Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1114716" data-attributes="member: 32260">It is possible to use the below setup:<ol>
<li data-xf-list-type="ol">Apply Proactive Configuration.</li>
<li data-xf-list-type="ol">Add the rule: Action - Run Virtually, File Group - All Applications, File Origin - Removable Media&nbsp;&nbsp; &lt;------&nbsp; this protects flash drives</li>
<li data-xf-list-type="ol">Modify default rule:&nbsp; Action - Run Virtually, File Group - All Applications, File Rating - Unrecognized, File age: 1 day (or 1 hour)</li>
<li data-xf-list-type="ol">Add the rule to contain 7-Zip application&nbsp; (c:\Program Files\7-Zip\7zFM.exe). Set 7-Zip as the default application to open archives and disk images (ISO, IMG, etc.). 
With this rule, the 7-Zip GUI works similarly to Comodo&#039;s Virtual Desktop. Anything opened from the 7-Zip application (even text documents) is contained.</li>
<li data-xf-list-type="ol">In Script Analysis, enable Embedded Code Detection for cmd[.]exe.</li>
<li data-xf-list-type="ol">In the office applications, block macros.</li>
</ol>The below will be restricted by the File age: 1 day (or 1 hour):<ul>
<li data-xf-list-type="ul">When downloading applications from the Internet, they have a fresh &quot;creation time&quot;.</li>
<li data-xf-list-type="ul">Files copied from the flash drives to the hard disk have a fresh &quot;creation time&quot;.</li>
</ul>When using Comodo Internet Security (instead of Comodo Firewall + Microsoft Defender), I would propose the file age recommended by Comodo: File age: 3 days. Comodo&#039;s signatures for new malware are rather poor.WARNINGTo open files from disk images and archives with no containment, one must use another archiver application or Windows built-in features:Right click &gt;&gt; Open with &gt;&gt; Windows ExplorerPost edited and updated.</blockquote>

[QUOTE="Andy Ful, post: 1114716, member: 32260"] It is possible to use the below setup: [LIST=1] [*]Apply Proactive Configuration. [*][COLOR=rgb(0, 168, 133)][B]Add the rule[/B][/COLOR]: Action - Run Virtually, File Group - All Applications, File Origin - Removable Media <------ this protects flash drives [*][COLOR=rgb(0, 168, 133)][B]Modify default rule[/B][/COLOR]: Action - Run Virtually, File Group - All Applications, File Rating - Unrecognized, [COLOR=rgb(0, 168, 133)]File age: 1 day (or 1 hour)[/COLOR] [*][B][COLOR=rgb(0, 168, 133)]Add the rule to contain 7-Zip application[/COLOR][/B] (c:\Program Files\7-Zip\7zFM.exe). Set 7-Zip as the default application to open archives and disk images (ISO, IMG, etc.). With this rule, the 7-Zip GUI works similarly to Comodo's Virtual Desktop. Anything opened from the 7-Zip application (even text documents) is contained. [*]In Script Analysis, enable Embedded Code Detection for cmd[.]exe. [*]In the office applications, block macros. [/LIST] The below will be restricted by the [COLOR=rgb(0, 168, 133)]File age: 1 day (or 1 hour):[/COLOR] [LIST] [*]When downloading applications from the Internet, they have a fresh "creation time". [*]Files copied from the flash drives to the hard disk have a fresh "creation time". [/LIST] When using Comodo Internet Security (instead of Comodo Firewall + Microsoft Defender), I would propose the file age recommended by Comodo: [COLOR=rgb(0, 168, 133)]File age: 3 days. [/COLOR] Comodo's signatures for new malware are rather poor. WARNING To open files from disk images and archives with no containment, one must use another archiver application or Windows built-in features: Right click >> Open with >> Windows Explorer [B][COLOR=rgb(184, 49, 47)]Post edited and updated.[/COLOR][/B] [/QUOTE]

Verification