "safe"/"trusted", therefore at Comodo any file using svchost always will have free comms. That said, if user changes Comodo default to "custom rules", "ask first", "deny all" or similar... then it becomes a nightmare, because in the best scenario an user can allow/block few apps, but 99,99% of the users never will know how to manage hundreds of Windows connections. Unfeasible and unreal! Not to mention that virus/malware connecting through svchost they will appear as requesting comms under the name of svchost, so 99,99% of the users will allow it. It's important always to talk about real world! Comodo is a blocker, and blockers in essence can block anything. However: 1. A blocking function is not an identification/detection of virus/malware 2 Blocking is a trade-off, as long as you block more and more, you will have less and less usability That said, 99,99% of the users in normal world, if they use Comodo, then they will use "safe" settings, which means that Windows Services files, svchost, and a long list of another files... all them will have free comms. Therefore, if a virus/malware hijacks one of these "safe"/"trusted" files... then the virus/malware will have comms. Period. PS: At Comodo (default settings) browsers work under several firewall rules, not just one rule. That said, not every browser uses svchost! It depends on the browser. [/QUOTE]

Verification