App Review Comodo Firewall Setup- An Addendum

[cruelsister]

 

[Nightwalker]

Great video with nice background music, as always!

@Chimaira helped me fix the problem that I was facing with the Partial Limited setting instead of the Restrictive one, while using Windows 10 you really need to disable UAC using Local Group Policy.

 

[Chimaira]

Considering your extensive testing with CFW against malware over many years, I trust your decision to not bother with UAC. If having UAC off opened users to attack with CFW running with your settings, I am certain you would be screaming to keep it on!

Thanks for the video, very informative as always!

 

[show-Zi]

Lyrical music and last scene
Thank you very much

 

[Allego]

How to completely turn off UAC in Windows 10 Home edition because it has no Local Group Policy feature?

 

[cruelsister]

As a UAC example, let me expand on the last scene in the video- as you noticed, UAC kept hammering away asking if we wanted to block the Volume Shadow Copy Service (vssadmin). So although UAC would not in any way stop the encryption process, if we did block vssadmin from acting we would have saved our System Restore Point (assuming you have System Restore enabled). I am in no way trying to minimize this! On an otherwise unprotected system we would be able to restore our files.

Now, what about UAC and Comodo (which I didn't touch on for the Tesla)? If we had Containment at Restricted no UAC popups would have occurred, mainly because this malware actually spawns a daughter that does the damage. Restricted mode will prevent this spawning.

For the Partially Limited setting the malware would be allowed to spawn, but the daughter would also be contained. Now this daughter would also try to access vssadmin (but this also would be contained). If you had UAC on also, it would react with a popup, but the reaction would be to stuff happening in the virtual environment, thus clicking either Yes or No would not matter to your actual system [fun fact: consent.exe (aka UAC) is in this case also running in the sandbox. When the popup occurs flushing the sandbox at that point would also get rid of that popup].

I realize I might be going a bit into the weeds with the above, but in short Comodo meets and exceeds protection provided by UAC. If it did not then this would constitute a simplistic breach of Comodo and I would never use it (never ever).

 

[cruelsister]

Allego- You can't turn off UAC totally on Win10 nor should you. Even at the off position UAC in Win10 provides protection of System Files from things like wipers.

 

[ForgottenSeer 69673]

CS in your last video thread in post # 60 a poster shows how to disable UAC through a policy.
Video Review - Comodo Firewall- Cruelsister Variation

 

[Nightwalker]

CS in your last video thread in post # 60 a poster shows how to disable UAC through a policy.
Video Review - Comodo Firewall- Cruelsister Variation

Only after I disable UAC through a policy that Comodo Sandbox worked as it should.

There is a bug between UAC and Comodo in Windows 10, thats for sure.

Before Local Policy:
Cruel Comodo Win


After Local Policy:

 

[codswollip]

Seems better for me to use "Checked but run in Containment" otherwise with "unchecked" I'm apt to mis-click the pop-up and Run Unlimited.

 

[Av Gurus]

My situation is like this (with CS settings):

 

[Nightwalker]

My situation is like this (with CS settings):

View attachment 182105 View attachment 182104

I cant see if it is running as "Partial Limited" or as "Restricted", which one is it?

 

[Av Gurus]

In CF settings are set on "Restricted", but on KillSwitch it show "Unknown".

 

[Nightwalker]

In CF settings are set on "Restricted", but on KillSwitch it show "Unknown".

I am afraid that your Comodo KillSwitch is missing the "Restriction" tab.

Example:

 

[Av Gurus]

This was KS from CCE now I run KS from CF and it's the same as yours:

 

[Nightwalker]

This was KS from CCE now I run KS from CF and it's the same as yours:

View attachment 182108

Thanks for testing, I am almost sure that if you disable UAC from the Local Group Policy and reboot the system, you will get the "correct" setting (Restricted).

 

[AtlBo]

@Nightwalker. Noob question. Why is there no UAC prompt with those settings? Does Comodo containment actually bypass UAC somehow or was it on a low setting? A question I started having a few days ago...

EDIT...I wonder if Comodo did this on purpose knowing that UAC would block everything that isn't Partially Limited...

 

[Av Gurus]

I just try with disabled UAC and it show "Restricted":




What does it mean now?
Can @cruelsister explain this?

 

[Nightwalker]

@Nightwalker. Noob question. Why is there no UAC prompt with those settings? Does Comodo containment actually bypass UAC somehow or was it on a low setting? A question I started having a few days ago...

EDIT...I wonder if Comodo did this on purpose knowing that UAC would block everything that isn't Partially Limited...

There is no UAC prompt because I turned it off in the Control Panel (CS settings) but it isnt enough to make Comodo Sandbox works like it should.

If I disable UAC completely using Local Group Policy, Comodo will use the "Restricted" setting for everything (correct scenario).

Ps: I dont believe it is on purpose, imo it is a bug. @cruelsister is using Windows 7, so maybe thats why she didnt had the same experience I did.
Anyway like she said, it isnt a big deal because Partially Limited setting is very strong now, but because I am a little bit OCD this bug annoys me

Edit: @Av Gurus made the testing scenario that I proposed before and had the same results that I did, so it is a bug for sure.

 

[AtlBo]

Yeah thx. What a strange bug. It's good that you noticed that, and it seems like kind of a serious thing. Maybe Comodo will catch that and fix it at some point. It's hard to get their attemtnion on the forum....