Advanced Plus Security ErzCrz Security Config 2024

[ForgottenSeer 92963]

ErzCrz,​

What is the status of popular script interpreters in your Comodo setup?
I mean: cmd[.]exe, cscript.exe, mshta.exe, powershell.exe, powershell_ise.exe, wscript.exe.

Oeps forgot that @ErzCrz used Comodo. I have used Comodo Cloud AV and that 'light' version had block rules for suspicious execution of the 'usual suspects' scriptors, so I guess Comodo also protects against scriptors somehow making SWH probably the best option to use.

 

[ErzCrz]

ErzCrz,​

What is the status of popular script interpreters in your Comodo setup?
I mean: cmd[.]exe, cscript.exe, mshta.exe, powershell.exe, powershell_ise.exe, wscript.exe.

Just the default for Proactive Configuration for those as Runtime Detection and Autoruns Scan which includes some others as well. I know some people who have an extensive list beyond what's there by default but not something I've played around with. All the files in the Autoruns scan have Embedded Code Detection enabled.

Spoiler

 

[Andy Ful]

Just the default for Proactive Configuration for those as Runtime Detection and Autoruns Scan which includes some others as well. I know some people who have an extensive list beyond what's there by default but not something I've played around with. All the files in the Autoruns scan have Embedded Code Detection enabled.

View attachment 263956
View attachment 263958

If you run powershell.exe, is it contained in Comodo's sandbox?

 

[ErzCrz]

If you run powershell.exe, is it contained in Comodo's sandbox?

No, you'd have to set containment rules for that and any changes you did make with powershell wouldn't affect the system. The default setting is just script analysis/detection. Maybe it's something I should look into

 

[Andy Ful]

No, you'd have to set containment rules for that and any changes you did make with powershell wouldn't affect the system. The default setting is just script analysis/detection. Maybe it's something I should look into

So, Comodo can detect scripts by heuristics like most AVs. I am not sure how effective it can be (no tests).
The Comodo Client Security can use advanced heuristics based on AMSI but I am not sure about Comodo AV.

Real-Time Scanner Software Virus Protection | Comodo Client Security For Windows

Real-time scanner or on-access scanning program launches scan whenever a new file is created and copied. Real time scanning gives you the highest level of protection and it is highly recommended to enable it in your PC.

help.comodo.com

Anyway, Comodo with your settings can be sufficient at home.

 

[ErzCrz]

Just updating. No real isses for the most part. The Noeval uBO rule has been a little annoying to whitelist but that's only been on the occasional site. CIS updates slow the machine when running and full scans seem to get automatically aborted, maybe I'm not using the machine long enough when that's running.
Still on an old machine that isn't Win 11 compatible, hoping I at some point get around to an upgrade though I may have to go to an older one I have spare as this faster one is starting to fall apart. Time to think about an upgrade at some point soon.

 

[ErzCrz]

Removing the *##+js(noeval) rule in uBO. Just breaks a few pages I visit and Resource library recommends it not set as generic filter. Wonder if there's somehow a noop or TLD rule for it but yeah, more hassle than needed at the moment.

Resources Library · gorhill/uBlock Wiki

 

[ErzCrz]

Got the itch to move back to Hard_Configurator update before long. I like CIS but I think the last bug fix was almost a year ago. We'll just see bit but it's a move I'm thinking about doing.

 

[ErzCrz]

So decided to try going back to MD. Uninstalled CIS and restarted as normal but now MD not working I might have a system restore but it's been a couple of weeks sine I did an install.

 

[ErzCrz]

Anyway, found a restore point from last week, will have a go at that.

 

[SeriousHoax]

So decided to try going back to MD. Uninstalled CIS and restarted as normal but now MD not working I might have a system restore but it's been a couple of weeks sine I did an install.

View attachment 266597

View attachment 266598

When it comes to Comodo, never rely on uninstallation. In my experience, they are the worst at uninstalling. For all AV in general, it's better to create a backup before installing a third party AV.

Anyway, found a restore point from last week, will have a go at that.

Glad to hear that.

 

[Shadowra]

So decided to try going back to MD. Uninstalled CIS and restarted as normal but now MD not working I might have a system restore but it's been a couple of weeks sine I did an install.

View attachment 266597

View attachment 266598

I'm not really surprised.
When I tried it, Comodo even blocked Windows updates with HIPS enabled (to put it simply, the installation failed)
I had to uninstall it.
I hope they fixed the problem.

 

[ErzCrz]

System restores just sticks at Initializing. I think I need to run SFC scan and see if that does anything.

 

[Kongo]

System restores just sticks at Initializing. I think I need to run SFC scan and see if that does anything.

You might want to check out this tool. Was quite helpful to me in some cases.

(Almost) everything you need to repair Windows problems in one small handy tool. - Windows Repair Toolbox

Windows Repair Toolbox (freeware) is a portable program that helps you repair a Windows system, by making the process faster, easier, and more consistent.Features:– Download and run “on-the-fly” the best free software when it comes to diagnosing and solving several kinds of Windows problems...

windows-repair-toolbox.com

It's the same dev who created the Antivirus Removal Tool: Antivirus Removal Tool - The technician friendly tool to detect and completely remove antivirus software.

 

[ErzCrz]

So System Restore didn't fix the issue or it just kept hanging and I had to repair install to get Windows loading again. I do have an old full backup from years ago but I'd have to figure out what I've added and back that up. Alternatively, do a fresh install but that'll mean finding program discs again and a long download of a game (40gig).

I think Reset this PC might just be the best option and use Open Office or something for Word, Excel etc and Thunderbird for emails. Just doing a backup of my keepass files.

 

[WhiteMouse]

So System Restore didn't fix the issue or it just kept hanging and I had to repair install to get Windows loading again. I do have an old full backup from years ago but I'd have to figure out what I've added and back that up. Alternatively, do a fresh install but that'll mean finding program discs again and a long download of a game (40gig).

I think Reset this PC might just be the best option and use Open Office or something for Word, Excel etc and Thunderbird for emails. Just doing a backup of my keepass files.

System Restore failed on me too many times that I stop trusting it. I disable it to save disk space and ssd TBW. Macrium Reflect is so reliable that I even bought 4 licenses.

 

[SeriousHoax]

So System Restore didn't fix the issue or it just kept hanging and I had to repair install to get Windows loading again. I do have an old full backup from years ago but I'd have to figure out what I've added and back that up. Alternatively, do a fresh install but that'll mean finding program discs again and a long download of a game (40gig).

I think Reset this PC might just be the best option and use Open Office or something for Word, Excel etc and Thunderbird for emails. Just doing a backup of my keepass files.

Why not create a separate partition for games?

 

[ErzCrz]

Why not create a separate partition for games?

Yeah, I didn't think of that at the time. I do have a second partition on the drive with plenty of space so I'll do that this time around. Just checking if I can move the files over to the 2nd partition for the game to save me spending all weekend downloading it

Not sure I can face this system reset but I better get on with it so I'm not up all night.

 

[CyberTech]

It looks like you didn't backup system image every two weeks or month? that's a reason, System restore is bad sometime..

 

[ErzCrz]

It looks like you didn't backup system image every two weeks or month? that's a reason, System restore is bad sometime..

Yeah, intention was for that to be the case but the exernal drive became a hassle and I've been planning to get a separate drive just dedicated to backups. Anyway, a lesson I needed to learn I think.

OFFLINE for the rest of today but hopefully it won't take long.