I came across a morph malware. Silly enough, I ran it to Test the AV if it was detected, and more specifically… Defense+. I wasn’t thinking about Memory Firewall, I know Memory Firewall is in D+, Anyway… But when I did save and run it, D+ immediately alerted me of a BO Attack! I then terminated the morph malware.
This is only one example… But this is why you do need Buffer Overflow Protection, And Comodo is the very to few to have this protection built it! Melih dosen’t give out research info for the sake of it, It’s just a proven fact that BO attacks are so common, even though you may NOT realize it - it is. If a user just had an AV on there machine, they will be infected just because there was no signature for the malware/Buffer overflow attack, Time to change to Prevention, And yes Memory Firewall is also prevention too!
It is still active when D+ is software disabled by the slider but I’m not sure it’s active when D+ is permanently disabled. I’ll see if I can find out and post back here.
However if that application was to be in a BO attack again, you would get a new alert as long as “skip this application in the future” is NOT checked…
then you would manually have to remove that application from the BO protection list to get an alert for it…
(you find that under D+> advanced > image execution contrl… > exclusions…
Anyway, this is why CIS is building a “cure” also, to let you if you accidentally let something run, or intentionally since you think the application is good, heal the infection and the potential harm it might have coursed…
Of course the BO would run, I didn’t say anything contrary. Nevertheless D+ will catch the malware because of it’s behavior, e.g. modifying other processes and so on…
