Hi
Standard sandbox settings with the (do not virtualize access to specific files and folders) option unchecked will protect against this threat.
Adding the system partition C:* to protected files will also protect all data on that partition with the option in hips (only lock).
I remember that I had the entries listed below in a File Group called āAnti-Ransomā which was added to HIPS āProtected Files and Foldersā when I was using CIS V5.12.
\Global??\FltMgrMsg
\Device\KsecDD
?:*
Are the first two entries of use for CIS V12 too?
Are we sure thatās all? It seems he had some interesting posts and Iām wondering if itās wise to just dismiss it all. Unfortunately, I am just an intermediate user (less than intermediate in the Comodo ecosystem) and do not feel qualified to make an assessment. But Iād like to know if low people in high places have cracked the Comodo conundrum. The ostrich act is not a good idea IMO.
I would like to know too. Thatās why I asked him to provide more information about his bypass statement. His statement is completely worthless without evidence .
I had also below entry added to HIPS āBlocked Filesā in CIS V5.12 to protect against certain ransomware.
*.locked
Not sure if this setting is still applicable with all new ransomware types these daysā¦
Maybe someone can comment on this setting or shed a light on it?
for fix problem in exclusions of auto containment: Containment Configuration, Containment, Restricted Internet Access, Containment Computer Security | Internet Security
ādo not virtualize acess to:ā ADD ?:* in protect files
in: Active HIPS Rules, Network Access, Internet Protection | Internet Security
ADD ?:* as āall applicationsā and in āfiles/folders protectā - block āshared spaceā and folders than your addā¦
NOTE: If is user inexperienced, NOT MAKE THIS!
Sorry my english!
Adding ?:* has a pretty big performance impact in online games and causes lag (FPS goes down dramatically)
I didnāt notice any on my old laptop but if your using Containment anyway, you can just add your libraries folder and leave it at that though I would adjust the Run Virtually to āRestrictedā or āBlockā
To avoid confusion
It should be this
?:*
not this
?:*
sorry my mistakeā¦ 
;D
By keeping HIPS off but automatic containment active (with the standard proactive configuration setting), can you be safe against ransoware attacks and / or other attacks (trojans, adaware, etc ā¦)?
HIPS for me is perhaps a bit complicated and even when I install Comodo Antivirus or CIS on the PC of my inexperienced friends / relatives I prefer not to enable it to avoid that it can be complex to use.
Can happen. 
when I used these paranoid HIPS settings, HIPS used the PC not me. flood of alerts for every single action then tons of BSODs just unable to use for avarage users like me :P0l
Ha ha ha thatās funny!
Yeah well, it does itās job ha ha.
Why not let HIPS eat the idle CPU cycles? There are plenty of them! Ha ha
3 letters like ākylā ??? :P0l
:P0l
:-TD
Do you think CIS would be able to protect individual users from this latest major ransoware attack via Kaseya?
Iām no expert but Iād say Yes. Anything unknown/untrusted gets put in containment and therefore doesnāt infect your system. I prefer to run CIS in Proactive mode with Unknown Containment level set as āRestrictedā but CIS will protect you from unknows including latest Zero-Day and any ransomware but CruelSister can confirm.
I expect that with the Cruelsister settings CIS will be able to stop it. Iād love to hear from Cruelsister herself.
I still have some doubts about the containment approach.
For unrecognized applications it is better to set it to ārun limitedā or "run virtualized?
If it is set to ārun virtualizedā in the options should you put the check mark on āset restriction levelā to āpartially limitedā or ālimitedā?