CCAV Hotfix is available today ; Performance issues solved !

[Jon79]

@23 post:68

But question is, what will the average user do in this case, if he/she is convinced that this file is safe?

This is exactly my concern about sandbox/virtualization… you can check my comment here

@Jon79 post:10

That’s true, but I guess the keylogger comes with another software to hide it, right?
If so, if you run that software as virtualized, maybe something can’t work properly because of the virtualization (this happens with some unarmful softwares not yet whitelisted by Comodo).
So the average user will run again the software asking CIS to not virtualize it.
Then, what will happen? You get keylogged!!!

That’s why I think (just a personal opinion) it’s better to run any unknown software as “Run Restricted → Untrusted”. Like this you will get some pop-up from the HIPS and that can let you better understand what the software is trying to do and decide whether to allow it or not.
Of course, it’s user-dependent, but I think CIS warnings are quite clear to understand and manage

Some more references:
https://forums.comodo.com/defense-sandbox-help-cis/spyshelter-test-t109758.0.html
https://forums.comodo.com/format-verified-issue-reports-cis/limited-and-restricted-block-screen-capture-but-untrusted-does-not-m399-t95001.30.html

In my opinion HIPS and FW are two key components of a security software, so I’ll keep CIS even if CCAV is available.
What I think would be worth is to have an option in CIS to choose either the full AV (i. e., download the database on your PC) or just the cloud AV (which would be much lighter)