Comodo's white-list database

[Endymion]

@OmeletGuy post:18

let me test that

EDIT: seems one of the files droped are on the safe list but the exe’s arent, so in a way it still bypasses the defualt config.

Not sure what you intended to test but I guess you could at least mention what “droped” are on the safelist.

What I asked was if you check if those apps perform the features they are advertised for or if they are fakes.

Including applications that perform the intended function but are deemed “not efficient” in a new rogue category would be a slippery route as Windows itself come bundled with streamlined apps far less efficient than certain freeware alternatives.

[Endymion]

@ssj100 post:19

That’s interesting. Does this mean Comodo could make a mistake and add a eg. rogueware to the white-list? If it’s added to this safelist, does this mean Defense+ will not give an alert when it’s run?

I guess this mean that some people at wilders assumed so because the proactive config you tested is able to control installations whereas the test was carried using the Internet security config which do not include executable extensions in protected files lists.

[who_te_fuc]

@ssj100 post:19

That’s interesting. Does this mean Comodo could make a mistake and add a eg. rogueware to the white-list? If it’s added to this safelist, does this mean Defense+ will not give an alert when it’s run?

probably possible… I wouldn’t go around worrying about it thou… Even if a file is added to safe list you still have to get the file to get infected… stay with safe known download sites… don’t open that love mail from that hot chick you never heard of… :-TU ;D

@ssj100 post:20

Also, does this mean the daily updated safelist is being communicated to every CIS user? If so, could there be an option to enable/disable this in future releases? Also, could there be an option to ask the user if he wants his safelist updated or not?

I didn’t realise that the safelist was being updated behind my back haha! By the way, is the safelist stored “in-the-cloud”? Or does every user who has installed CIS on their computer have a (safelist) file that is continually being updated?

Threatcast is in the cloud… The whitelist is not… It would not function when your disconnected if it was online stored… The easiest way to avoid CIS auto allowing stuff good stuff is by choosing paranoid mode with trust softwares digitally signed by software vendors turned off and set the firewall to custom policy… This will leave all decisions to you and you will get more popups…

But any rules you already had prior to this will not generate any alerts and will be keept… Untill you manually go and alter them… O0 :-TU

• Even in paranoid I think alerts will use the white list to the extent that they will tell you “blabla.exe is a safe application bla bla bla bla…”… but you can ignore the info and still block if you like… =)

There is ways to stop CIS from updating altogether as well but probably not recommended…

[Endymion]

@Monkey_Boy=) post:23

probably possible… I wouldn’t go around worrying about it thou… Even if a file is added to safe list you still have to get the file to get infected… stay with safe known download sites… don’t open that love mail from that hot chick you never heard of… :-TU ;D

Probably is more easy to hint at that scenario disregarding Comodo continued efforts. :-\

Regardless if rogue was usually meant for fake applications whose malicious action was none other than the fraud itself.

In case an user is assumed to be unable to recognize the fraud the AV detection could actually make them aware.

Whereas a new rogue category introducing efficiency criteria would paradoxically include applications like notepad, calc, sound recorder, paint, wordpad and other windows apps which are far less efficient than other real software it is not that an AV could potentially be used as an unmanned software review.

[JoWa]

@ssj100 post:20

By the way, is the safelist stored “in-the-cloud”? Or does every user who has installed CIS on their computer have a (safelist) file that is continually being updated?

There is a “master Comodo safe list”:

The Lookup… button allows you to check for information on the files by consulting the master Comodo safe list, Select the file(s) you want to check and click the Lookup… button. This will contact Comodo servers to conduct a search of Comodo’s master safe list database to check if any information is available about the file in question. If no information is available, you are presented with the option to submit them to Comodo for analysis:
(Help file)