I upgraded my Windows and thus enabled Training mode for a reboot. After the reboot I thought now CIS/D+ learned what to whitelist. Well it did not and I was unable to login anymore because the HIPS simply blocked everything.
I had to boot into safe mode to disable CIS from starting.
I now need a way to edit the CIS configuration (where is it?) without starting CIS, because if I did that my PC would be bricked.
Thank you
Might be easier to just uninstall CIS in Safe Mode and then re-install it. The preset configurations are in the Comodo Folder under Program Files. You can try running it in Safe Mode and see if it’ll allow you to activate one of the other configurations.
Will that delete my custom configuration?
I found this in the registry: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CmdAgent\CisConfigs\0\HIPS\Settings maybe Mode is the, well, mode? I have it at 90efffe which I assume is Paranoid Mode. Could someone verify by changing their settings and seeing if that changes the key? If so, please give me the Training Mode key. Thank you.
This key exists multiple times in CisConfigs\0\HIPS to CisConfigs\3\HIPS. No idea which is the correct one.
I don’t have first hand knowledge of the registry keys myself. See if CIS will run in safe mode and then if you can, adjust the HIPS settings from there or at the very least save your configuration before swapping over to Proactive or Internet Security and then rebooting.
Regarding HIPS, might be a good idea to put it in training mode or create rules for safe applications initially if your running that tight of configuration. Safe Mode works fine and less hassle, particularly if you have Containment enabled,
Ok I got it working. Seems you cannot access those regkeys while CIS is running, so looking up the correct value would be hard anyway.
For whatever reason I lost all my HIPS rules though -.-
That seems to be the case indeed.