Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1106828" data-attributes="member: 32260">You probably had in mind disabling LUA by using the reg tweak or GPO. This makes the Comodo sandbox fully functional. But, at the same time, anything running outside the sandbox is more vulnerable. The malware/exploit does not need to use privilege escalation or UAC bypass.It does and disabling LUA can stop that exploit too.By the way, if you disable LUA then UAC is automatically set to &quot;Never notify.&quot;But, when LUA is enabled and you set UAC to &quot;Never notify&quot;, this will not change the LUA.When LUA is disabled, everything executed by the user starts by default as administrator. So, the &quot;Run as administrator&quot; option is not needed anymore.&nbsp;That particular exploit will be blocked on SUA independently of the LUA enabled/disabled.The advantage of using SUA happens when the UAC bypass is not contained by Comodo.</blockquote>

[QUOTE="Andy Ful, post: 1106828, member: 32260"] You probably had in mind disabling LUA by using the reg tweak or GPO. This makes the Comodo sandbox fully functional. But, at the same time, anything running outside the sandbox is more vulnerable. The malware/exploit does not need to use privilege escalation or UAC bypass. It does and disabling LUA can stop that exploit too. By the way, if you disable LUA then UAC is automatically set to "Never notify." But, when LUA is enabled and you set UAC to "Never notify", this will not change the LUA. When LUA is disabled, everything executed by the user starts by default as administrator. So, the "Run as administrator" option is not needed anymore. That particular exploit will be blocked on SUA independently of the LUA enabled/disabled. The advantage of using SUA happens when the UAC bypass is not contained by Comodo. [/QUOTE]

Verification