COMODO Internet Security 3.5.56968.437 released

Another "reveal".

Let us take DuplicateHandle test. CLT.exe opens csrss.exe with the access mask PROCESS_DUP_HANDLE. Then it duplicates this handle without requesting additional access. So, all CLT can do with csrss.exe is nothing, but handle duplication. This is just crazy to block such harmless things and this has nothing to do with real malware. Another misleading PR test to show how "cool" CIS is hoping that the users are ignorant and do not understand how system does work. I hate such dirty tricks ..

 

I guess we all have opinions!

 

When it comes to API opinions do not matter, only the facts and tech docs do.