App Review Comodo Firewall 10 Setup

[AtlBo]

It will, but I run it w/Comodo just because of past experiences with slight instability. It's a 100% a fallback option, and I wouldn't have AppCheck except that it's so light. Also, if you allow something to run outside the container that Comodo doesn't "Trust" there is a fallback at least and a chance to block r/w.

Anyway, I think Comodo is in the process of turning Viruscope recognizer into this type of system monitor in time or at least m/b it will have this kind of capability.

 

[ncage]

Guys after watching the video i have lots and lots of questions. I stared composing it in word and it would be a couple pages long . Would you rather get it question at a time so as not water down any of the questions or should i just post everything at once? I'm thinking the settings in the video are really good if you were setting it up for someone with low technical knowledge and are kind of protecting them for their selves but depending on what you are wanting to do i'm guessing you should tweak the settings from there and i'm trying to understand each setting so i can set everything up perfectly.

 

[codswollip]

Would you rather get it question at a time

If only to see where you are going with this, and to give feedback. The video was self-explaining to me, although CF interface has changed slightly since.

I'd suggest a new thread.

 

[ncage]

If only to see where you are going with this, and to give feedback. The video was self-explaining to me, although CF interface has changed slightly since.

I'd suggest a new thread.

I'm not saying the video was confusing its more than comodo's settings are confusing and the documentation isn't the best. What comodo is doing behind the scene? I'm the type that doesn't like to change a setting unless i understand 100% what its doing. A good example would be "Do not show privileged alearts" which you can choose one of the following if you select it:
1. Run Inside Container
2. Run Unlimited
3. Run Unlimited And Trust
4. Block

Yes you won't get an UAC dialog is pretty simple to understand but what happens after that is not.

1 & 4 are pretty easy. What in the world is the difference between "Run Unlimited" & "Run Unlimited & Trust"? Only thing i could think of is "Run Unlimited & Trust" maybe would trust any processes it spawns? What if you didn't have this check box checked? Would it ask you how you would like to run the process? I would assume anything spawned from a container would also be sandboxed but maybe i'm wrong. I'm just hoping if you click yes to the UAC dialog then there won't be a possibility that something could escape from the sandbox. Maybe CS whole point of checking this box if for the lay user won't get comodo popups that confuse them.

 

[shmu26]

I'm not saying the video was confusing its more than comodo's settings are confusing and the documentation isn't the best. What comodo is doing behind the scene? I'm the type that doesn't like to change a setting unless i understand 100% what its doing. A good example would be "Do not show privileged alearts" which you can choose one of the following if you select it:
1. Run Inside Container
2. Run Unlimited
3. Run Unlimited And Trust
4. Block

Yes you won't get an UAC dialog is pretty simple to understand but what happens after that is not.

1 & 4 are pretty easy. What in the world is the difference between "Run Unlimited" & "Run Unlimited & Trust"? Only thing i could think of is "Run Unlimited & Trust" maybe would trust any processes it spawns? What if you didn't have this check box checked? Would it ask you how you would like to run the process? I would assume anything spawned from a container would also be sandboxed but maybe i'm wrong. I'm just hoping if you click yes to the UAC dialog then there won't be a possibility that something could escape from the sandbox. Maybe CS whole point of checking this box if for the lay user won't get comodo popups that confuse them.

If you have questions about specific Comodo settings, the first place to look is the Comodo help. Comodo Internet Security, Antivirus protection, Firewall Software | Security Help
There are a lot of details there about various settings. If it is not detailed enough, ask on Comodo forum, they know the product.

You are right that CS's video is primarily targeting the beginning to intermediate users, it is not for advanced users who are willing to get their hands dirty and risk making big mistakes.
For instance, almost the first thing CS does is disable HIPS, which is the most powerful component, but also the most complex and accident-prone.

 

[AtlBo]

ncage...

Rather than answer your questions all at once here, here are some thoughts to consider. Let me start with a quote from you:

I'm not saying the video was confusing its more than comodo's settings are confusing and the documentation isn't the best.

Couldn't have put it better. You will find the help will become more valuable as you work through things, but it took me a year or so before I would have said this was true for me. Next, this might help you pick things up more quickly. Comodo settings aren't going to make perfect sense to you. This is because they don't make 100% sense in the first place. There isn't anything per se missing but there are quirks.

The privileges escalation setting does not turn off UAC. It does seem to indicate this the way it is worded, but it is not the case. Basically, if you choose to show the alert for apps that want raised privileges, the options you get on the alert are the same ones you see listed in the setting. I recommend unchecking the box and then simply do not choose to remember your choice to disallow/allow privilege escalation for a given executable (unless you are sure it should be blocked). Then you can choose to remember the choice. These don't happen very oftenly. By far most things you run will be auto-allowed because of the "Trusted Vendor" list.

Run Unlimited v Run Unlimited and Trust->basically the same thing but the latter adds the rating of "Trusted" to the executable in the "File List" in the settings. This means no element of Comodo will be monitoring the executable. Anyway, I recommend staying away from this setting. Just uncheck the box. Also, on the various types of alerts (Firewall/HIPS/Containment) I recommend staying away from designating (and remembering) an executable as a type (i.e "Allowed" or "Installer" etc.). These settings can cause you consternation later when you go through your rules. Keep it simple and block or allow and remember if you are 100% sure and you can safely run Proactive with HIPS on no problem.

The privilege elevation alerts btw, will not stop Auto-containment from happening. On first run of an executable that is not auto-allowed, you will get both alerts. For me, it behaves more like an extra HIPS alert, although I admit remembering a choice I suppose would lead to de-containing an executable the second time it runs.

On @cruelsister's settings I think it's a good place to start, but I like HIPS. For me, this means also making some other adjustments to her settings to limit my opportunities for accidently creating "Trusted" in the "File List" Mostly, I gear my thinking to allow or block without remembering, unless I am 100% sure of my choice. In that case, then fine, remembering that an allow will create "Trusted" status in the "File List". Cruelsister eliminates HIPS but she also chooses to trust the Comodo system by not seeing alerts for privilege escalation (I think firewall too). That's fine, and it works extremely well too, but I like the extra layer HIPS provides, since I might take a chance at some point.

 

[shmu26]

@AtlBo, what's the easiest way to delete Trusted Vendors and then add back the ones I use?
Someone said you can do this by running a Ratings scan, but I can't figure out how.

 

[Tiny]

@AtlBo, what's the easiest way to delete Trusted Vendors and then add back the ones I use?
Someone said you can do this by running a Ratings scan, but I can't figure out how.

Delete all trusted vendors then go to Tasks > General Tasks > Scan (Scan your computer for viruses and spyware). It should repopulate a list it considers safe from the scan. This is from what I recall was in the post you mentioned. Haven't tried it myself.
CF/cs- Editing the Trusted Vendors List

 

[shmu26]

Delete all trusted vendors then go to Tasks > General Tasks > Scan (Scan your computer for viruses and spyware). It should repopulate a list it considers safe from the scan. This is from what I recall was in the post you mentioned. Haven't tried it myself.
CF/cs- Editing the Trusted Vendors List

It's true that it will find the trusted files. But it doesn't add the vendors automatically, it just gives you an idea about what you trusted.
It seems the best method is to start up your main programs, and then add vendors from "read from a running process"

 

[Tiny]

It's true that it will find the trusted files. But it doesn't add the vendors automatically, it just gives you an idea about what you trusted.
It seems the best method is to start up your main programs, and then add vendors from "read from a running process"

I personally think so too.

 

[AtlBo]

@AtlBo, what's the easiest way to delete Trusted Vendors and then add back the ones I use?
Someone said you can do this by running a Ratings scan, but I can't figure out how.

@shmu26...the way that worked for me was to start with a list that you would like to keep. You may not know the devs all by name but by using the search at the top you can search for a keyword like Google or Microsoft (click on magnifying glass right side of the dev column header). Before starting make sure all the items are checked and then search the dev column by typing in your keywords one by one. For all the ones that show up that you want to keep, uncheck the box. Then move to the next keyword and do the same thing. Once you have gone through the list, then click delete and all the checked ones (that you didn't uncheck) will be deleted.

Works well, but trimming has its down side. You kind of lose Comodo's input on what is safe, and you will get more pop ups o/c. Turning off Cloud Lookup will keep Comodo from adding back entries into the TVL when it detects one on the cloud. For me, this it's sort of necessary to turn off C/L when trimming in order to monitor more closely what is granted trust, which is basically the entire reason for limiting the list in the first place I suppose. In spite of the down side with more pop ups I like the TVL & Cloud Lookup this way since I don't install a ton of programs. This way you will get your 2 cents on apps from vendors not in your amended TVL if you use HIPS and also from the firewall.

 

[shmu26]

@shmu26...the way that worked for me was to start with a list that you would like to keep. You may not know the devs all by name but by using the search at the top you can search for a keyword like Google or Microsoft (click on magnifying glass right side of the dev column header). Before starting make sure all the items are checked and then search the dev column by typing in your keywords one by one. For all the ones that show up that you want to keep, uncheck the box. Then move to the next keyword and do the same thing. Once you have gone through the list, then click delete and all the checked ones (that you didn't uncheck) will be deleted.

Works well, but trimming has its down side. You kind of lose Comodo's input on what is safe, and you will get more pop ups o/c. Turning off Cloud Lookup will keep Comodo from adding back entries into the TVL when it detects one on the cloud. For me, this it's sort of necessary to turn off C/L when trimming in order to monitor more closely what is granted trust, which is basically the entire reason for limiting the list in the first place I suppose. In spite of the down side with more pop ups I like the TVL & Cloud Lookup this way since I don't install a ton of programs. This way you will get your 2 cents on apps from vendors not in your amended TVL if you use HIPS and also from the firewall.

Good idea.
I noticed that no matter what you do, Comodo Security Solutions will add itself back to the list, right away.
Fortunately, this is not the sig that Comodo uses when they certify 3rd party software.

 

[ncage]

If you have questions about specific Comodo settings, the first place to look is the Comodo help. Comodo Internet Security, Antivirus protection, Firewall Software | Security Help
There are a lot of details there about various settings. If it is not detailed enough, ask on Comodo forum, they know the product.

You are right that CS's video is primarily targeting the beginning to intermediate users, it is not for advanced users who are willing to get their hands dirty and risk making big mistakes.
For instance, almost the first thing CS does is disable HIPS, which is the most powerful component, but also the most complex and accident-prone.

Thanks and that answered one of my questions about HIPS (as in why turn it off). I know hips would confuse a lot of users (i wouldn't turn it on for my wife or my parents) but i think i will keep it on for me. A good example of this is i love the alerts that emsisoft gets but for the lay user this would be to much (at least it doesn't make you make any choices) while bitdefender (especially under autopilot) doesn't give you any. While this is great for my wife & parents im not a big fan of this for me.

 

[ncage]

ncage...

Rather than answer your questions all at once here, here are some thoughts to consider. Let me start with a quote from you:



Couldn't have put it better. You will find the help will become more valuable as you work through things, but it took me a year or so before I would have said this was true for me. Next, this might help you pick things up more quickly. Comodo settings aren't going to make perfect sense to you. This is because they don't make 100% sense in the first place. There isn't anything per se missing but there are quirks.

The privileges escalation setting does not turn off UAC. It does seem to indicate this the way it is worded, but it is not the case. Basically, if you choose to show the alert for apps that want raised privileges, the options you get on the alert are the same ones you see listed in the setting. I recommend unchecking the box and then simply do not choose to remember your choice to disallow/allow privilege escalation for a given executable (unless you are sure it should be blocked). Then you can choose to remember the choice. These don't happen very oftenly. By far most things you run will be auto-allowed because of the "Trusted Vendor" list.

Run Unlimited v Run Unlimited and Trust->basically the same thing but the latter adds the rating of "Trusted" to the executable in the "File List" in the settings. This means no element of Comodo will be monitoring the executable. Anyway, I recommend staying away from this setting. Just uncheck the box. Also, on the various types of alerts (Firewall/HIPS/Containment) I recommend staying away from designating (and remembering) an executable as a type (i.e "Allowed" or "Installer" etc.). These settings can cause you consternation later when you go through your rules. Keep it simple and block or allow and remember if you are 100% sure and you can safely run Proactive with HIPS on no problem.

The privilege elevation alerts btw, will not stop Auto-containment from happening. On first run of an executable that is not auto-allowed, you will get both alerts. For me, it behaves more like an extra HIPS alert, although I admit remembering a choice I suppose would lead to de-containing an executable the second time it runs.

On @cruelsister's settings I think it's a good place to start, but I like HIPS. For me, this means also making some other adjustments to her settings to limit my opportunities for accidently creating "Trusted" in the "File List" Mostly, I gear my thinking to allow or block without remembering, unless I am 100% sure of my choice. In that case, then fine, remembering that an allow will create "Trusted" status in the "File List". Cruelsister eliminates HIPS but she also chooses to trust the Comodo system by not seeing alerts for privilege escalation (I think firewall too). That's fine, and it works extremely well too, but I like the extra layer HIPS provides, since I might take a chance at some point.

A most excellent post and i appreciate your time in composing/posting it. Makes more sense now. I'm with you i want to see what things are doing and make choices. For example i don't want to automatically block things in the sandbox. I want to see what they are actually trying to do and then make decisions based upon that. I've had stuff in the past that i wanted to try to run sandboxed that were creating UAC dialog and i was thinking "why does it need admin privileges".

 

[shmu26]

Thanks and that answered one of my questions about HIPS (as in why turn it off). I know hips would confuse a lot of users (i wouldn't turn it on for my wife or my parents) but i think i will keep it on for me. A good example of this is i love the alerts that emsisoft gets but for the lay user this would be to much (at least it doesn't make you make any choices) while bitdefender (especially under autopilot) doesn't give you any. While this is great for my wife & parents im not a big fan of this for me.

I also prefer HIPS to containment.
If you spend time on crafting HIPS rules, it is a good idea to export to a file (from the configuration menu) because Comodo suffers from a "forgetting rules" bug. It might never happen to you, and it might happen to you twice a week. Better safe than sorry.

 

[ncage]

If you all don't mind i would like to keep the questions here because this has worked well. I'll do it question at a time to make it concise. Next question:
I've seen it said somewhere that you don't really need an AV when running CF. I do understand that CF kind of has a virus detection engine with viruscope & whatever rules it uses to detect if an executable should be sandboxed (like for example if the executable has been signed by a trusted entity) but i don't know if i would feel very secure without running a standard av & comodo has been known for lousy definitions. It was some work try to find an AV engine that would be compatible with comodo. I tried emsisoft anti-malware which, although, each program didn't scream at me that there were incompatabilites the interface for comodo would not come up when i had both installed. Uninstalling emsisoft fixed the issue. Tried both kaspersky free & bitdefender free & both told me they weren't compatible. End the end i tried Avast free which has worked well so far.

 

[shmu26]

Thanks and that answered one of my questions about HIPS (as in why turn it off). I know hips would confuse a lot of users (i wouldn't turn it on for my wife or my parents) but i think i will keep it on for me. A good example of this is i love the alerts that emsisoft gets but for the lay user this would be to much (at least it doesn't make you make any choices) while bitdefender (especially under autopilot) doesn't give you any. While this is great for my wife & parents im not a big fan of this for me.

You probably already know this, but HIPS in proactive config does more than HIPS in firewall config.
Another important tweak, which you probably also know about, is Advanced Protection/Miscellaneous/certain applications. You can turn on protection for more vulnerable processes, and add your own to the list, and it supports wildcards.

 

[shmu26]

If you all don't mind i would like to keep the questions here because this has worked well. I'll do it question at a time to make it concise. Next question:
I've seen it said somewhere that you don't really need an AV when running CF. I do understand that CF kind of has a virus detection engine with viruscope & whatever rules it uses to detect if an executable should be sandboxed (like for example if the executable has been signed by a trusted entity) but i don't know if i would feel very secure without running a standard av & comodo has been known for lousy definitions. It was some work try to find an AV engine that would be compatible with comodo. I tried emsisoft anti-malware which, although, each program didn't scream at me that there were incompatabilites the interface for comodo would not come up when i had both installed. Uninstalling emsisoft fixed the issue. Tried both kaspersky free & bitdefender free & both told me they weren't compatible. End the end i tried Avast free which has worked well so far.

Right on all counts.
It is good to have an AV as well. And the Comodo AV is very weak.
Avast free is a good choice, also Windows Defender is a good choice, maybe the best choice, if you are on Windows 10.
WD has been getting very good marks in recent tests, and it has the least conflicts. Even Avast is known to cause conflicts.

By the way, if you ignore the compatibility warnings from Kaspersky free , you might find that it works well. It says that it is incompatible because it doesn't know if you are using Comodo Firewall alone, or the full Comodo Internet Security (which includes an AV component). If you are in fact using CIS, then you should uninstall the AV component, if you want to use a 3rd party AV.

 

[Davidov]

First install the AV and then CF most of the time works well.

 

[codswollip]

comodo has been known for lousy definitions

CF doesn't use AV definitions (CIS yes, CF no). Properly configured, CF affords superior system security. Some say that using the "CS settings" in CF pre-empt any AV program protection, rendering it valueless. OTOH having a basic AV running alongside CF isn't hurtful. Avast Free and 360 Total Security (free) have been suggested in CS threads (although some users are distrustful of the latter).