Just trying to understand how this thing works.
-
There is an option in the settings of firewall and D+ “Create rules for trusted programs” (unchecked by default), I know that CIS has a white list of trusted programs, but how does it chack files against it? (By name, checksum, digital signature?)
-
Is it possible for malware \ virus to aquire or fake digital signature in order to fool CIS into thinking it’s trusted?
-
Let’s say I have unrecognized file in auto-sandbox, and it caused D+ alert let’s say “Access to protected reg key” if I click Allow (remember my choice checked) it creates a rule for that app where everything is allowed?? how does that work? I mean shouldn’t it just allow Reg access for that program and when it tries to acces something else protected? Same with deny … it’s about the same with firewall rules.
-
On averege, how much does it take to recognize a file as safe or not? a day? a week? a month? Is there anything I can do to speed it up? (Let’s say I don’t know if the file is safe)
-
I have Left 4 dead 2 game (Steam version), When I start Steam client everything’s fine, I guess it’s trusted, when I start the game however (I Have Russian version, if that matters) it says “Unrecognized program has been put in sandbox as partially limited”… well fine, It starts to load but then exists. I check the status of the program in unrecognized list it says unknown. Well I bought it so I guess I can trust it, I put it in trusted and it wofrks fine, but I’m curious, when this file will be recognized by comodo? It is still working on it after I transfered it to trusted right? So how can I check if the file s recognized yet, is it in que or what?
-
If the file is recognized as malware \ virus by D+ can I somehow learn why exactly? I have a game file that D+ detects as dangerous, but CAMAS.comodo.com detect as suspicous just becourse it creates C:\WINDOWS\system32\d3d8caps.dat even there is no such file in that directory when the game runs (I have show hidden and protected files on)
-
Is there a way to look at current d+ white list? Cuz it seems most of my games are unrecognized (is that normal?)