BB seems to disable HIPS alerts?

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
#1

I don’t understand why having BB active should also seem to disable HIPS notifications.

For example if I iinstall a new program with BB switched on, then the process will run to completion with no HIPS warnings whatsoever. Only if I set BB to ‘Disabled’ do I get the notifications of registry/directory changes etc, such as I remember from earlier versions of CFW.

Why is it like this? Why can I apparently not have auto-sandboxing and still see HIPS notifications about what an installer is doing to my OS?

#2

It is not really BB only everything has been done to reduce alerts as most members want this.

Trusted Vendors list also helps with reducing alerts.

If you want more alerts you have to change the settings to a level you are comfortable with.

#3

Thanks Dennis2…

Yes I appreciate Commodo’s wish to make CIS a less intrusive program for users, but I am struggling to find settings that suit my own wishes. When I’m installing or running a new program I do like to see all these ‘intrusions’ and to know exactly what the program is doing with my OS, while at the same time I like the idea that auto-sandboxing will catch any rogue activity. I can appreciate the fine distinction here though, and that CIS can’t really be expected to know the difference between unknown and rogue activities.

The only way I’ve found to restore the level of alerts that I want, is to disable auto-sandboxing… it seems to be a case of one or the other, and I can’t find any settings which deal with this. Switching HIPS to paranoid just freezes my PC, a problem which I posted in this thread some time ago.

Thanks for the response anyway … I guess it’s a case of experimenting further with settings and finding some compromise that suits me.

#4

Sorry found your post, that should not really happen.

I have a lot tighter settings than that greatly reduced Trusted Vendors list, and no problem with alerts freezing in Paranoid Mode usually have about 300 alerts to start with when running some processes in the first 1/2 hour.

Though it is Windows 7 x 32 but that should not make that much difference.

The thing it possibly could be would be a conflict with one of your other programs that you have running.

You would really need to do a full bug report, or restrict which processes you run at first until you find which one causes the problem.

#5

Thanks for that… yes it’s on my to-do list : ) To run HIPS paranoid with all auto-starts disabled, and then add processes one by one to see if it’s one in particular rather then just the sheer volume of alerts. If I can isolate it to one process/program than I will certainly file a proper bug report.

Cheers.

#6

Thanks :slight_smile:

It can take a lot of time and may not be successful, but it does help everyone.

Dennis

Edit Please note in Windows 7 there is a problem in Paranoid Mode with slow shutdown during logoff/shutdown (no desktop no alerts possible) only way to fix is check logs and add rules manually.