[Resolved]Defense Plus log entry

mitchell64 · January 7, 2011, 2:13am

I have been a user of Comodo Firewall for 3 years now but only just started using Defence+ yesterday.
I think i have pretty well got it sorted but wanted confirmation that i have interpreted some log entries correctly.
I found the relevant post in the forums FAQ

'Access memory' event log entries - how can I suppress these? [v5] - Defense+ / Sandbox FAQ - CIS - Comodo Forum

These are the log entries

2011-01-07 09:10:44 C:\Program Files\Malwarebytes’ Anti-Malware\mbam.exe Access Memory C:\Program Files\Comodo\Comodo Internet Security\cmdagent.exe
2011-01-07 09:14:05 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Access Memory C:\Program Files\Comodo\Comodo Internet Security\cmdagent.exe
2011-01-07 09:14:19 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Access Memory C:\Program Files\Comodo\Comodo Internet Security\cfp.exe

If i am reading this correctly Comodo has blocked SAS & Mbam from scanning Comodo’s memory space (in other words Comodo self defense mechanism is in play)

I really just after re assurance that i am understanding this correctly

Jacob · January 7, 2011, 2:35am

Yes; you are correct;

Jake

mitchell64 · January 7, 2011, 2:37am

Thank you very much Jake, your response is appreciated

Jacob · January 7, 2011, 2:38am

Your Welcome;

Any other questions?

Jake

mitchell64 · January 7, 2011, 2:42am

I assume it is probably best left alone, i don’t feel a great need for SAS & Mbam to be scanning what Comodo is trying to protect ie Comodo memory space

Citizen_K · January 8, 2011, 5:34pm

It is best to leave this alone. As each program you allow to access CIS in memory is a breach of its self protection. Suppose the allowed file gets infected then the malware could try to attack CIS.

Only when an application is not functioning properly without having memory access, which seems a bit of a questionable design practice to me, you should allow it.

mitchell64 · January 9, 2011, 9:04pm

Thank you for your response Eric it is much appreciated, i thought this was the case just wanted assurance that i was on the right track. HIPS is all very new to me but i think i am getting my head around it

Thank you again Eric & Jake for your help

Jacob · January 9, 2011, 9:34pm

Any thing else we can help you with?

Jake

mitchell64 · January 9, 2011, 10:45pm

No thanks, i think i have all my queries covered for the time being

Jacob · January 9, 2011, 10:47pm

Ok
If any other issues or questions please dont be afraid to ask;

%lock%

Jake