CFP 3.0.11.246 RC1- Questions about how it works

[system]

@gibran post:140

You have to select the installer policy on the 2nd popup after the one that ask permission to run. That will disable popups.
Then you have to examine your pending file list and move all harmless files to your Safe list.

I still get the reminder Unless im doing something wrong??

[gibran]

@Josh123 post:145

I still get the reminder Unless im doing something wrong??

You can only get a reminder if you don’t switch to install mode.
Anyway please post a screenshot of the alerts you get.

[system]

Screen Shots here!

[attachment deleted by admin]

[gibran]

@Josh123 post:147

Screen Shots here!

I see. No need to worry then.

Install mode is a special mode used for the Install policy. But it should be activated only when you install an app. That reminder ask you to return to the previous mode. If you finished to install then you can click yes.

[system]

@gibran post:148

I see. No need to worry then.

Install mode is a special mode used for the Install policy. But it should be activated only when you install an app. That reminder ask you to return to the previous mode. If you finished to install then you can click yes.

I get ya now… I will only do it for installing for now on

Thanks for your help gibran!

Josh. (:KWL)

[gibran]

@Sutebe post:135

Correct it was the my pending list… also I updated my post above per your request.

And no, I used the All header, however for alot of the entries it said something to th effect of cannot move to trusted list, entry already exists, or something to that effect, and it would pop that up for 80% of the items in the pending list, which i find VERY odd because if they were already in the trusted list why would my “administrative authorization” be needed?

Lookyng at your configuration I see was a normal one so there should be no software conflict involved I guess. Maybe D+ log could have provided an hint about the issue

Files in my pending list are added to track file modification occurring when you use install or trusted policies. It also track deleted files (to know if something important was deleted).
So as long as some file will be changed you’ll have to move it again to the safe list.

if you purged those entries before moving then that was a bug

[Sutebe]

Hmm perhaps I will give it another go to try it out, however comodo was infact preventing windows security center from recognizing AVG Anti-Virus. As soon as I uninstalled COMODO it appeared in Windows Security.

Yea I was running in installation mode at the time that it was being installed. It was weird though because the message stated that the file wasn’t moved to the safelist because it was already there, however it was in pending, so do I simply remove it from pending? Its kind of a pain to have to click OK to the message that pops up for a hundred files after attempting to move ones that are already in my safe files, especially after a big install.

And no, I haven’t purged any entries from the pending list actually, I simply used “remove” so I don’t think that was the issue.

Also it didn’t really seem to be recording my settings correctly because I would state to record an application as trusted, and to always apply that setting and the prompt would always pop up despite this. Or is that a normal occurance?

[gibran]

@Sutebe post:151

Hmm perhaps I will give it another go to try it out, however comodo was infact preventing windows security center from recognizing AVG Anti-Virus. As soon as I uninstalled COMODO it appeared in Windows Security.

Yea I was running in installation mode at the time that it was being installed. It was weird though because the message stated that the file wasn’t moved to the safelist because it was already there, however it was in pending, so do I simply remove it from pending? Its kind of a pain to have to click OK to the message that pops up for a hundred files after attempting to move ones that are already in my safe files, especially after a big install.

This seem a bug. maybe this is the same reason you had those alerts. Every entry in that list will trigger an alert.

@Sutebe post:151

And no, I haven’t purged any entries from the pending list actually, I simply used “remove” so I don’t think that was the issue.

Purging will save you a lot of time as it will remove entries that are no longer on your HD. You’ll have an error message if you try to move those.

@Sutebe post:151

Also it didn’t really seem to be recording my settings correctly because I would state to record an application as trusted, and to always apply that setting and the prompt would always pop up despite this. Or is that a normal occurance?

This is not normal. It would be interesting to know if these files were in My pending list to.

BTW to solve those issues there is a workaround.
You’ll have to move all files from your safe list to My pending list. Then you’ll have to move them back.

Anyway in order to make your life easy try to add as many app you trust to My Trusted Vendors.
Many softwares with a certified vista logo have a Digital signature (like Adobe, ahead,Netscape, Sun…)

[Sutebe]

Yea I reinstalled it and things are already appearing better. Windows Security Center is now recognizing AVG (which is good cause that alert was annoying).

Also that workaround for the pending list is a good idea, i’ll have to try that next time.

Purging physically deletes the files from your HD correct? I had some necessary files for FlashGet in Pending and if I purged these the program would have ceased to operate correctly.

I’ll keep in mind to add as many APP’s to trusted as possible. When installing new software should I add them as trusted or treat them as installers?

[gibran]

@Sutebe post:153

Purging physically deletes the files from your HD correct? I had some necessary files for FlashGet in Pending and if I purged these the program would have ceased to operate correctly.

Purging only clear My pending file lis from any file that was already deleted. Those files are added to My pending list so you can have a look to what file was deleted and have a chance to note if there is anything suspicious going on.

@Sutebe post:153

I’ll keep in mind to add as many APP’s to trusted as possible. When installing new software should I add them as trusted or treat them as installers?

Installing new software using the installer policy will quench the alerts. after an install you only need to disable the installer mode or answer yes to the remainder and finally look at my pending list.

[Sutebe]

@gibran post:154

Purging only clear My pending file lis from any file that was already deleted. Those files are added to My pending list so you can have a look to what file was deleted and have a chance to note if there is anything suspicious going on.
Installing new software using the installer policy will quench the alerts. after an install you only need to disable the installer mode or answer yes to the remainder and finally look at my pending list.

ahh ok so does the pending list create a copy of the files in question? because when I uninstalled flashget and reinstalled it, the files for flashget were in my pending files. If i purged them, would it have remove the re-installed ones in my hard drive?

everything seems to be going alright so far, lets hope it stays that way

[gibran]

@Sutebe post:155

ahh ok so does the pending list create a copy of the files in question? because when I uninstalled flashget and reinstalled it, the files for flashget were in my pending files. If i purged them, would it have remove the re-installed ones in my hard drive?

everything seems to be going alright so far, lets hope it stays that way

Nope My pendiing list is only a list of filenames. For one aspect it can be considered a log for another it can be used to mark apps as untrusted (this mean that if there is no ruleset for that app you’ll get alerts) or mark new apps as safe (thus enabling autolearning)

https://forums.comodo.com/cfp_beta_corner/installation_mode_and_clean_pc_mode-t13200.0.html

BTW this should be a better description as the one I wrote there https://forums.comodo.com/cfp_beta_corner/cfp_3011246_rc1_questions_about_how_it_works-t14514.0.html;msg103254#msg103254 were not. If a rule is already defined for a file in my you should not see any alert for that app.

[zippo]

I read that the new Comodo 3 will have an HIPS ability. I would like to know if it is going to conflict with the antivirus (Sophos 7) that is doing itself the HIPS analysis.

[system]

Hi Zippo.

It’s really not wise to run two HIPs applications side by side. Whilst I don’t know much about the Sophos product, if it has hips and you wish to use CFP v3 I suggest you disable one or the other.

[Ragwing]

Greetings!

They’ll most likely conflict with eachother, so only use one of them. Even if they might work together, I’d disable one of them, as you’ll get about twice as many alerts for each application.

Cheers,
Ragwing

[zvaragabor]

And what about CFP HIPS, and CAVS HIPS? Should I turn off one of them?

[Ragwing]

Yes, you should only have one of them running at the same time. There’s no point in running two HIPS. Most likely they’ll conflict with eachother, and generate about twice as many alerts for each application.

Cheers,
Ragwing

[zvaragabor]

I see. Anyway I use CFP 2.4 and Nod32 3.0 trial, I was just curious. But I will change, when the final release is out both of them, that’s for sure.
Thank you!

Greetings,
Gabor

[the_duality]

My university offers Sophos 7 to all Residential Network users. Sophos’ “HIPS” is not really HIPS. Its more like behavioral analysis, a form of heuristics. Fraught with FP’s i have found - but that is besides the point.

Sophos will be just fine running next to CPF 3.

[Sutebe]

@gibran post:156

Nope My pendiing list is only a list of filenames. For one aspect it can be considered a log for another it can be used to mark apps as untrusted (this mean that if there is no ruleset for that app you’ll get alerts) or mark new apps as safe (thus enabling autolearning)

https://forums.comodo.com/cfp_beta_corner/installation_mode_and_clean_pc_mode-t13200.0.html

BTW this should be a better description as the one I wrote there https://forums.comodo.com/cfp_beta_corner/cfp_3011246_rc1_questions_about_how_it_works-t14514.0.html;msg103254#msg103254 were not. If a rule is already defined for a file in my you should not see any alert for that app.

Ah alright I see. If I’m not in clean PC mode however, but in “Train with Safemode” and I purge my list, will it remove the files listed there from my HD? I see files that are on there that are needed by some applications and I just want to be sure that im not removing them directly from my harddrive.

It seems that if I switch to clean mode after allowing access to the necessary programs it would be easy to just remove the files from pending that I know are safe and leave the other suspicious ones in the list to see if I can trust them or not correct?

I just want to be sure im not deleting something that I need on here with the purge, I tried it once and it looked like it was purging it from my entire HD rather than just the list.