The discussions on HIPS (including D+) center around how a user tells whether a request (to write to a disk, for example) for an unknown program should be allowed or not. There are various approaches to this, including whitelists which show what known programs might do, but it basically up to your knowledge of what programs should be doing on your computer at the current time because of the "zero day" problem. The fact that there are often lots of things going on in the background (like updates, etc.) further complicates the ability to do "situational awareness". Behavior blockers, for example, attempt to characterize sequences of these activities that might be indicative of malware, rather than depending on you not to hit "allow and remember" and having you do the characterization manually. And whether a program is known or not can be complicated by names like comodoa.exe or or svchst.exe being used by malware. Most of the time all of the popups are indeed harmless, which tends to lull the user into a sense of complacency. And remember that only a small percentage of the users of a security program even frequent forums like this and worries about problems like this, and so there is a large population of soft targets out there if much interaction is required. An AV (like Avast!) indeed only solves a percentage of the problem, but when it does there is a large "THIS IS A VIRUS, DELETE OR QUARANTINE IT" sign that almost all users will understand, rather than a "c0modo.exe wants to ...".
My comment to Patrice58 was just that when I looked at his reference, there seemed to be one attempt to answer his questions, and several postings that were simply affirmations of faith about the Comodo AV claims for the future. Maybe there will be more help later?
