I installed dropbox, right after the installation I realized that the program had ended the previous instance of explorer. exe and started another.
So I decided to do a test with antiteste. exe before and after installation of dropbox.
tested without having installed the dropbox, CIS 6 funionou perfectly, alerting and being able to block access attempts. However installing dropbox and performing the test, the CIS 6 warned not blocked or anything.
after restarting the PC or the explorer process. exe comodo back to their normal characteristics alerting and blocking, and if a layman User downloads a malware able to bypass defense +?
Note: realized the test outside the sandbox and behavior blocker disabled. Because even if the antiteste runs in fully virtualized sandbox, it will be able to capture screen and keyboard.
for those who do not want to see the video image in the sequence follows:
Defense + (proactive) active behavior blocker and sandbox disabled
occurs, even though disabled setting rating
the right would be alerted that the explorer was being accessed as is the case of security policies to reliable software pre-defined.
and feel a certain lag when I try to run the dropbox.
Coming to think of it in light of the above and this is an unacceptable practice performed by the Dropbox installer.
I am not sure why this strategy was chosen. May be it was because they tried to avoid a reboot but it is unacceptable from a security point of view. I find it already questionable it installs its self in the user folder like viruses and Google Chrome do trying to avoid Windows User Account Control. But restarting Explorer with installer privileges has my blood boiling and steam coming out of my ears and nose … :o :-X
Unfortunately, this problem is an old one in the alert process explorer trying to access an application and an application attempting to access the explorer process works sometimes and not others :-\
what makes dropbox and restart the process explorer, explorer not auto restart case has been finalized by a third-party software.
reason the system fails and the explorer will ask us to restart the explorer process
solution
dropbox uses Seclogon HKLM \ SYSTEM \ ControlSet?? \ Services \ Seclogon
placing it in protections CIS6 comodo registry is able to prevent the dropbox restart the explorer process
proceed as follows:
I realize it’s a vulnerability and not a bug, but I believe it certainly falls under the blanket of issues which are worthy of bringing to the devs attention.
I have used CiS for years on my both PC’s.
Right now i got problems (instable) with the old version on one computer, and the other just received v6 (where i am unable to find advanced options :P).
That, and looking at Your video made me think, that its time to move to some other software.
But what?
Zone Alarm was good - about a decade ago
Any suggestions please?
Version 6 is not on the automatic updater for people using v5.x. What happened? You likely saw the updater icon, which may stray for 10 or so seconds, but it did not say there was an update. However when clicking on it it will give a screen with a url. Following that url probably got you the message there was another version.
Did you install v6 without uninstalling v5?
(where i am unable to find advanced options :P).
Already answered in your other post. Please don't cross post.
That, and looking at Your video made me think, that its time to move to some other software.
But what?
Zone Alarm was good - about a decade ago :P
Any suggestions please?
It's one glitch. That does not make CIS completely useless all at once. With Zone Alarm you're far worse of: http://www.matousec.com/projects/proactive-security-challenge-64/
:-X
