Does CIS have self-protection?

[Guest]

[alexo2003]

Hi!

The question concerning possibility to kill processes of Comodo. I have the latest version of CIS installed and KillSwitch utility from latest CCE. It is very simple to terminate both cfp.exe and cmdagent.exe, and CIS does not reload them. So, now we have no CIS, no protection, am I right?

[Valentin N]

Hey and warm welcome to comodo forums Alex!

CIS has selfprotection. Keep in mind that CIS is not the nanny of the users decisions so if you decide to delete some file from CIS folder CIS won't stop you. BUT if a malware tires to do the same as you do, it won't succeed but fail.

Regards,
            Valentin N

[alexo2003]

OK, I understand that termination using Killswitch is some artificial task. But let's imagine a malware having legitimate digital signature, so it is treated as trusted app by Comodo, and CIS won't stop such termination. I mean that if there exists some possibility of such killing, Comodo should increase its protection. There are some other products that give no chance to terminate them by Killswitch. Well it is only my apprehension and you say CIS is strong enough just "out of the box".

Thank you.

[JoWa]

There are some other products that give no chance to terminate them by Killswitch.

Which products? And are you sure they were not restarted (= new PID)? Are you sure that KillSwitch’s driver was loaded?

If an application successfully loads a well written kernel mode driver (such as the one KillSwitch/Process Hacker uses), it can terminate any process.

But let's imagine a malware having legitimate digital signature, so it is treated as trusted app by Comodo, and CIS won't stop such termination.

Trusted applications are not allowed to terminate cfp and cmdagent. There are exceptions though, as you can see in Protection settings.

[alexo2003]

Which products? And are you sure they were not restarted (= new PID)? Are you sure that KillSwitch’s driver was loaded?

Bitdefender:

, .

This is from discussion here: http://www.kadets.info/showthread.php?t=78288, sorry it is in Russian. You are right, there is e.g. Ikarus, that restarts just killed process.

[wj32]

Please do not use an old version of Process Hacker (like KillSwitch). Upgrade to the latest version and retest.

[alexo2003]

Please do not use an old version of Process Hacker (like KillSwitch). Upgrade to the latest version and retest.

Well, I downloaded latest Process Hacker 2.12, installed just Comodo Firewall with maximal proactive security and tested again on XP SP3. Nothing changed.

First I terminated cmdagent.exe at TP1 (!!!), then cfp.exe was successfully terminated at TT2. I made find in Process Hacker and it shows no "comodo" in Handless or DLLs.

In addition. After termination all Comodo processes I can't start any program from shortcut on the Desktop. System reboot fixes normal behavior of Comodo and XP.

[wj32]

Well, I downloaded latest Process Hacker 2.12, installed just Comodo Firewall with maximal proactive security and tested again on XP SP3. Nothing changed.

I meant with BitDefender... (Why would a newer version of PH remove the ability to terminate Comodo processes?)

[OldRampant]

BitDefender 2011 Win 7 32 bit real

http://www.youtube.com/watch?v=Ryh_zdDWoac

[languy99]

I cannot terminate cmdagent using killswitch at all.

[wj32]

BitDefender 2011 Win 7 32 bit real

http://www.youtube.com/watch?v=Ryh_zdDWoac

1. Why are you using an old version of Process Hacker?
2. KProcessHacker (the driver) does not appear to be loaded. I have had some reports of AVs blocking KPH from loading.

EDIT: I just tested PH on Windows 7 64-bit, and it terminates BitDefender processes just fine.

[military]

windows xp sp3 / process hacker 2.12 ( killswitch are same results)

[wj32]

The original topic has been discussed at length a few times before. You cannot protect against kernel-mode termination.

[OldRampant]

1. Why are you using an old version of Process Hacker?
2. KProcessHacker (the driver) does not appear to be loaded. I have had some reports of AVs blocking KPH from loading.

EDIT: I just tested PH on Windows 7 64-bit, and it terminates BitDefender processes just fine.

Win 7 64 bit real PH 2.12
http://www.youtube.com/watch?v=VnBAJq4O8QU

[wj32]

Win 7 64 bit real PH 2.12
http://www.youtube.com/watch?v=VnBAJq4O8QU

KProcessHacker is not loaded. You must load it, as I already explained.

[Tags:]