Comodo Internet Security
Version 12.2
English
Containment - An Overview
- Comodo
Internet Security's container is an isolated operating environment
for unknown and untrusted applications. Comodo
has built automatic containment of unknown files into the
security architecture of Comodo Internet Security, complementing and
strengthening the Firewall, HIPS and Antivirus modules.
- Applications
in the container cannot make permanent changes to other processes,
programs or data on your 'real' system. They are executed under a
carefully selected set of privileges and write to a virtual file
system and registry instead of the real system.
- After
an unknown application has been placed in the container,
CIS also automatically queues it for submission to Comodo Cloud
Scanners for automatic behavior analysis.
- Firstly,
the files undergo another antivirus scan using the very latest cloud
blacklist.
- If
the scan discovers the file to be malicious then it is designated as
malware and the result is sent back to your installation of CIS. The
local black-list will also be updated.
- If
the scan does not detect that the file is malicious then its
run-time behavior will be tested by Comodo's Instant Malware
Analysis (CIMA) servers. If CIMA finds it to
be malicious then the file is manually analyzed by Comodo
technicians to confirm it as malware.
- If
confirmed as malware, the executable is added to the global
antivirus black list. The 'malware' verdict is sent back to your
installation of CIS and the file will be quarantined.
- This
process delivers the perfect balance between usability and security
for unknown files. Unknown applications can run 'normally' in the
container but are denied any opportunity to damage your computer or
access your data.
