Using third party firewall instead of Windows Firewall

Its simple. He showed Cruelsister settings. He launched some malware to confirm its working as intended. Then he cleaned sandbox. As he launched the final malware (the one he was trying to show), comodo did not contain it for whatever reason and everything got infected. Bam. Also, Restricted is the 2nd lowest elevation allowed. Unrestricted is the lowest, with literally nothing allowed, but then almost nothing works, so I think Restricted is fine for sandboxing.

 

https://malwaretips.com/threads/comodo-sandbox-restriction-s-levels.54050/

 

Paging @cruelsister

 

Now I wonder how Spyshelter free firewall would perform against it.

Uh, oh. Now I feel the neuroticism and paranoia building.

 

Hehe that was my goal ;d

 

Yo guys can someone message cruelsister on malware tips or wherever, she might not come to wilders for weeks or who knows how long

 

LOL.......Won't happen. Paranoia and the Internet are not compatible. You can see it here and on MalwareTips. People have their computers so loaded with security software, trying to plug every tiny hole, I'm surprised the machines work.

 

I tried messaging her over there. Wouldn't let me. Either something screwed up on my end, or she has messages turned off.

 

you tried here?

Code:

https://www.wilderssecurity.com/conversations/add?to=cruelsister

so true
https://www.wilderssecurity.com/threads/what-is-your-security-setup-these-days.111264/

 

Hi Guys! I am familiar with the video in question and confirmed at that time that what occurred was not reproducible. CF will contain such unsigned executable trivia like this trojan downloader quite readily at any containment level, so why it was not contained immediately in the Authors video one can only speculate.

But for those venturesome enough to confirm/deny what was done in the video the malware used is well known and available from the usual sources:
(MD5 8d01c393b5663644f7c787ca03662cd7).

I certainly have nothing against valid videos demonstrating security products being breached, but I assure you this was not one.

 

yep, sometimes, **** happens..

 

When this file is run it will spawn a daughter into AppData/Local, set up a startup entry pointing to the daughter, delete itself, and then the daughter will connect out initially to Paris, then other nastier places (like California).

The firewall of CF blocks outbound connections, the daughter is contained in Local as is the Startup link in Roaming; these will be deleted on Containment flush or on reboot. Nothing real special here.

 

Hey CS, do you still use comodo firewall? Any point of using the av with it? Asking for my grandma

 

The last place I want my laptop connecting is to California. I wasn't sure whether your video was in regards this one or the other alleged breach, or whether they were the same nuisance in two different videos. Thank you for clearing it up.

 

Floyd- Yes, I do. Still haven't been able to bypass it and God Knows it is not for the lack of trying. But for those that want a nice complement to CF, WVSX provides protection that is additive and will result in a combo less confusing for newbies (and Grandma).

 

indeed!

 

I've got WiseVector on this thing. Right now, fooling with Spyshelter free Firewall/HIPS but no doubt will be back with Comodo. I keep the latest offline install version on an external drive. I like the containment feature, which is also nice for trying out new software as well as providing protection.

 

LOL, this does indeed remind of the good old days.

Don't you find the alerts annoying in SS Free? It's a pity you can't disable them.

 

The first day was very annoying. They've settled down since. Still get them, of course, when I open a program I haven't used since installing SS. At least it shows me SS is working.

 

Yeah, no. You've just lost A LOT of credibility here @ wilders.

 

Thank for for confirming, cruelsister

 

Hi @ Wilders

Just installed TinyWall 3 in Win 10.

I am wanting to find out whether Windows Firewall is better switched off or left on with TinyWall.?

The only thing I can find from their web site is this:-

"With the exception of Windows Firewall, no other firewall software should be active while TinyWall is installed. This includes standalone"

For me, this doesn't answer my question, any help would be appreciated.

Thanks

Terry

 

Yes, that's why I decided to go for SS Firewall because you can disable certain stuff, to minimize alerts. On the other hand, if you put it in "medium mode" it may allow too much, it's a pity that you can't manage the whitelist.

I believed this was already explained in the TW thread, you know in the little discussion that I had with Ultim? Basically he said that it's best to leave the Win Firewall enabled. What this means is that incoming connections will be blocked by both TW and WF and outgoing connections will be managed by TW. And in order to avoid any problems it's best not to install Win Firewall Control (from Malwarebytes), unless you know what you're doing.

 

Hi Rasheed187

Thanks for that, I'd missed it.
It was, after all, a pretty verbose section of the thread.

Terry

 

G'day ; just wondering if windows firewall hardening tools have been compared and tried vs the comodo firewall setup you use @ cruelsister. Personally that is what I use but I have found it blocks allot of native windows updates etc. I have uninstalled it for grandma because there seems to be issues every time windows auto updates or the antivirus updates. So the question is does simplewall, tinywall or the malwarebytes binisoft make a good alternative to the comodo wall setup and is it effective enough. I have not seen any in depth reviews on this other than people showing the different levels of firewall profile settings of "low", "medium" and "high" on these windows firewall configuration tools.