Basically it would work in a similar way as avast! does now. Except avast! Sandbox only suspicious files, CIS would auto sandbox every unknown app. Until further analysed by the behavior aalysis or cloud results. After that, it would unsandbox it if confirmed clean. Otherwise it would keep it in sandbox until later verified clean or confirmed malware. In fact i wonder why CIS even asks to Allow or Sandbox in CIS 5.10 where it could auto sandbox it anyway. Would make sense…
That is because auto sandbox in current versions of CIS doesnt support full virtualization. Only manual sandoxing does. However, its been said that CIS 6.x will support it. You can read more here.
Some computer security software, such as McAfee's McAfee VirusScan and Symantec's Norton AntiVirus, works by patching the kernel. Additionally, anti-virus software authored by Kaspersky Lab has been known to make extensive use of kernel code patching on x86 editions of Windows. This kind of antivirus software will not work on computers running x64 editions of Windows because of Kernel Patch Protection.
Interestingly, Symantec’s corporate antivirus software and Norton 2010 range and beyond does work on x64 editions of Windows despite KPP’s restrictions. Antivirus software made by competitors ESET, Trend Micro, Grisoft AVG, avast!, Avira Anti-Vir and Sophos do not patch the kernel in default configurations, but may patch the kernel when features such as “advanced process protection” or “prevent unauthorized termination of processes” are enabled. Sophos publicly stated that it does not feel KPP limits the effectiveness of its software.
Do you think that COMODO is superior than Symantec in 64bit, because COMODO patches the Kernel and Symantec doesnt? Or is it because of the Default Deny Protection system?
According to the links I read before, it’s not really impossible since it has been bypassed before. Microsoft did however release patches for that… twice. So I assume it’s not impossible but perhaps extremely hard.
Current version if AV is set to give alerts, when a threat is detected by local signs the alert mentions, Comodo AV & if the threat is detected by cloud signs the alert mentions Comodo Cloud AV. This is perfect.
But if the AV is set to autoquarantine the threats, when a threat is detected the autoquarantine alert mentions Comodo Internet Security for every detection i.e local signs or cloud signs.
This is not something major but it would be good if the autoquarantine alert too distinguishes the threat detection & mention Comodo AV for local signs & Comodo Cloud AV for cloud signs.
I like it good to know if the detection was by local or cloud signs & also to know the cloud effectiveness.
CIS has the option: DEFENSE+ > DEFENSE+ SETTINGS > Enable enhanced protection mode
So, it’s not impossible to patch it for COMODO as for its competitors its not impossible either, according to this portion of the article:
“Antivirus software made by competitors ESET, Trend Micro, Grisoft AVG, avast!, Avira Anti-Vir and Sophos do not patch the kernel in default configurations, but MAY patch the kernel when features such as “advanced process protection” or “prevent unauthorized termination of processes” are enabled.” Source: Wikipedia.