comodo有没有文件校验功能？

显示全部楼层 · 发表于 2016-5-13 11:19:01

最近在测试jetico，里面有明显的一项是校验程序的hash；不知道comodo是否默认校验还是不校验？

显示全部楼层 · 发表于 2016-5-13 11:45:40

我感觉它不检查规则文件是否修改；ssf会提示修改

显示全部楼层 · 发表于 2016-5-13 12:22:22

布吉岛！没玩过这个= =
我只是觉得偶尔不按照规则办事，抽！

显示全部楼层 · 发表于 2016-5-13 14:05:35

我只知道他們論壇上報只能提交HASH1....

显示全部楼层 · 发表于 2016-5-13 17:22:22

没有

显示全部楼层 · 发表于 2016-5-14 22:21:15

本帖最后由 Candygu 于 2016-5-14 22:24 编辑

其实是有hash校验的，可以从两个地方看出来。

1、自动沙盒设置里，可以根据File hash和process hash设置规则。

2、官方帮助文件里有这么一段描述：

Files and processes that pass the security inspections above but are not yet recognized as 'safe' (white listed) are 'Unrecognized' files. In order to try to establish whether a file is safe or not, CIS will first consult Comodo's File Look-Up Server (FLS) to check the very latest signature databases:
• A digital hash of the unrecognized process or file is created.
• These hashes are uploaded to the FLS to check whether the signature of the file is present on the latest databases. This database contains the latest, global black list of the signatures of all known malware and a white list of the signatures of the 'safe' files.
• First, our servers check these hashes against the latest available black-list
• If the hash is discovered on this blacklist then it is malware
• The result is sent back to the local installation of CIS
• If the hash is not on the latest black-list, it's signature is checked against the latest white-list
• If the hash is discovered on this white-list then it is trusted
• The result is sent back to local installation of CIS
• The local white-list is updated
• The FLS checks detailed above are near instantaneous.
• If the hash is not on the latest black-list or white-list then it remains as 'unrecognized'.

显示全部楼层 · 发表于 2016-5-14 22:28:30

Candygu 发表于 2016-5-14 22:21
其实是有hash校验的，可以从两个地方看出来。

1、自动沙盒设置里，可以根据File hash和process hash设置 ...

這是beta版的CIS 10?

显示全部楼层 · 发表于 2016-5-15 21:29:10

諾言敵不過時間发表于 2016-5-14 22:28
這是beta版的CIS 10?

CIS 9 beta.

[求助] comodo有没有文件校验功能？

本帖子中包含更多资源