wisdomskiey

How is the Firewall taking priority over other applications when the PC first boots? How is the priority given,is it through a kernel driver?

• Comodo Antivirus For Linux File System Filter Driver Is Not Loaded
• Comodo Filesystem Filter Driver Is Not Loaded

Sep 11, 2017 - Tools for Pentesters. Este manual contiene principalmente una referencia de funciones PHP, tambien contiene una.

I'm using Comodo Firewall and I see that the Spotify app is loading before Comodo loads;well it seems like that since the Spotify panel appears before the Comodo one.I mean the Firewall has to start first before other applications can access the internet,isn't that so?

That might be ok for Spotify but what if there is a rogue app that gets access to the internet before the firewall does? How can you prevent that?

1 Answer

How is the Firewall taking priority over other applications when the PC first boots?

I'm using Comodo Firewall and I see that the Spotify app is loading before Comodo loads; well it seems like that since the Spotify panel appears before the Comodo one.

The apps that you see loading are the GUI components of Spotify and Comodo.

These GUI components are loaded during logon. At this point the protection parts of Comodo are already loaded so the system is secure.

• The protection parts of Comodo (cmdagent.exe and the Inspect packet filter driver inspect.sys) are loaded very early in the boot process (before explorer starts).

• Inspect runs at the lowest level (kernel level).

Comodo Antivirus For Linux File System Filter Driver Is Not Loaded

The processes that protect are actually Comodo Internet Security Helper Service (cmdagent.exe) and the Inspect packet filter driver (which runs under Comodo Internet Security Helper Service).

They start very early in the boot process. Cis.exe is the client program; it is the program that provides the UI and instructs cmdagent.exe how to behave. Cistray.exe provides the tray icon, widget and starts cis.exe.

Protection is provided regardless whether cistray.exe and cis.exe are running.

Source Why does cis.exe get launched as a service?

CIS uses WFP in conjunction with inspect.sys packet filter driver. Inspect runs at the lowest level (kernel level) where WFP runs at higher levels.

Source Is CIS using Windows Filtering Platform (WFP) or what?

What if there is a rogue app that gets access to the internet before the firewall does? How can you prevent that?

A Firewall will not prevent the installation of rogue apps. You need another layer of security to do this, for example an AntiVirus program.

There are also progams that will monitor system changes. I useWinPatrol which has the following alerts:

• New Start-up Programs

  Spyware and Malware need to start in order to run. Protect your startup programs.

• New Browser Add-ons Wondershare dr fone registration code crack android.

  Don’t let unwanted add-ons invade your privacy, commandeer or slow down your Internet browsing.

• New Browser Toolbars

  Unwanted toolbars slow your browser down and have the potential invade your privacy.

• Newly installed Windows Services

  A Windows Service has total permission to EVERYTHING on your computer. You NEED to know when one is installed and why!

• Creation of Scheduled Tasks

  Scheduled tasks are a way spyware and malware will schedule one of their minions to run. Don’t let them use your task scheduler against you.

• Changes in File Type Associations

  Malware will typically change file type associations to get you to run their program. In addition, this helps to prevent file hi-jacking of file type associations by impolite programs.

• Newly Active-X components

  You need to know what is installed on your computer.

• Changes to your home page

  Don’t let programs get away with changing your homepage without your permission.

• Changes to your default Internet search provider

  Junkware, malware and unscrupulous entities love to change your search provider so they can control the results.

• Changes to your hosts file

  This protects you for malware redirecting to you their site rather than the real site.

• Changes to Auto Updates Settings

  Malware loves to disable auto updates, stop them in their tracks!

• Changes to UAC Settings

  Don’t let programs change your UAC Settings without your knowledge.

• Changes to Hidden Files

  Get alerted if any new hidden files are added or changed.

Source WinPatrol

Disclaimer

I am not affiliated with WinPatrol in any way, I am just an end user of the software.

Not the answer you're looking for? Browse other questions tagged windowsnetworkingsecurityfirewallservices or ask your own question.

I downloaded Comodo on 14.04 and it says filesystem not loaded so I went out and found some patches but I dont want to mess around with the kernel so can I use Comodo without the filesystem filter driver, will it work the same way.

1 Answer

Of course you can use it without this options just you'll need to scan manually every time

But there is simple soution:

1) You can get this driver 'redirfs,avflt,dazuko -- kernel 3.18 or lower' needed from here:

2) Go to folder where you downloaded the driver:

Comodo Filesystem Filter Driver Is Not Loaded

sudo mv driver.tar /opt/COMODO/driver.tar

3) Then change directory

cd /opt/COMODO

4) Install it sudo ./post_setup.sh(Please be carefull at end of licence you NEED to accept with Y and then you can add email address, and choose Language 8)

5) Restart cmdavd/etc/init.d/cmdavd restart

6) Reboot if must

7) RIGHT CLICK on System Tray icon and click

1. Antivirus Security Level
2. On Access

DONE!!!

Not the answer you're looking for? Browse other questions tagged antivirus or ask your own question.