When I use big files like virtual machines or truecrypt container and I suspend the virtual machine (closing and saving state)/dismount the truecrypt container and I have HIPS set to “Clean PC mode” cmdagent starts reading the whole file after a few seconds causing heavy IO (100% in perfmon). This takes more than 10 minutes on my PC so mostly I will kill it. When I set HIPS to disabled I dont observe this behavior. Auto-Sandbox is disabled and Sandbox-feature is not used.
Antivirus: happens with Stateful and Off
Firewall: Safe Mode
Virusscope: happens with on and off
CIS Version 8.2.0.4591
Windows 8.1
It also prevents me from ejecting external drives when the file is on it.
This behaviour started a few weeks ago.
In perfmon the System process with PID 4 is shown as culprit but Procmon shows cmdagent reading the whole file.
No other security software installed.
I have exactly the same problem. Anytime there is a change in my two VM images, not only on closing, HIPS goes to work and hogs the hard drive slowing everything down. My images are 16 and 50 GB in size and it takes HIPS up to 30 minutes to finish each scan. I don’t understand why it’s scanning these huge files at all.
I like HIPS but because of this I have to keep it disabled. Is there a way to tell HIPS to not scan files over certain size or to exclude specific files and directories? I looked in HIPS settings but didn’t find it. The “Exclusions” at the bottom of Advanced settings don’t do it (perhaps they only apply to shellcode injections).
COMODO Firewall 8.2.0.4674
HIPS doesn’t scan until there’s there’s something executed unless your talking about explorer preview and thumbnail generation which does have to peek the file.
The only thing executing when I work with the VM is VirtualBox. The main machine only sees the VM image getting updated. So my question is how can I tell HIPS to ignore the VM image file altogether?