Hello,
tested on Windows 7 x64 with Comodo 5.0.163652.1142. Sandbox off, D+ with proactive profile.
RadeonPro can inject its dll “AppProfiles.dll” into other processes and there’s no pop up from Comodo regarding this.
Even if I use the process protection features, e.g. to protect firefox.exe against injections and so on, AppProfiles.dll is loaded into the memory:
If you want to test by yourself you need a Radeon graphics card in order to run RadeonPro. http://radeonpro.info/
Can you reproduce it?
If yes, what do you think?
when i launched it i get the D+ alert asking for unlimited access
if i clic block i dont get nothing to happen everything is normal no dll opened or nothing
check you setting you may have turned off some D+ functions or attually clicked allow for the install so all files installed are supposed to be safe
also its looks like a safe program, even if is not signed the comodo cloud scan may find it as safe
You are seeing a pop up regarding the sandbox. The sandbox must be always disabled for such testing because it’s using Windows rights limiting and this distorts the result.
D+ should handle any code injection.
If I recall it correct Online Armor has the same problem. And I bet almost every other HIPS has too.
I’d really like to know what is different of RadeonPro’s injection technique that it seems to be fully unknown to popular HIPSes.
What is pis*ing me off more is that since Comodo 3.8 the x64 HIPS didn’t improve at all regarding usermode hooks.
I’m curious what the developer comment will be in my “Sad: No progress with the x64 HIPS of CIS” thread. :-TD
I won’t try this now because I haven’t installed CIS anymore.
But my assumption is: Yes, because RadeonPro can work with limited rights and for the rest D+ is used (and D+ fails the injection).
When RadeonPro is first executed, there is a COM alert. When this is allowed, CIS lets the rest of the allow alerts too. This is for the sake of end-user experience by default. For example, if you blocked, it would block the DLL injection. Can this be changed? Yes. When you see the popup, it is the default popup layout. You can simply click “More Options” and it will expand the popup to Advanced Layout. In this layout, CIS will be verbose and allow you to play.
I’ve tested again and it actually fails like hell.
I always use the advanced layout. If I test such an issue and even create a forum thread you can be sure that mentally ■■■■■■■■ human failures like the one you have described don’t apply to my findings.
Just for my ego I tested again (advanced pop up layout!!!) and there is no pop up regarding the injection.
If I recall it correct there’s not even a pop up for the COM interface.
@MOVEAX: Did you see a pop up regarding COM interface access?
