How do I treat all the applications in a folder EXCEPT ONE in a particular way?

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
1

Let’s say I have the folder C:\Stuff\Programs and I want to add a rule for everything in there to behave in a particular way. I’d do this in D+:

C:\Stuff\Programs* - Funky Application

What if I want to treat ALL BUT ONE program in that manner WITHOUT MAKING RULES FOR EACH INDIVIDUAL PROGRAM in \Programs?

Let’s say I want to treat C:\Stuff\Programs\blacksheep.exe as a Weird Application while still treating the rest of C:\Stuff\Programs* as Funky. How do I do that? Can I simply add the rule for it after the Programs* rule?

2

Placing the specific rule above the general rule in D+ rules should work. But please note the * applies to subdirectories too.

More guidance on issues like this in the FAQ: File specification inc the use of wildcards in CIS.

3

So if my D+ list looks like this, in the following order:
C:\Stuff\Programs\blacksheep.exe - Strange Application
C:\Stuff\Programs* - Funky Application
Then COMODO will stop at the first entry and not process the next one?

4

If you launch blacksheep, yes.

And assuming there are no other contradictory rules above

At least that’s what should happen

Remember Programs* has a different effect to Programs*. Your version is correct, but CIS gives Programs* by defailt. The default version would trigger for C:\stuff\Programs1.exe [edited]

Best wishes

Ba Ba

5

I’m aware of this and it honestly bothers me. When Comodo started replacing all the rules of the type “Program Files*” with “Program Files*”, I immediately changed them back because I realized anyone can make a “Program Files.exe” that can piggyback on the rule.

6

Yes the parsing of the strings containing asterisks is logically correct, but the interpretation of the user selection of a directory as an asterisk without a preceding path divider, is not, IMHO.

Best wishes

MOuse