Advice Request Comodo Internet Security Setup/configuration thread

[Deleted member 178]

Comodo Internet Security's auto-Sandbox (BB) & HIPS interaction explanation

 

[Sunshine-boy]

@shmu26
@Umbra
Thank you for providing us valuable information about this ugly comodo

 

[Sunshine-boy]

I think everyone needs to read comodo help and understand how this ugly product work
Comodo Internet Security, Antivirus protection, Firewall Software | Security Help

 

[shmu26]

Comodo Internet Security's auto-Sandbox (BB) & HIPS interaction explanation

Right.
I attempted to bring the info up to date, because with Comodo 10, there are some major changes in categories and terminology, and even some added features.
Please comment, and offer corrections/improvements.

 

[Deleted member 178]

Not used it since so no idea how they call the BB now, it was autosandbox then BB then autosandbox again...

 

[shmu26]

Not used it since so no idea how they call the BB now, it was autosandbox then BB then autosandbox again...

Autosandbox is now officially called "containment", but most users still refer to it as autosandbox.

Should we tell people about the @Lockdown approach to Comodo, which is to add the entire Windows folder to trusted files, and then get rid of the trusted vendors list? Of course, this approach can only be used on a clean system.

I have a suspicion that the super-long file list thus created is responsible for the disappearing rules bug. Same goes for your super-long HIPS rules list. When lists get too long, they can become unstable.

 

[Rengar]

@shmu26
@Umbra
Thank you for providing us valuable information about this ugly comodo

The guy that loves Sophos spoke.....feelsbadman...

 

[shmu26]

This is my remaining question: If you use HIPS, should you also enable autosandbox?
It used to be that HIPS alone would miss certain things, so autosandbox gave added protection.
But HIPS has improved. Does it make autosandbox unecessary?

Actually, I have another question, too: how good is the shellcode protection, i.e., the protection against memory exploits? What does it do, and what doesn't it do?

 

[Sunshine-boy]

I think hips is needdy to watch sandbox activity! but only in paranoid mode can do it

 

[shmu26]

still useful to me.

Why is autosandbox still useful to you? As an opinion about the safeness of the file?

 

[Av Gurus]

Autosandbox is now officially called "containment", but most users still refer to it as autosandbox.

Should we tell people about the @Lockdown approach to Comodo, which is to add the entire Windows folder to trusted files, and then get rid of the trusted vendors list? Of course, this approach can only be used on a clean system.

I have a suspicion that the super-long file list thus created is responsible for the disappearing rules bug. Same goes for your super-long HIPS rules list. When lists get too long, they can become unstable.

I don't know if you watch my video (where Comodo Firewall missed malware) but in that video a delete all trusted vendors list and then run a Scan with Comodo so can check only Vendors that are on my machine at that time and add them to Trusted list.

To me is the simple and effective way.

 

[shmu26]

I don't know if you watch my video (where Comodo Firewall missed malware) but in that video a delete all trusted vendors list and then run a Scan with Comodo so can check only Vendors that are on my machine at that time and add them to Trusted list.

To me is the simple and effective way.

I watched, but I forgot that part.
So you also use the method of adding lots and lots of files to trusted list?
Right now, I am doing an experiment, I am adding my entire C drive to trusted files, to see what happens............

 

[Av Gurus]

Comodo add it automatically, no need to do it manually.
When you run some files that is not on Trusted Vendors Comodo will check in the cloud and if it is safe will put on the list.
Try it.

 

[shmu26]

Comodo add it automatically, no need to do it manually.
When you run some files that is not on Trusted Vendors Comodo will check in the cloud and if it is safe will put on the list.
Try it.

Thanks.
I want to take a different approach: no cloud lookup, no trusted vendors, only manually trusted files.

 

[Av Gurus]

This is probably a safer way (if we exclude a human error) but it lasts for a long time and requires some knowledge.

 

[Ink]

Comodo HIPS is disabled by default?

 

[shmu26]

Comodo HIPS is disabled by default?

If you install Comodo Firewall, by default you are put on the firewall config, it has HIPS enabled, and autosandbox disabled.
If you switch to proactive mode, which is a popular thing to do, both are enabled by default.

 

[Daniel Keller]

Thank you for this useful information.

 

[Deleted member 178]

Why is autosandbox still useful to you? As an opinion about the safeness of the file?

Because if the user mistakenly click allow on the HIPS for a malicious file , the Autosandbox will block/isolate it (depending its settings)

I want to take a different approach: no cloud lookup, no trusted vendors, only manually trusted files.

This is probably a safer way (if we exclude a human error) but it lasts for a long time and requires some knowledge.

Q&A - Comodo Internet Security v8 Setup/configuration thread
My simple and effective method to do it, works best on a clean installed system for obvious reasons.

 

[509322]

I have a suspicion that the super-long file list thus created is responsible for the disappearing rules bug. Same goes for your super-long HIPS rules list. When lists get too long, they can become unstable.

I have seen rules disappear with only a few rules in each of the modules, but yes... I think that the more rules there are, the more unstable the GUI in general becomes. It is something that has been reported for a very, very long time.

I haven't touched COMODO products in a long time at this point.