COMODO DiskShield Version 1.0.1.18 - BETA Released

Still not got the added "keep changes on reboot" feature but its heading in the right direction!

http://forums.comodo.com/comodo_dis...eld_version_10118_beta_released-t24713.0.html

Following are changes:

* ADDED: Protection against RAW disk access
* ADDED: An application cdsdsbl.exe, which can be used in Windows Safe mode to disable CDS. This is done, in case you are not able to boot due to CDS.
* IMPROVED : Cache management. Now it automatically uses empty space in disk. User does not have to bother about it.
* IMPROVED : Crash handling, it would generate crash-dump, which can be sent to us for crash-analysis, if any
* FIXED : Startup issues in Windows Vista.
* FIXED: User reported BSODs and crashes.

 

What is this?
some shadowing/virtualizating app from comodo?

 

Yup, similar to Shadow Defender, Returnil etc. only free (and in beta). Previous version here: https://www.wilderssecurity.com/showthread.php?t=211523&highlight=comodo

 

According their forum, Comodo DiskShield wants to become the best virtual ISR-software. I'm looking forward how they are going to beat the best ISR-software.

 

erik i'd just be happy if they do two things :

1) defeat "robodog" type threats that defy most current virtualization isr's

2) give you the option of selecting certain folders that you can save to even with the protection running

 

There is still more betas to come. More features, etc will be added into future CDS beta builds. Still bug fixes to do

Josh

 

Wow Comodo Never Ceases To Impress!

 

Well, I want more than this and certainly not a clone of Returnil or ShadowDefender or a combination of both, that would be the same as the n'th scanner.

 

i understand erik, but apparently stopping the "robot dog" type malware is easier said than done.

over on the comodo forums, there's already a thread of a program (bypassdisk.exe) being able to wreck a partition being protected by the latest version of comodo diskshield!

 

These are all unauthorized executables, peanuts for AE or similar softwares.

 

Very true Erik.

My quest is to pretend there are no apps like AE or even a HIPS to intercept these types of MBR breakers, but rather a one-click hardening tool who's only purpose is to alert to this or others and give a user the option of denying while IMMEDITELY TERMINATING it or allowing it to fudge the MBR and write junk to disrupt the partition table.

EASTER

 

I would agree with such a tool also and I'm only astonished, that it doesn't exist already.
I can't even find a script blocker with artificial intelligence to block any script with destructive commands in it, unless it's authorized. What is going on in the security industry are they sleeping or too busy with creating the n'th scanner ?

 

I believe exactly the same. It's almost like Vista is caused all this rift for current satisfied XP users in some attempt to disuade us away to it, and personally vista doesn't make the grade as a viable better alternative and can't be.

I recall the Windows 98 days when makers and freelance freeware developers would throw together small individual apps that went a long way in covering certain problem areas, why can't the security industry or freelancers come up with the same.

I repeat my frustration over AnalogX's ScriptDefender, a fantastic script middleman or interceptor where you can add your own choice of 3 letter extension associations at will, but when you go to uninstall those associations are not all return to defaults. I'm using it again ONLY because i took all night to gather up as many reg files as i could find from Doug Knox's site and Kelly's so that when i do ever uninstall or replace it for something better i'm not left with associations that don't work anymore.

Now, on COMODO's DISK SHIELD.

It's always good to find another option with features maybe better suited for different user's taste, and i hope they finalize a useful end product sometime soon, but in the meantime Returnil and/or Power Shadow is what i choose to serve that purpose.

EASTER

 

Perhaps if you took a nanosecond away from your seeming anti-scanner obsession, you might figure out that there really aren't "destructive commands", only normal commands employed in a malicious context.

What you are seemingly asking for is an automated tool that assesses underlying intent. Do you really believe that's generically feasible in a heterogeneous software environment?

Blue

 

Any script that wasn't there during the installation, doesn't belong in my system and needs to be blocked. I don't need the good scripts and I certainly don't need the bad scripts, because my system is already working properly without the good and the bad scripts. Is that good enough to you ?

 

Not sure anyone has bothered or even has the resources to perform such a task like AE employs but that shouldn't matter. Script Sentry is way too limited regardless of how well it works, and Script Defender (My Fav) allows me to add even the most unorthodox of file extensions like maybe a edf file, and if i use notepad to create, save, then try to run it, SD will flag that extension on-the-mark. I guess thats what makes it my script protector of choice in spite of it's uninstall glitch.

COMODO DiskShield is completely new to me and i don't intend to even toy around with it for some weeks yet, but it remains to be seen what they have up their sleeve with this new program.

EASTER

 

Once again we are completely OFF TOPIC-this is about DiskShield not AE etcetc.

Can we NOT offer opinions or baseless suppositions until we have actually tested the software,or are better informed.

Back on topic

Previously tried it and it was evidently buggy.
Now a short test indicates it really has improved.

DiskShield is of course a virtualising software similar in concept to Returnil.

Theoretically,you should be able to perform software testing with these apps,but the weakness has been that any app which requires a reboot to install properly couldnt be tested,as the virtualiser automatically disabled upon reboot,taking the app to be tested with it.

However DiskShield,stays enabled ,even after reboot,until actually disabled .
So far-software can indeed be tested .

The controls are quite simple and intuitive-mem. usage is only 3000k and different drives can be selected for protection.
After a disabled reboot and the tested app has vanished-I couldnt find any trace of it.
Ideally more than one drive should be selectable,as in my case ,the apps generally can be installed to a different drive to the system C
When this is done,the apps contents remain even after disabling.

Weaknesses in a very short test-initially slow to load installed apps-the desktop splash screen is arguably horrible-
Otherwise well worth checking out,especially in view of its software testing capability.
Unless something bad happens -will keep

EDIT: FURTHER TESTING NEEDED about the retention of apps that need a reboot!!!

It certainly works extremely well with the testing or removal of software that doesnt require rebooting.

The GUI is clean,simple and logical.

Not able to perform a security test-so any one using for this should not install-apparently there are some holes.

 

Well, trouble is many members are quick on the draw to jump on betas and in case anyone didn't know it, BETA in Latin means, "doesn't work yet".

You'll just have to sit in wait as they continue to gather incoming reports from beta testers and confirm then readjust where needed as they progress along with this new introduction.

But i'll repeat again, it's nice to see another new entry in this field just like any other security app which compiles in different makeups of what they intend to fashion as the end result, and all that takes time.

LOL

 

Easter,

Some betas are perfectly acceptable and UNTIL the person posting has ACTUALLY TESTED ,they are not qualified to comment ,other than third hand info.

If the topic was "Are Betas safe etc" then it may be fair comment,but the thread is about DS,not Betas.

 

It's a toss up. Some betas are more stable and closer to finalization then others, thats a given. And beta testers are the one's who are best qualified to comment on their results without a doubt.

DiskShield is currently in beta, and that is what it is. It's not a matter if it's safe to try or not, it boils down to is it safe enough for your system to run on. Well, if you use VM's or a disk that can be easily restored by an image should the worse happen, then you are no more worse for wear.

But, i will repeat again, it's nice another new virtual system is entered the scene, and the end results remain yet to be seen whether or not it possesses better features or is easily more compatible with the rest of a user's security strategy.

 

Referring to my previous post,unfortunately,DS CANNOT be used for the testing of software which requires a reboot,in the sense that the app will vanish upon reboot.

Even though DS remains enabled throughout-Windows of course boots prior to DS,so the app. is lost during that gap.

Ah well back to the drawing board-looks like this may be impossible to achieve.

Will still keep as I haven't struck any bugs and the general approach makes it possibly the simplest to use,just on demand.

However it seems there may well be security holes so dont use yet for security-I just want it for testing.
It does seem this may be a Beta for testers rather than for the general public!

As I commented -the testing of non reboot software can be achieved very easily.
Actually, even most reboot to install apps could also be tested as most will function even prior to rebooting-just that they will require a reinstall afterwards
Just tested one and left a horrible mess all over the desktop-files galore.
A reboot everything is gone!

That horrible splash screen can also be turned off.

 

That horrible splash screen is no doubt the price we pay for a free product, some are far worse then others unfortunately.

I think you're squarely on-target for the feature i been waiting on myself. Like you hinted at, it must be too difficult to impliment with this Kernel and system, but one day i look for that to be a reality.

At least we have sometime new to wet our feet on when finished, but i just hope they raise the bar above others enough to gather up interest in making it desirable like Returnil did when they first came out with their virtual system.

You sure can't blame COMODO for lack of pushing the envelope though. Looks like they're going after a whole group of programs that's drawed a very large audience and some popularity.

The key is let it all hang out, and build or duplicate everything thats already showed itself interesting and useful.

EASTER

 

I believe the reboot feature will be enabled by beta 3 (the next one) according to the COMODO forum.

 

Good find ,rendez2k-and lets hope so about the reboot issue

 

Watch out returnil .