No way to untrust a program in Comodo?

I like how Comodo trust almost everything in my computer with Cloud scanner or sth. But there are times when I need to untrust the trusted programs by Comodo so I can set custom rules to them, which I think is an essential part of an HIPS program.

However, I can't find a way to do it.

If I manually remove a program from the "trusted files" list, next time you run the program it will be added in the trusted again automatically. And your custom rules set to the program don't work at all because "trusted group" rules override.

Is paranoid mode the only answer? But I'm not that paranoid... I only want to untrust a few.

 

Currently i have CIS uninstalled, but you can deactivate the auto trusting features in Defense+ settings (Just ready carefully all boxes).
And yes you can block programs, i just can't tell you how since i don't have the program for reference

BTW, nice choice! CIS HIPS and Firewall are really good!

 

I'm pretty sure the option "create rules for trusted applications" Is what your looking for. That way, You can modify them later instead of being in the background.

 

Thank you for the reply, Kyle1420. I thought that was what I was looking for.

I tried turning on that option ("creat rules for safe applications"), but even though you are now able to see and modify the rules for each safe application, the "ask" function does not work. Comodo will not ask you when you set it to ask but automatically make its own "trusted group" rules again. So it does not work like "untrust".

So I'd like to block this one, but which activity should I block then. Tried blocking "DNS client service", but it's not working.

 

change the FW to Custom policy

 

Uninstalled Comodo already... This is like the 3rd time I give up on it.

I will go and try PF, PCT, OSS then. If none satisfies, I will go back to OA again.

 

"create rules for safe applications" is not what you want. That will only fill your ruleset/registry with unnecessary rules. I'm on my other system now w/o Comodo, but I think if you disable cloud lookup it won't reset the program to trusted after you untrust it.

Why don't you disable the auto sandbox? I don't use it. OA is the only thing that has anything like it so the other programs like PF and PCT aren't exactly a replacement.

 

I think the only way to keep it from getting trusted over and over again, is deselecting both Cloud options in the D+ settings.

 

I guess disable cloud lookup is the only way, I'll have to tolerate more pop ups though.

I like the idea of sandbox in Comodo. I didn't try it, but auto sandbox everything is not for me.

Currently I'm happy with PF. I'm not a paranoid user, but want to be able to tweak a few behaviors of my programs.