I disabled HIPS on my CF setup. My only real-time protection is CFs file lookup server and VirusScope. What would happen if a legit program tries to load infected DLL? Does CF protect against it?
Does Comodo FLS protect from DLL hijacking or process injection?
- Thread starter Nagisa
- Start date
Please provide comments and solutions that are helpful to the author of this topic.
- Apr 13, 2013
- 3,224
Hi Nagisa! Actually the better question is how to PREVENT a dll from getting infected, and this is where the strength of CF comes into play (Containment). Currently the popular method for either reflective dll or PE injection is by means of some script or other (powershell being the most common). Consider something like Netwalker variants which will initiate encryption with a powershell script that inject a dll into explorer. Stop the script will stop the malicious cascade (and CF just loves to kill scriptors). With Containment in Restricted Mode
Things like various sorts of Process Hollowing and Process Doppelgänging are also prevented by CF (not that you asked).
And good move on killing the HIPS. HIPS (in general) tend to give a false sense of security while pretty much ignoring things like the recently popular trend for malware to use LoLbins (the Ransominater series in the Video section being an excellent example).
Oh yeah- good move not bothering with CIS (which has the not needed on demand scanner). As you mention CF has the Cloud and File rating, but having something like WD enabled is also a good idea.
Things like various sorts of Process Hollowing and Process Doppelgänging are also prevented by CF (not that you asked).
And good move on killing the HIPS. HIPS (in general) tend to give a false sense of security while pretty much ignoring things like the recently popular trend for malware to use LoLbins (the Ransominater series in the Video section being an excellent example).
Oh yeah- good move not bothering with CIS (which has the not needed on demand scanner). As you mention CF has the Cloud and File rating, but having something like WD enabled is also a good idea.
- Dec 12, 2016
- 1,396
Where can I find comodo firewall ?
Since the EOL only CIS is available via the website.
Post or PM a link if possible.
- Nov 10, 2017
- 3,250
Here's a link
Open a setup> Options> all unchecked > Components uncheck all except Firewall then install it
- Oct 22, 2018
- 590
And when you download Comodo Firewall, set it up to Cruelsister's specs. Doesn't take but a couple of minutes and you've got as close to bulletproof protection as any security software of which I'm aware.
- Aug 22, 2013
- 886
