Comodo Project Experimental Configuration All Welcome

[AtlBo]

Starting a project to refine Comodo, but it will take some time. I first got this thought tonight looking at the Firewall rules, and I was having success finding information on ip ranges and then creating rules for applications. This has long been something I have wanted to do, but I then moved forward a little bit, creating ask rules for all of what Comodo defines Temp files and then also for the File Group Windows Sockets. Just simple ask rules, but I started to get that feeling about the config where I wanted more:emoji_sob:. Only difference this time is I felt for the first time that I can do this, especially starting with the Firewall rules. I think it's going to easily be the best place to start for me.

Hope is to build a default scheme down the road that anyone can use. So to get everyone warmed up, I went looking around and quickly found a list of all executable files. I don't think this is by any means all of them, but I am not 100% satisfied with Comodo's list of executables. That said, I'm not worried, because the strength of Comodo is really in the Container and generally in the default deny concept. However, I do sense that there could be some interesting revelations down the line as the fairies are dancing in my head for creating location rules, such as we see in Easy File Locker for protection of files and backups and then also possibly some new HIPs groups which could be associated with limited HIPs monitoring, meaning only some of the 16 HIPs categories put into action (i.e. interprocess memory access, Write to a Protected Zone, Process Execution, etc.).

OK, for laughs to start here is the list of executables I found:

Spoiler: List of Executable Files

Executable Files
Executable files contain code that is run when the file is opened. Windows programs, Mac OS X applications, scripts, and macros are all considered executable files. Since these file types run code when opened, unknown executable files, such as those received as e-mail attachements, should not be opened.
Common executable file extensions include .EXE, .APP, .VB, and .SCR.

File Extension	File Type	Popularity
.0XE	F-Secure Renamed Virus File	170
.73K	TI-73 Application	171
.89K	TI-89 Application	190
.8CK	TI-84 Plus C Silver Edition Application File	135
.A6P	Authorware 6 Program	162
.A7R	Authorware 7 Runtime File	189
.AC	Autoconf Script	183
.ACC	GEM Accessory File	250
.ACR	ACRobot Script	220
.ACTC	Action(s) Collection File	175
.ACTION	Automator Action	209
.ACTM	AutoCAD Action Macro File	271
.AHK	AutoHotkey Script	191
.AIR	Adobe AIR Installation Package	193
.APK	Android Package File	167
.APP	macOS Application	196
.APP	FoxPro Generated Application	272
.APP	Symbian OS Application	284
.APPLESCRIPT	AppleScript File	223
.ARSCRIPT	ArtRage Script	400
.ASB	Alphacam Stone VB Macro File	350
.AZW2	Kindle Active Content App File	267
.BA_	Renamed BAT File	233
.BAT	DOS Batch File	202
.BEAM	Compiled Erlang File	325
.BIN	Unix Executable File	181
.BIN	Generic Binary Executable File	189
.BTM	4DOS Batch File	400
.CACTION	Automator Converter Action	157
.CEL	Celestia Script File	275
.CELX	Celestia Script	208
.CGI	Common Gateway Interface Script	190
.CMD	Windows Command File	179
.COF	MPLAB COFF File	210
.COFFEE	CoffeeScript JavaScript File	209
.COM	DOS Command File	209
.COMMAND	Terminal Command File	200
.CSH	C Shell Script	275
.CYW	Rbot.CYW Worm File	200
.DEK	Eavesdropper Batch File	233
.DLD	EdLog Compiled Program	229
.DMC	Medical Manager Script	400
.DS	TWAIN Data Source	271
.DXL	Rational DOORS Script	400
.E_E	Renamed EXE File	267
.EAR	Java Enterprise Archive File	219
.EBM	EXTRA! Basic Macro	229
.EBS	E-Run 1.x Script	200
.EBS2	E-Run 2.0 Script File	177
.ECF	SageCRM Component File	223
.EHAM	ExtraHAM Executable File	356
.ELF	Nintendo Wii Game File	188
.EPK	LG Firmware Package	233
.ES	SageCRM Script File	400
.ESH	Extended Shell Batch File	300
.EX4	MetaTrader 4 Program File	222
.EX5	MetaTrader 5 Program File	250
.EX_	Compressed Executable File	221
.EX_	Renamed Windows Executable File	194
.EXE	Windows Executable File	173
.EXE	PortableApps.com Application	223
.EXE1	Renamed EXE File	225
.EXOPC	ExoPC Application	400
.EZS	EZ-R Stats Batch Script	300
.EZT	EZT Malicious Worm File	375
.FAS	Compiled Fast-Load AutoLISP File	227
.FAS	QuickSilver Fast Save Lisp File	267
.FKY	FoxPro Macro	267
.FPI	FPS Creator Intelligence Script	233
.FRS	Flash Renamer Script	200
.FXP	FoxPro Compiled Program	170
.GADGET	Windows Gadget	206
.GPE	GP2X Video Game	217
.GPU	GP2X Utility Program	200
.GS	Geosoft Script	271
.HAM	HAM Executable File	500
.HMS	HostMonitor Script File	200
.HPF	HP9100A Program File	500
.HTA	HTML Application	233
.ICD	SafeDisc Encrypted Program	191
.IIM	iMacro Macro File	237
.IPA	iOS Application	177
.IPF	SMS Installer Script	350
.ISU	InstallShield Uninstaller Script	215
.ITA	VTech InnoTab Application File	400
.JAR	Java Archive File	173
.JS	JScript Executable Script	229
.JSE	JScript Encoded File	350
.JSF	Java Script Command File	226
.JSX	ExtendScript Script File	173
.KIX	KiXtart Script File	283
.KSH	Unix Korn Shell Script	360
.KX	KiXtart Tokenized Script File	325
.LO	Interleaf Compiled Lisp File	300
.LS	LightWave LScript File	300
.M3G	Mobile 3D Graphics Program	169
.MAC	Application Macro File	300
.MAM	Microsoft Access Macro	333
.MCR	3ds Max Macroscript File	193
.MCR	Tecplot Macro	209
.MEL	Maya Embedded Language File	240
.MEM	Macro Editor Macro	333
.MIO	MioEngine Application File	350
.MLX	MATLAB Live Script	233
.MM	NeXtMidas Macro File	242
.MPX	FoxPro Compiled Menu Program	225
.MRC	mIRC Script File	233
.MRP	Mobile Application File	218
.MS	3ds Max Script File	333
.MS	Maxwell Script	217
.MSL	Magick Scripting Language File	200
.MXE	Macro Express Playable Macro	260
.N	Neko Bytecode File	256
.NCL	NirCmd Script File	400
.NEXE	Chrome Native Client Executable	240
.ORE	Ore Executable File	400
.OSX	PowerPC Executable File	267
.OTM	Outlook Macro File	300
.OUT	Compiled Executable File	194
.PAF	Portable Application Installer File	247
.PAF.EXE	PortableApps.com Program File	208
.PEX	ProBoard Executable File	300
.PHAR	PHP Archive	212
.PIF	Program Information File	253
.PLSC	Messenger Plus! Live Script File	194
.PLX	Perl Executable File	267
.PRC	Palm Resource Code File	300
.PRG	Program File	231
.PRG	GEM Application	267
.PS1	Windows PowerShell Cmdlet File	242
.PVD	Instalit Script	500
.PWC	PictureTaker File	200
.PYC	Python Compiled File	226
.PYO	Python Optimized Code	229
.QIT	QIT Trojan Horse File	250
.QPX	FoxPro Compiled Query Program	400
.RBF	LEGO MINDSTORMS EV3 Robot Brick File	267
.RBX	Rembo-C Compiled Script	290
.RFU	Remote Firmware Update	200
.RGS	Registry Script	225
.ROX	Actuate Report Object Executable File	333
.RPJ	Real Pac Batch Job File	233
.RUN	Linux Executable File	167
.RXE	Lego Mindstorms NXT Executable Program	213
.S2A	SEAL2 Application	300
.SBS	SPSS Script	325
.SCA	Scala Script File	300
.SCAR	SCAR Script	175
.SCB	Scala Published Script	214
.SCPT	AppleScript Script File	275
.SCPTD	AppleScript Script Bundle	200
.SCR	Script File	185
.SCRIPT	Generic Script File	233
.SCT	Windows Scriptlet	280
.SEED	Linux Preseed File	200
.SERVER	MySQL Server Script	400
.SHB	Windows Document Shortcut	340
.SMM	Ami Pro Macro	433
.SPR	FoxPro Generated Screen File	260
.TCP	Tally Compiled Program File	211
.THM	Thermwood Macro File	283
.TIAPP	TiTanium App	280
.TMS	Telemate Script	300
.U3P	U3 Smart Application	220
.UDF	Excel User Defined Function	322
.UPX	Ultimate Packer for eXecutables File	333
.VBE	VBScript Encoded Script File	292
.VBS	VBScript File	235
.VBSCRIPT	Visual Basic Script	300
.VDO	Heathen Virus File	300
.VEXE	Virus Executable File	200
.VLX	Compiled AutoLISP File	183
.VPM	Vox Proxy Macro File	233
.VXP	Mobile Application File	202
.WCM	WordPerfect Macro	175
.WIDGET	Microsoft Windows Mobile Widget	209
.WIDGET	Yahoo! Widget	169
.WIZ	Microsoft Wizard File	267
.WORKFLOW	Automator Workflow	167
.WPK	WordPerfect Macro	500
.WPM	WordPerfect Macro File	300
.WS	Windows Script	240
.WSF	Windows Script File	282
.WSH	Windows Script Host Settings	229
.X86	Linux Executable File	267
.XAP	Silverlight Application Package	178
.XBAP	XAML Browser Application File	167
.XLM	Excel Macro	119
.XQT	SuperCalc Macro File	250
.XYS	XYplorer Script File	300
.ZL9	ZoneAlarm Quarantined EXE File	189

A few pop into my mind that I don't see here, and those would be .msi, .mui, and .msc. Not sure about things like .cpl and .mmc.

So that's it. If anyone would like to chime in with anything here anytime, please do. I have started a new config I am calling Experimental Proactive. I saved my current state and then imported it by the name for the new profile. As of now, I am using that profile, but I can go back if necessary. If I can make good enough progress, I will then turn to coming up with some nice default rules. That will be a big challenge, so I'll probably have to go back to a brand new OS image and Comodo firewall installation to do this, so there won't be ANY clutter...just great rules.

Welcome any and all contributors. This may take months, maybe over a year, but I will try to keep good logs in Evernote and then pass them here from time to time...:emoji_v::emoji_fingers_crossed::emoji_fist::emoji_pray:

 

[simmerskool]

can we get cruelsister to confirm and verify the "fairies [that] are dancing in [your] head" -- (meant as a compliment, no offense intended) I'm running cruelcomodo, so count me (unless it complicates my life)

 

[Andy Ful]

You can look at the extensions implemented in Run By SmartScreen:
ACCDA, ACCDE, ACCDR, ACCDT, ACM, AD, ADE, ADN, ADP, AIR, APP, APPLICATION, APPREF-MS, ARC, ASA, ASP, ASPX, ASX, AX, BAS, BAT, BZ, BZ2, CAB, CDB, CER, CFG, CHI, CHM, CLA, CLASS, CLB, CMD, CNT, CNV, COM, COMMAND, CPL, CPX, CRAZY, CRT, CRX, CSH, CSV, DB, DCR, DER, DESKLINK, DESKTOP, DIAGCAB, DIF, DIR, DLL, DMG, DOCB, DOCM, DOT, DOTM, DOTX, DQY, DRV, EXE, FON, FXP, GADGET, GLK, GRP, GZ, HEX, HLP, HPJ, HQX, HTA, HTC, HTM, HTT, IE, IME, INF, INI, INS, IQY, ISP, ITS, JAR, JNLP, JOB, JS, JSE, KSH, LACCDB, LDB, LIBRARY-MS, LOCAL, LZH, MAD, MAF, MAG, MAM, MANIFEST, MAPIMAIL, MAQ, MAR, MAS, MAT, MAU, MAV, MAW, MAY, MCF, MDA, MDB, MDE, MDF, MDN, MDT, MDW, MDZ, MHT, MHTML, MMC, MOF, MSC, MSH, MSH1, MSH1XML, MSH2, MSH2XML, MSHXML, MSI, MSP, MST, MSU, MUI, MYDOCS, NLS, NSH, OCX, ODS, OPS, OQY, OSD, PCD, PERL, PI, PIF, PKG, PL, PLG, POT, POTM, POTX, PPAM, PPS, PPSM, PPSX, PPTM, PRF, PRG, PRINTEREXPORT, PRN, PS1, PS1XML, PS2, PS2XML, PSC1, PSC2, PSD1, PSDM1, PST, PSTREG, PXD, PY, PY3, PYC, PYD, PYDE, PYI, PYO, PYP, PYT, PYW, PYWZ, PYX, PYZ, PYZW, RB, REG, RPY, RQY, RTF, SCT, SEA, SEARCH-MS, SEARCHCONNECTOR-MS, SETTINGCONTENT-MS, SHB, SHS, SIT, SLDM, SLDX, SLK, SPL, STM, SWF, SYS, TAR, TAZ, TERM, TERMINAL, TGZ, THEME, TLB, TMP, TOOL, TSP, URL, VB, VBE, VBP, VBS, VSMACROS, VSS, VST, VSW, VXD, WAS, WBK, WEBLOC, WEBPNP, WEBSITE, WS, WSC, WSF, WSH, XBAP, XLA, XLAM, XLB, XLC, XLD, XLL, XLM, XLSB, XLSM, XLT, XLTM, XLTX, XLW, XML, XNK, XPI, XPS, Z, ZFSENDTOTARGET, ZLO, ZOO

The above list is based on SRP, Outlook Web Access, Gmail, and Adobe Acrobat Reader file extension blacklists.

 

[Decopi]

... interesting project, good job @AtlBo , I will follow your progress in this post...

IMHO, Comodo FF with default settings add almost nothing. But in the other hand, Comodo FF is great and sometimes unbeatable, if default settings are tweaked / not applied.
So, I just wonder why Comodo is not doing something similar to what you are doing in this project, as well as always I wondered why Comodo never used or (at least) promoted CS' settings.

 

[Andy Ful]

...

Spoiler: List of Executable Files

Executable Files
Executable files contain code that is run when the file is opened. Windows programs, Mac OS X applications, scripts, and macros are all considered executable files. Since these file types run code when opened, unknown executable files, such as those received as e-mail attachements, should not be opened.
Common executable file extensions include .EXE, .APP, .VB, and .SCR.

File Extension	File Type	Popularity
.0XE	F-Secure Renamed Virus File	170
.73K	TI-73 Application	171
.89K	TI-89 Application	190
.8CK	TI-84 Plus C Silver Edition Application File	135
.A6P	Authorware 6 Program	162
.A7R	Authorware 7 Runtime File	189
.AC	Autoconf Script	183
.ACC	GEM Accessory File	250
.ACR	ACRobot Script	220
.ACTC	Action(s) Collection File	175
.ACTION	Automator Action	209
.ACTM	AutoCAD Action Macro File	271
.AHK	AutoHotkey Script	191
.AIR	Adobe AIR Installation Package	193
.APK	Android Package File	167
.APP	macOS Application	196
.APP	FoxPro Generated Application	272
.APP	Symbian OS Application	284
.APPLESCRIPT	AppleScript File	223
.ARSCRIPT	ArtRage Script	400
.ASB	Alphacam Stone VB Macro File	350
.AZW2	Kindle Active Content App File	267
.BA_	Renamed BAT File	233
.BAT	DOS Batch File	202
.BEAM	Compiled Erlang File	325
.BIN	Unix Executable File	181
.BIN	Generic Binary Executable File	189
.BTM	4DOS Batch File	400
.CACTION	Automator Converter Action	157
.CEL	Celestia Script File	275
.CELX	Celestia Script	208
.CGI	Common Gateway Interface Script	190
.CMD	Windows Command File	179
.COF	MPLAB COFF File	210
.COFFEE	CoffeeScript JavaScript File	209
.COM	DOS Command File	209
.COMMAND	Terminal Command File	200
.CSH	C Shell Script	275
.CYW	Rbot.CYW Worm File	200
.DEK	Eavesdropper Batch File	233
.DLD	EdLog Compiled Program	229
.DMC	Medical Manager Script	400
.DS	TWAIN Data Source	271
.DXL	Rational DOORS Script	400
.E_E	Renamed EXE File	267
.EAR	Java Enterprise Archive File	219
.EBM	EXTRA! Basic Macro	229
.EBS	E-Run 1.x Script	200
.EBS2	E-Run 2.0 Script File	177
.ECF	SageCRM Component File	223
.EHAM	ExtraHAM Executable File	356
.ELF	Nintendo Wii Game File	188
.EPK	LG Firmware Package	233
.ES	SageCRM Script File	400
.ESH	Extended Shell Batch File	300
.EX4	MetaTrader 4 Program File	222
.EX5	MetaTrader 5 Program File	250
.EX_	Compressed Executable File	221
.EX_	Renamed Windows Executable File	194
.EXE	Windows Executable File	173
.EXE	PortableApps.com Application	223
.EXE1	Renamed EXE File	225
.EXOPC	ExoPC Application	400
.EZS	EZ-R Stats Batch Script	300
.EZT	EZT Malicious Worm File	375
.FAS	Compiled Fast-Load AutoLISP File	227
.FAS	QuickSilver Fast Save Lisp File	267
.FKY	FoxPro Macro	267
.FPI	FPS Creator Intelligence Script	233
.FRS	Flash Renamer Script	200
.FXP	FoxPro Compiled Program	170
.GADGET	Windows Gadget	206
.GPE	GP2X Video Game	217
.GPU	GP2X Utility Program	200
.GS	Geosoft Script	271
.HAM	HAM Executable File	500
.HMS	HostMonitor Script File	200
.HPF	HP9100A Program File	500
.HTA	HTML Application	233
.ICD	SafeDisc Encrypted Program	191
.IIM	iMacro Macro File	237
.IPA	iOS Application	177
.IPF	SMS Installer Script	350
.ISU	InstallShield Uninstaller Script	215
.ITA	VTech InnoTab Application File	400
.JAR	Java Archive File	173
.JS	JScript Executable Script	229
.JSE	JScript Encoded File	350
.JSF	Java Script Command File	226
.JSX	ExtendScript Script File	173
.KIX	KiXtart Script File	283
.KSH	Unix Korn Shell Script	360
.KX	KiXtart Tokenized Script File	325
.LO	Interleaf Compiled Lisp File	300
.LS	LightWave LScript File	300
.M3G	Mobile 3D Graphics Program	169
.MAC	Application Macro File	300
.MAM	Microsoft Access Macro	333
.MCR	3ds Max Macroscript File	193
.MCR	Tecplot Macro	209
.MEL	Maya Embedded Language File	240
.MEM	Macro Editor Macro	333
.MIO	MioEngine Application File	350
.MLX	MATLAB Live Script	233
.MM	NeXtMidas Macro File	242
.MPX	FoxPro Compiled Menu Program	225
.MRC	mIRC Script File	233
.MRP	Mobile Application File	218
.MS	3ds Max Script File	333
.MS	Maxwell Script	217
.MSL	Magick Scripting Language File	200
.MXE	Macro Express Playable Macro	260
.N	Neko Bytecode File	256
.NCL	NirCmd Script File	400
.NEXE	Chrome Native Client Executable	240
.ORE	Ore Executable File	400
.OSX	PowerPC Executable File	267
.OTM	Outlook Macro File	300
.OUT	Compiled Executable File	194
.PAF	Portable Application Installer File	247
.PAF.EXE	PortableApps.com Program File	208
.PEX	ProBoard Executable File	300
.PHAR	PHP Archive	212
.PIF	Program Information File	253
.PLSC	Messenger Plus! Live Script File	194
.PLX	Perl Executable File	267
.PRC	Palm Resource Code File	300
.PRG	Program File	231
.PRG	GEM Application	267
.PS1	Windows PowerShell Cmdlet File	242
.PVD	Instalit Script	500
.PWC	PictureTaker File	200
.PYC	Python Compiled File	226
.PYO	Python Optimized Code	229
.QIT	QIT Trojan Horse File	250
.QPX	FoxPro Compiled Query Program	400
.RBF	LEGO MINDSTORMS EV3 Robot Brick File	267
.RBX	Rembo-C Compiled Script	290
.RFU	Remote Firmware Update	200
.RGS	Registry Script	225
.ROX	Actuate Report Object Executable File	333
.RPJ	Real Pac Batch Job File	233
.RUN	Linux Executable File	167
.RXE	Lego Mindstorms NXT Executable Program	213
.S2A	SEAL2 Application	300
.SBS	SPSS Script	325
.SCA	Scala Script File	300
.SCAR	SCAR Script	175
.SCB	Scala Published Script	214
.SCPT	AppleScript Script File	275
.SCPTD	AppleScript Script Bundle	200
.SCR	Script File	185
.SCRIPT	Generic Script File	233
.SCT	Windows Scriptlet	280
.SEED	Linux Preseed File	200
.SERVER	MySQL Server Script	400
.SHB	Windows Document Shortcut	340
.SMM	Ami Pro Macro	433
.SPR	FoxPro Generated Screen File	260
.TCP	Tally Compiled Program File	211
.THM	Thermwood Macro File	283
.TIAPP	TiTanium App	280
.TMS	Telemate Script	300
.U3P	U3 Smart Application	220
.UDF	Excel User Defined Function	322
.UPX	Ultimate Packer for eXecutables File	333
.VBE	VBScript Encoded Script File	292
.VBS	VBScript File	235
.VBSCRIPT	Visual Basic Script	300
.VDO	Heathen Virus File	300
.VEXE	Virus Executable File	200
.VLX	Compiled AutoLISP File	183
.VPM	Vox Proxy Macro File	233
.VXP	Mobile Application File	202
.WCM	WordPerfect Macro	175
.WIDGET	Microsoft Windows Mobile Widget	209
.WIDGET	Yahoo! Widget	169
.WIZ	Microsoft Wizard File	267
.WORKFLOW	Automator Workflow	167
.WPK	WordPerfect Macro	500
.WPM	WordPerfect Macro File	300
.WS	Windows Script	240
.WSF	Windows Script File	282
.WSH	Windows Script Host Settings	229
.X86	Linux Executable File	267
.XAP	Silverlight Application Package	178
.XBAP	XAML Browser Application File	167
.XLM	Excel Macro	119
.XQT	SuperCalc Macro File	250
.XYS	XYplorer Script File	300
.ZL9	ZoneAlarm Quarantined EXE File	189

...

Such big file extension blacklists are useful when files are not blocked via command line with extension sponsor. Please check if the below two command lines are blocked in command prompt (hello.vbs present on the Desktop):
wscript
wscript %userprofile%\desktop\hello.vbs

If you blocked in Comodo the .vbs extension and the first command line can be executed but not the second one, then such a big extension black list can be useful.
If so, then in the home environment it is safer to block also some extension sponsors like wscript.exe, cscript.exe, mshta.exe, etc.
The most useful for blocking via extension blacklist is SRP, because only Windows scripts (except PowerShell) and MSI files are blocked when using command lines with sponsors.

 

[AtlBo]

So, I just wonder why Comodo is not doing something similar to what you are doing in this project, as well as always I wondered why Comodo never used or (at least) promoted CS' settings.

You and me too Decopi lol...

The most useful for blocking via extension blacklist is SRP, because only Windows scripts (except PowerShell) and MSI files are blocked when using command lines with sponsors.

Thanks for the list @Andy Ful. I am thinking of possibly some special HIPs rules that will allow all but some of the monitored behaviors for say certain types of executables and location based.

Getting started last night I ran into trouble almost right away. I decided to take a look at the HIPs "Protected Objects" dialog, hoping to establish a firm link between that dialog and the HIPs monitored behavior protection for "Protected Files/Folders" (HIPs Settings->monitoring settings). I dropped a folder of files on a flash drive. Then I added a rule to Protected Objects->Protected Files to protect the contents of the folder (E:\Test Folder\*) and ran a cmd script to delete the contents. I had turned off the container, but the HIPs did not alert. I tried it a dozen times and then added the location to "Protected Data". So then I just ran the test again today, and it worked Hallelluya. I don't know, maybe it was settings lag or a need for a reboot for the setting to work? At any rate, I still don't know what Protected Objects->Protected Data is for. The good news is that deleting files is blocked with the HIPs "Protected Files/Folders" monitoring based rule activated (HIPs settings->monitoring settings (next to mode selection at top of settings)). What I read from Comodo help stated that the files become read only, but as per usual with Comodo help, there is no comprehensive list of what the protection does, so I wasn't sure it would block file deletes. Easy File Locker handles read only and delete separately, giving the user the choice to block deletes. It would have been a deal breaker for protecting files/locations with Comodo if the program did not block deletes with this HIPs setting. At any rate, I feel safer having the files protected this way, even remembering that I have played unsuccessfully with this before. Wonder if settings lag or need for a reboot got me then too...

Now I am considering setting up a HIPs rule for all executables or all applications to protect just with this one HIPs rule. Maybe I will need two or three rules for this, idk, because I have to think of the affects of global type rules such as "all executables" on the other protected areas, not just ones that I add. Could be I end up going through alert by alert to set up exceptions for a ton of actions of executable, not sure. That could be alot of work, but I think many aren't aware that Comodo HIPs helps users set up exceptions from alerts.

Here at first with HIPs, the idea is to create an Easy File Locker type of protection for backup drives and then decide from alerts which applications can have access to these "Protected Files". Again, there is the potential problem that the entire HIPs monitoring of "Protected Files/Folders" must be considered. It is defined in the Protected Objects area, but there is only the one way to protect a location from unwanted writes, meaning that any HIPs rule based on "Protected Files/Folders" monitoring that is then universal in scope will affect all the areas in the "Protected Objects" area, including the Comodo default areas. Can't just think of designing a rule for use with the one area I have added. Do I want to have every single executable alerting me for every one of the locations listed by Comodo (not just "Unrecognized")? I might try it and see how it works a little later today.

Maybe this can be rethought some, but I am not sure until I look over everything in "Protected Objects". Seems to me Comodo could make this simpler by making it possible to choose for, for example, "All executables" an option from within the new rule dialog for, say, "located in program folders" or "located in user areas". I have noticed this about Comodo HIPs rules. The containment rules have options but not so much so the HIPs ones.

I appreciate the responses and support. It might be a while before I get to setting up nice rules packages, but I am hoping I can really get somewhere this time. I'll definitely be looking for some ideas, but folder/drive protection is a great start for me at this point. Simple as adding the location/drive to the HIPs->Protected Objects->Protected Files area...

 

[AtlBo]

Steps forward and steps backward. First, a serious success. I read that log spam was a cause of high processor usage from cmdagent.exe. This is something that has caused me to have to reinstall Comodo several times, so I have always been interested in a solution. Not sure this will solve cmdagent.exe, but I have finally solved the riddle of log spam. It can be one of two things by a standard. They are:

1. Log spam from HIPs memory access blocks-Programs like Process Lasso and Cleanmem access memory of Comodo processes. Comodo blocks and logs every attempt. To see if you have this problem, look in the HIPs log. If you see in the logs a program that is attempting to access the memory of a Comodo process, here is the way to fix the problem:

Once you have located the name of the file that is spamming the HIPs log, write it down and also see what file it is accessing. There is actually more than one way to handle this, but, so far, the most common trigger for this is a process attempting to access memory of Comodo processes. All processes get flagged for this, not just "Unrecognized". For this example, there are 4 processes attempting to access cis.exe in short increments of time. This method would stop the log spam of the 4 processes for any of the processes listed in the second picture below contained under the header (File Group) Comodo Internet Security. So here are the pictures:

1. The group containing the file(s) being compromised by the 4 processes. In this case, the file(s) is/are found in the Comdo Internet Security HIPs rule:

2. Clicking once on the entry "Comodo Internet Security", now we can click to edit the rule for this group:

3. The Edit dialog pops up, and we navigate to "Protection Settings" to find the rule we must edit:

4. In "Protection Settings" we locate the rule "Interprocess memory access"->Exclusions->Modify:

5. Next choose Edit and the option for "File". Now navigate to the process that is attempting to access the memory of a Comodo process. Add this process to the list here:

This should resolve HIPs spam. It can be any process on any other. You may even have to make a separate rule for both the file attempting to access and for the vulnerable application. More than likely, just for the file being accessed in its HIPs protection settings Exclusions for "Interprocess memory access". You will also need to make sure that the rule is set to Active from Inactive.

After locating which application is being accessed from the log, go to Settings->HIPs->HIPs Rules. Click on "Add" on the menu. Using the file option search for the executable for which the block is occurring. Make sure to activate "Interprocess memory access". Then add the name(s) of any and all processeds that are trying to access its memory. This will stop HIPs memory access rule log spam.

2. Firewall log spam-The key here is to look for "Windows Operating System" and/or svchost.exe in the log being the responsible application for the connection log spam. These are mostly blocks and many of them are on local or semi-local traffic (someone else's local). So the goal is to unblock all of the local ones. Once you know which IP ranges on the local network that each of your devices are registered to use, you can see which domain your devices occupy. Usually, it will be the range 192.168.1.1-192.168.1.255. However, if you are accessing a publc wi-fi in your place of residence, you many notice something along the lines of 192.168.***.***, where the star represents any number up to 255. All the third numbers should be the same.

As an example, if your computers are connecting using something like 192.168.148.*, then you will be using this IP range element in the firewall rules to get rid of the spam. In the above case, the range would be 192.168.148.1-192.168.148.255. Again, the range is usually going to be the standard 192.168.1.1-192.168.1.255 local range. At any rate, you will be looking to set a NEW allow rule for the application shown in the log to be causing the firewall log spam (responsible for the blocks usually). If the application is what Comodo calls "Windows operating system", looking at its log entries, we will be looking at the remote IPs to see if they are on the same local domain as your PC. These are the ones we want unblocked, not access from devices on other networks. So we can create an allow rule in this example for "Windows operating system" for the range containing our local domain to allow this traffic and end its block spams in the log. One more time, almost every time the range to use is 192.168.1.1-192.168.1.225. This will stop most log spam from "Windows operating system" or svchost.exe.

It's important that we, unfortunately, cannot find a way to create a rule for "Windows operating system". For svchost.exe, we can simply create a rule at the top of the firewall list, but "Windows operating system" does not exist anywhere in Comodo by those exact words, "Windows operating system". When creating a rule there is no option to select it as the subject of the rule. This has caused me untold grief over that last 5 years, along with how to deal with svchost.exe. Well, the good news is, that "Windows operating system" is not important, unless it is causing log spam. Also, although it is not available by name to choose as a process/file group for rule creation, we CAN get Comodo to create a firewall rule for us in every situation where we would care to do so. This is because the only time we will care to create a rule for "Windows operating system" is when it is spamming the firewall log. So, if it is doing so, what do we do?

OK, this is really not so bad and really quite simple. If I notice that the log events bar for the firewall is dominating the others, and I discover firewall log spamming from "Windows operating system", I would obviously like to resolve the dilemma with the spam. OK, so there is one important thing to note here. In the case of "Windows operating system", the entries are always going to be in the form of blocks. This is by design from Comodo. The only question then is whether there are too many. If so, because these are block events, we can look to "Unblock applications" on the widget to see if "Windows operating system" is there. Indeed, in every instance where a block appears in the firewall log for "Windows operating system", it will also appear in "Unblock applications". So, to create a rule that we can work with in the firewall area, all we have to do is find "Windows operating system" in "Unblock applications" and right click its entry to unblock its firewall block. Comodo does the rest, auto-creating an allow rule, even though there is no way to choose to create a rule for "Windows operating system" in Comodo (or at least that I have seen). This is great!

However, it's important to note and consider here that the unblock we issued when we unblocked "Windows operating system" or svchost.exe from "Unblock applications" means that we just allowed ALL inbound traffic for this process (not for the entire system) with a new Comodo created "unblock" rule. So, in above examples, what do we do to set up rules nicely to get all blocks but only allows for safe local?

OK, so here is how it's done. With the Comodo allow rule in place, create a new rule and make sure it is ABOVE the Comodo generate "unblock" rule for the application. Having found the range that you would like to allow, we set this new allow rule to allow for TCP and UDP and in. Then we set our IPv4 range below the rule title in the dialog. This is the range of safe IPs we determined to be our local network. OK the rule. Now, with your ranged allow rule in place above the "Unblock applications" rule for the application, we want to make sure now to go back and set the original rule to block. So, click on the original rule and open its Edit dialog. Set the rule to block TCP and UDP in and set it to log. Retitle the rule to match your choices for the rule, i.e. "svchost.exe (or "Windows operating system) Block and Log TCP/UDP In". OK the rule, and you should have the safest possible scenario. This is because you have the block rule in place as clearly Comodo felt was best. Obviously, it was Comodo's choice to firewall block the app in the first place via a firewall block. At any rate, you now have a simple way of allowing local or otherwise safe traffic into the system. You just create a single allow rule above the others any time for whatever IP needs access via the process, but the Comodo generated rule you turned into a block blocks all others. Here is how it will look after you are finished:

Note in the picture above that I have set one of the rules to log activity. This is not necessary and I wouldn't if it were leading to spam, of course. The important thing is that you are in control of the logging now. Also, you now have the added flexibility of being able to refine Comodo's choice to block "Windows operating system" or "svchost.exe". Don't know if "Windows operating system" affects Remote Desktop, but, if so, I could easily create a single allow rule for the single IP of each of the PCs I would like to use to connect via RDP.

One other not about the above. There are two ranges that I have allowed, because I park two machines next to each other that use connection sharing for one of them to connect to the internet. The PC using connection sharing uses a different local range to make its connections. It considers the server the machine from which it gets its connection...see here:

Again, recall this same thing can happen with svchost.exe or "Windows operating system". And just to reiterate, if you notice a firewall block in the "Unblock Applications" area (lock icon on the widget) for either of these two processes, go to the firewall log to see if the process (svchost.exe or Windows operating system) is creating spam there. If so, go back to "Unblock Applications" and unblock the application for the protections shown that are blocking this application. This will auto-create an allow rule for the application for all IPs. So our job is to refine this situation so that only safe IP ranges are allowed. Back to the firewall area, we must set the allow rule created by unblocking in "Unblock Applications" back to "block", because we don't want to allow all traffic in via "Windows operating system" or "svchost.exe, either one. Find the "Windows operating system" or svchost.exe rule (should be the newest rule at the top). Now click on the "+" left of the entry to expand its rule(s). Change the rule and its title to "block" and OK the rule. Now, still in the firewall rules area, create a new allow rule under the process. Add this rule just above this process' existing rule which you just edited to re-create the block Comodo had originally been making. Make this rule an allow rule for TCP and UDP and in and then set the range of safe IPs (v4) to be allowed. Usually, the spam are in blocks, so you may find that you can get what you want (eliminate log spam) by just allowing the safe ones of these. Now set the range of the rule to your local network. The bulk of the traffic will now be allowed safely, since it is your local traffic. All other traffic will remain blocked. For this to stop the spam, make sure this allow rule is the top rule under the process' rules.

Cure the log spam and you will be laughing with the angels about Comodo. Much if not most of the bugginess and clunkiness will disappear. Here is how a clean log without spam should appear:

No one or two categories overwhelm the statistics in the lab. If we see one bar very high and the others very low, this can be a tell tale sign of log spam.

ONE NOTE: When leaving a menu in Comodo settings, make sure to use the button at the bottom of the form to exit the menu. Never use the x's. Rules will not be remembered if the x's are used to leave a menu. Think of a trip into the settings area as a session. During this session, we must use the "OK" button to leave a dialog in order for Comodo to remember the change being made. This means for all dialogs. So, we must back out of the settings area using the OK button. Even one use of an x on the way out will void all changes made. This is obviously important to learn with Comodo. Use an x to escape a settings menu after making a change->expect the change won't be made.

Hope this helps some. Still in the formulative stages of setting some things up.

 

[mellowtones242]

Steps forward and steps backward. First, a serious success. I read that log spam was a cause of high processor usage from cmdagent.exe. This is something that has caused me to have to reinstall Comodo several times, so I have always been interested in a solution. Not sure this will solve cmdagent.exe, but I have finally solved the riddle of log spam. It can be one of two things by a standard. They are:

1. Log spam from HIPs memory access blocks-Programs like Process Lasso and Cleanmem access memory of Comodo processes. Comodo blocks and logs every attempt. To see if you have this problem, look in the HIPs log. If you see in the logs a program that is attempting to access the memory of a Comodo process, here is the way to fix the problem:

Once you have located the name of the file that is spamming the HIPs log, write it down and also see what file it is accessing. There is actually more than one way to handle this, but, so far, the most common trigger for this is a process attempting to access memory of Comodo processes. All processes get flagged for this, not just "Unrecognized". For this example, there are 4 processes attempting to access cis.exe in short increments of time. This method would stop the log spam of the 4 processes for any of the processes listed in the second picture below contained under the header (File Group) Comodo Internet Security. So here are the pictures:

1. The group containing the file(s) being compromised by the 4 processes. In this case, the file(s) is/are found in the Comdo Internet Security HIPs rule:

View attachment 224287

2. Clicking once on the entry "Comodo Internet Security", now we can click to edit the rule for this group:

View attachment 224283

3. The Edit dialog pops up, and we navigate to "Protection Settings" to find the rule we must edit:

View attachment 224288

4. In "Protection Settings" we locate the rule "Interprocess memory access"->Exclusions->Modify:

View attachment 224289

5. Next choose Edit and the option for "File". Now navigate to the process that is attempting to access the memory of a Comodo process. Add this process to the list here:

View attachment 224291

This should resolve HIPs spam. It can be any process on any other. You may even have to make a separate rule for both the file attempting to access and for the vulnerable application. More than likely, just for the file being accessed in its HIPs protection settings Exclusions for "Interprocess memory access". You will also need to make sure that the rule is set to Active from Inactive.

After locating which application is being accessed from the log, go to Settings->HIPs->HIPs Rules. Click on "Add" on the menu. Using the file option search for the executable for which the block is occurring. Make sure to activate "Interprocess memory access". Then add the name(s) of any and all processeds that are trying to access its memory. This will stop HIPs memory access rule log spam.

2. Firewall log spam-The key here is to look for "Windows Operating System" and/or svchost.exe in the log being the responsible application for the connection log spam. These are mostly blocks and many of them are on local or semi-local traffic (someone else's local). So the goal is to unblock all of the local ones. Once you know which IP ranges on the local network that each of your devices are registered to use, you can see which domain your devices occupy. Usually, it will be the range 192.168.1.1-192.168.1.255. However, if you are accessing a publc wi-fi in your place of residence, you many notice something along the lines of 192.168.***.***, where the star represents any number up to 255. All the third numbers should be the same.

As an example, if your computers are connecting using something like 192.168.148.*. You will be using the IP range element in the firewall rules to get rid of the spam. In the above case, the range would be 192.168.148.1-192.168.148.255. Again, the range is usually going to be the standard 192.168.1.1-192.168.1.255 range. At any rate, you will be looking to set an allow rule for the application shown in the log to be causing the firewall log spam (responsible for the blocks usually). If the application is what Comodo calls "Windows Operating System", you will be looking at the remote IPs to see if they are on the same domain as you. These are the ones we want unblocked, not access from devices on other networks. So we can enter an allow rule in this example for Windows Operating System for the range containing our local domain. One more time, almost every time the range to use is 192.168.1.1-192.168.1.225. This will stop most log spam from "Windows Operating System".

Again, this same thing can happen with svchost.exe. If you notice a firewall block in the "Unblock Applications" area (lock icon on the widget), go to the firewall log to see if svchost.exe (or Windows operating system) is creating spam there. If so, go back to "Unblock Applications" and unblock the application for the protections that are blocking the application. Now go into the firewall area and create an allow rule under this process' existing rule(s) for TCP and UDP. Usually, the spam are in blocks, so you may find that you can get what you want (eliminate log spam) by just allowing the safe ones of these. Now set the range of the rule to your local network. The bulk of the traffic will now be allowed safely, since it is your local traffic. All other traffic will remain blocked. For this to stop the spam, make sure this allow rule is the top rule under the process' rules.

Cure the log spam and you will be laughing with the angels about Comodo. Much if not most of the bugginess and clunkiness will disappear.

ONE NOTE: When leaving a menu in Comodo settings, make sure to use the button at the bottom of the form to exit the menu. Never use the x's. Rules will not be remembered if the x's are used to leave a menu. Think of a trip into the settings area as a session. During this session, we must use the "OK" button to leave a dialog in order for Comodo to remember the change being made. This means for all dialogs. So, we must back out of the settings area using the OK button. Even one use of an x on the way out will void all changes made. This is obviously important to learn with Comodo. Use an x to escape a settings menu after making a change->expect the change won't be made.

Hope this helps some. Still in the formulative stages of setting some things up.

Nice work!

 

[AtlBo]

Curious to know what kind of firewall rules I would need to allow only certain IPs access to a PC via Remote Desktop. I assume something like the rule ladder being used for "Windows operating system" in my previous post would be the answer. However, I don't know which process(es) I would need to block in order to then allow the IP of certain specific ones.

I would love to be able to do this. It will be on my mind until I come up with something, because this is another thing I have been hoping to achieve with some program someplace. Maybe it can be done with Comodo.

I am having a great deal of fun with the firewall element for now.

 

[koloveli]

Not unprotected files antivirus or suite, is an error!
Setting AtlBo not safe, can in risk
sorry my english