Comodo FileList Confusion

[Deleted member 2913]

I am confused with FileList - Unrecognized Files

I use default CIS settings.

I installed 2 programs.

There was no Unlimited Rights Alert.

The programs were not autosandboxed.

Sandboxed Apps option on the CIS main GUI shows "0".

When I run the 2 programs there is no green border.


FileList - Unrecognized Files - Shows many files related to those 2 programs.


It seems the programs were not sandboxed so why all the files in unrecognized list?


Both the programs were downloaded & installed after CIS install.

 

[viktik]

is Auto-sandbox Enabled?

• Have you done setting as shown below for "Unrecognized application"
• Set origin to "Any" for all three locations

 

[Deleted member 2913]

Autosandbox was enabled.
I know to change the settings to "Any" but I am not talking about that here.

I want to know, the settings were default, programs were not sandboxed so why all those files related to those programs in unrecognized filelist?

 

[hjlbx]

I am confused with FileList - Unrecognized Files

I use default CIS settings.

I installed 2 programs.

There was no Unlimited Rights Alert.

The programs were not autosandboxed.

Sandboxed Apps option on the CIS main GUI shows "0".

When I run the 2 programs there is no green border.


FileList - Unrecognized Files - Shows many files related to those 2 programs.


It seems the programs were not sandboxed so why all the files in unrecognized list?


Both the programs were downloaded & installed after CIS install.

@yesnoo

Do you remember if all the individual modules (e.g. *.exe, *.dll) were rated as Unrecognized - or - just some of them?

CIS will only sandbox modules that are loaded into active memory. Often, when a file is executed, only a few of its modules are loaded into memory. If none of the Unrecognized modules are loaded, then there will be no sandbox alert\sandboxing.

If you open the CIS Task Manager while those two apps are running, it will show on the right the Comodo file rating. If you see the files rates as Unrecognized then there should be HIPS (if enabled) and sandbox alerts. Obviously, you are already aware of this fact... I'm just trying to give you something that will help with troubleshooting.

Best Regards,

HJLBX

 

[Deleted member 2913]

Some files were in unrecog list.

If I remember correctly, when I run those programs & checked with KillSwitch, Virtualization for those programs was mentioned as disabled.

 

[hjlbx]

Some files were in unrecog list.

If I remember correctly, when I run those programs & checked with KillSwitch, Virtualization for those programs was mentioned as disabled.

It is better to check File Rating of running app by using CIS Task Manager.

 

[Rolo]

If I remember correctly,...

...and if you don't, you're on a wild goose chase. Always document/verify your settings (never say, 'default') and document the output. I've made a lot of money "fixing" computers and networks that were just misconfigured.