COMODO Internet Security Beta Wishlist [CLOSED]

[Dennis2]

During any scanning any virus found should be Quarantined not delete please.
Dennis

[Dennis2]

Option to update the antivirus at set time during the day.
Dennis

[fieseler]

one thing it definatly needs is to be able to scan individual files.

[system]

Yes, Right Click Scanning is a popular request. It will be added!

Josh

[salmonela]

option to change real time scan mode:
-on access
-on modification ??
-on execution

[Dennis2]

@fieseler post:23

one thing it definatly needs is to be able to scan individual files.

It appears to do that already I had a False Positive and wanted to copy it to another folder to zip it, as soon as I click on the file I had a virus warning.
Dennis

[fazio93]

@3xist post:24

Yes, Right Click Scanning is a popular request. It will be added!

Josh

Great! That’s one of the only things that I was unsure of b/c avast has it and its very useful.

(L) (L) (L) (L) (L)

[L.A.R_Grizzly]

Frankly, I would like to have all of the Advanced features that were in 2.0 Beta. I would like to be able to disable from the taskbar icon. Only do scanning on some files (instead of all) (it scans files sent to the Recycle Bin). Generally, I would like to have more scanning options so I can taylor it to my specific needs.

I’m only a little dissatisfied with the AV portion, for me, the Firewall is just the same as in the stand-alone version.

[Beardo87]

i would like to see:

1: e-mail scanner (that can add notes to bottom of emails)
2: quick scanner (that can be used from explorer right click menu and download managers that can be set to run scans on downloaded files.
3: (i dont know if this is already a feature but i dont think it is) Web scanner (that scans files you try to download or links that you click, and warning you if it is infected).

[system]

People need to remember since CIS is BETA, Wishes right now are most likely not to be covered, But some can be. The Developers are dealing with bugs & FP’s.

So hope you all understand. This is the first version of CIS & First Free Security Suite!

Josh

[L.A.R_Grizzly]

@3xist post:30

So hope you all understand. This is the first version of CIS & First Free Security Suite!

Josh

So long as the automatic updates keep working, I see it as a daily treat to see what features will be added along the development road to a great Security Suite!

[system]

@L.A.R. Grizzly post:31

So long as the automatic updates keep working, I see it as a daily treat to see what features will be added along the development road to a great Security Suite!

Yes… This is only the beginning.

Josh

[system]

@Beardo87 post:29

i would like to see:

1: e-mail scanner (that can add notes to bottom of emails)
2: quick scanner (that can be used from explorer right click menu and download managers that can be set to run scans on downloaded files.
3: (i dont know if this is already a feature but i dont think it is) Web scanner (that scans files you try to download or links that you click, and warning you if it is infected).

Melih Posted reasons:

@Melih post:63

getting the web attacking you requires a different kind of technique yet again!

Each channel opens up new way of attack
files
emails
web
IMs
etc etc.

At the end of the day, all these kinds of attacks must get CPU time to execute some malicious code. So where could that code come from it must be on the PC for it to execute? Hard disk or in RAM. So if you are a malicious software you want to get into either HD or RAM. You utilise things like Buffer Overflow etc to infect a victim machine. So if you have both “On access” and “in memory” scanning you cover both angles. However it doesn’t hurt to employ “different” techniques (pls note… i say “DIFFERENT” as there are companies out there who simply deploy same file scanning at web or email which imo doesn’t provide extra security) to be aware of these malicious attemtpts. One very good example is “Comodo Memory Firewall”. This is a Buffer Overflow (BO) protection and BO is a nasty way and much exploited way to get into your machine by simply visiting a site. There are toolkits like MPack, Icepak,Neospoilt (and many more) who dishes out attacks to victim’s machine after analysing to see which vulnerable software you have and then serve you a relevant malware to utilise the vulnerability found on the victim machine! In this BO attack scenerio, of course having file scanner “could” work if they have the signature of the malware, but usually AVs (file Scanning) is behind in terms of sig generation, so it would be great to supplement our security layer with a “prevention” layer and add “BO prevention” (Comodo Memory Firewall). So bottom line is as long as you are not taking the same technique and offering it as a solution to everything then i have a problem. If you are legitimately adding value by creating new ways to “detect and/or Prevent” at different levels of the communication channels then i would welcome it.

for example at Comodo that is what we try to do: Try to cover you from all different angles using different techniques.

Melih

@Melih post:61

the key here is: If its just file scanning that you are doing, then you don’t gain much by doing it at email level if you have both On access and in memory scanning. However, if you have different attack detection techniques for email that you are watching that is nothing to do with your file scanning than sure why not. So bottom line is if you are using a different technique to detect for email than files then sure. If you are using the same technique for emails as you do for files, then no point imo.

Melih

[jebuchanan]

Most of my wishes are already posted. I would add (though) the auto update feature offer options to auto update program files AND signature files. Also this could be further optioned with user selected time of day.

Found virus threats should have the option for a) auto delete, b) auto quarantine, c) wait for user to view and select either delete, quarantine, or ignore (all files user selectable per choice).

From previous posts, CMF and file right click scan have been requested. Both are needed options. CMF should also have its status displayed in the summary screen.

I know you disaprove, but scanning files downloaded (either from a DL Manager or web browser) does have the advantage of catching (known) viruses before any damage can be done. What I am implying is, if a file DL’d is supposed to be a file from a trusted source, one would allow it to run when Defense + asks one’s permission to allow it to run. If it is viral, one now has the potential of a virus running loose in their computer. By scanning when it is DL’d, one might be able to catch that virus before it does any serious damage. You did state different angles of defense is a good thing, and that is what Comodo is trying to provide. This is one angle that needs to be covered. All users/testers that requested it have valid reasons for asking it be included.
This is my reason: this morning I had a viral attack. Strange to me, as the file has been residing on my HD and in memory since last spring (April I think). The program did nothing it seemed, was supposed to be part of another program. Always loaded with the startup software and just sat there silently.
Avast (on-access AV of choice until CIS) never detected it as viral (and I ran several deep scans over a period of time). Three other AV’s never detected it, and Comodo CIS never detected it.
This morning at 7:00am, it went active. It repeatedly made attempts to connect to the outside world. It also damaged a few other (non critical) software files. CIS blocked every attempt to leave (great, as this is what allowed me to discover it). Upon updating (immediately) my Avast signatures, it was spotted in memory and on the HD as viral (Avast discovered both). CIS never picked it up. It was stopped, and completely destroyed from my system.
Granted, known signatures would/did not help, but many other viruses have been discovered from DL scans, and stopped right there before even being granted a foothold of HD realestate.
I do not wish to have any file reside that is viral. What if the infected file was copied and given to a friend. Without knowing it was viral, I would be contributing to the spread (my friend may not have the protection I have). The stoppage of viruses must be from any angle available.

[gibran]

CIS alerts don’t mention if the digital signature is invalid.

If possible I wish that code-signed executables with invalid signatures will be able to trigger a totally new alert to ask the user if they still wish to apply the existing policies for that app.
Code signing is actually a neglected by many users this would be a good way to increase end-user awareness.

---

Another wish would be to modify GUID alerts for COM objects to also provide a more informative progid and related InprocServer32 file.
I guess nobody will be able to tell what a GUID mean but a progid an file could do the trick.

If not we should print a cheatsheet of all protected guids.

Another related wish would be to add an alternative way to add COM components to protected COM interfaces.

Everytime it takes up to 20 seconds to populate the panels with all COM components (clicking abort close the entire dialog).
A simple way to add an entry directly would prove useful if the user already know the GUIDs or use the registry.

Basically the COM Components… menu entry could be renamed to Browse COM Components… and another menu entry named “Add…” could be added.

Or Maybe The com Component List could be hidden and enabled only sfter clicking a button. This way the user could awoid waiting if doesn’t need that list.

---

Please improve policy import/export support adding the possibility to import partial rulesets in a text-file format.

Another thing I miss is more aliases. They will make possible to share rules on the forum or to use a baseline configuration on “foreign” computers.

These Registry branches that contains useful alias I hope V3 will support
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DocFolderPaths

These improvements could make support topics more easy and it could be possible to share pre configured policies.
Future development could also make possible to create a centrad DB to index all those policies.

---

As I used no AV for moths I would like to mantain that light CPU-load usage pattern.

So the options are to manually scan pending file list or enable realtime scanning only when the installation mode is active (possibly only on the installer appchain and related written files).
At the same time I wish to prevent scanning of all applications that have a D+ policy and are not listed in my pending file list (an option to enable my pending file list for other modes would be good)

Maybe this will spare me only few CPU cycles but I see no point to scan the same applications everytime I run them.
IIRC CAVS should already have some kind of features as it was previously reported that CFP3 scan decrease scan time after multiple usage but there is no way to tell was file was just scanned lby Realtime AV ike (eg) avast.

Please ■■■ AV sig DB version to CIS about box

---

Please add a shortcut to CIS standalone Logviewer to Comodo startmenu folder and a logging menuentry (with f+, D+ and AV+ log submenu) to CIS tray icon menu

[system]

@John buchanan post:34

Most of my wishes are already posted. I would add (though) the auto update feature offer options to auto update program files AND signature files. Also this could be further optioned with user selected time of day.

Found virus threats should have the option for a) auto delete, b) auto quarantine, c) wait for user to view and select either delete, quarantine, or ignore (all files user selectable per choice).

From previous posts, CMF and file right click scan have been requested. Both are needed options. CMF should also have its status displayed in the summary screen.

I know you disaprove, but scanning files downloaded (either from a DL Manager or web browser) does have the advantage of catching (known) viruses before any damage can be done. What I am implying is, if a file DL’d is supposed to be a file from a trusted source, one would allow it to run when Defense + asks one’s permission to allow it to run. If it is viral, one now has the potential of a virus running loose in their computer. By scanning when it is DL’d, one might be able to catch that virus before it does any serious damage. You did state different angles of defense is a good thing, and that is what Comodo is trying to provide. This is one angle that needs to be covered. All users/testers that requested it have valid reasons for asking it be included.
This is my reason: this morning I had a viral attack. Strange to me, as the file has been residing on my HD and in memory since last spring (April I think). The program did nothing it seemed, was supposed to be part of another program. Always loaded with the startup software and just sat there silently.
Avast (on-access AV of choice until CIS) never detected it as viral (and I ran several deep scans over a period of time). Three other AV’s never detected it, and Comodo CIS never detected it.
This morning at 7:00am, it went active. It repeatedly made attempts to connect to the outside world. It also damaged a few other (non critical) software files. CIS blocked every attempt to leave (great, as this is what allowed me to discover it). Upon updating (immediately) my Avast signatures, it was spotted in memory and on the HD as viral (Avast discovered both). CIS never picked it up. It was stopped, and completely destroyed from my system.
Granted, known signatures would/did not help, but many other viruses have been discovered from DL scans, and stopped right there before even being granted a foothold of HD realestate.
I do not wish to have any file reside that is viral. What if the infected file was copied and given to a friend. Without knowing it was viral, I would be contributing to the spread (my friend may not have the protection I have). The stoppage of viruses must be from any angle available.

In Memory Scanner is still being built…

& Site Inspection Technology is to be built into CIS as well… But your Post is good. Thanks for the Feedback. :-TU

Josh

[goodbrazer]

I’d like one string from right-click menu to be removed: “configuration”. I guess config is chosen only once in most cases, so there is no much need in this string especially for those used to CFP’s right-click menu.

[attachment deleted by admin]

[fazio93]

will CAVS3 ever have a boot-time scan option? i would really like this.

(CLY)

[Mihai]

The context menu scanning is a must!

[gibran]

CIS realtime and scheduled scan have “Automatically remove threats found during scanning” enabled by default.

To my understanding there are few applications that are potentially unsafe(Applicationunsafe, Riskware, Joke) but they could be nevertheless needed by users.

If possible in order to let the users chose if those apps are going to be placed in CIS exclusion list I wish that those automatic delete options could be disabled by default and the default action would be to quarantine those files.

It would be also useful to provide some additional description about the different categories (eg Applicatiounsafe or riskware) in order to give users the infos they need to make a rational choice.

With those info it could be also possible to modify default behaviour(providing additional options) when a particular category is found.

eg: Only log Joke apps but quarantine Trojan apps.

I don’t know if there are some heuristic categories but I guess it would be useful to let the user know if some app was identified using heuristic in order to let them evaluate the possibility to check those apps using Defense+