Reply to thread

Message

<blockquote data-quote="ErzCrz" data-source="post: 1114943" data-attributes="member: 81799">I need to re-read through this topic. I&#039;m not using CF/CIS as I have CyberLock installed and running both is overkill. CF does have the option in Device Protection settings to block devices but it&#039;s blacklist. I think unchecking &quot;Trust files installed by trusted installers&quot; would go some way in adding protection but that&#039;s the thing with Comodo.You can tweak it to your hearts content and I used to including the below HIPS tweaks and trimmed vendor listings etc.Protected all drives with HIPS under protected files adding ?:\* will cause HIPS to protect all files on all volumes and drivesProtected registry keys added *\Software\* and *\System\*Under protected COM interfaces, added *\RPC Control\ntsvcs to monitor access to the service control managerLocalSecurityAuthority.* to control process token privilegesAnd added {*} and *.* to cover many COM interfaces by CLSID and ProgID.But there comes a point of balancing security and usability. Comodo is meant to work best in Proactive mode with it&#039;s defaults and CruelSister improved that by setting the restriction level to Restricted or Untrusted but even then these POCs find their way through. Hard_Configurator, WHHL SWH which will block many of these all run with CIS/CF without issue but again, overkill.You have to find a balance and probably the addition tweaks above advised by [USER=32260]@Andy Ful[/USER] will strengthen CIS/CF security but how many of the normal users will go to that extent. I hope for further CIS/CF improvements by Comodo this year but we&#039;ll just have to wait and see <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" /></blockquote>

[QUOTE="ErzCrz, post: 1114943, member: 81799"] I need to re-read through this topic. I'm not using CF/CIS as I have CyberLock installed and running both is overkill. CF does have the option in Device Protection settings to block devices but it's blacklist. I think unchecking "Trust files installed by trusted installers" would go some way in adding protection but that's the thing with Comodo. You can tweak it to your hearts content and I used to including the below HIPS tweaks and trimmed vendor listings etc. Protected all drives with HIPS under protected files adding ?:\* will cause HIPS to protect all files on all volumes and drives Protected registry keys added *\Software\* and *\System\* Under protected COM interfaces, added *\RPC Control\ntsvcs to monitor access to the service control manager LocalSecurityAuthority.* to control process token privileges And added {*} and *.* to cover many COM interfaces by CLSID and ProgID. But there comes a point of balancing security and usability. Comodo is meant to work best in Proactive mode with it's defaults and CruelSister improved that by setting the restriction level to Restricted or Untrusted but even then these POCs find their way through. Hard_Configurator, WHHL SWH which will block many of these all run with CIS/CF without issue but again, overkill. You have to find a balance and probably the addition tweaks above advised by [USER=32260]@Andy Ful[/USER] will strengthen CIS/CF security but how many of the normal users will go to that extent. I hope for further CIS/CF improvements by Comodo this year but we'll just have to wait and see ;) [/QUOTE]

Verification