App Review 360 Total Security Essential with Comodo Firewall prevention and detection Test

[safe1st]

Hope you all enjoyed the video
Thanks for watching

 

[Der.Reisende]

Now that's a killer combo, @cruelsister is very fond of those 2 AFAIK, thank you for sharing CF configured well you should be able to stop anything, sandboxing by Comodo, plus you have some very aggressive (and noisy...) HIPS of Q360 TS. Plus both are very lightweight.
Thank you for sharing @safe1st!
EDIT: Only some side note (at least on CIS, maybe same behaviour for CF): Turning off the option to exclude the shared folders & Download folders will protect even common script ransomware (.js, .vbs,...) from getting hit by ransomware and from the malware folder getting filled up with ransomware related stuff. Funnily enough, .exe, .jpeg and .txt placed in the malware folder were save in my test?

Spoiler: Comodo Sandbox Discussion Thread

Malware vs Comodo Containtment ! - News / Announcements / Feedback - CIS | Page 2

EDIT 2: What about Avira Free bundled with CF?

 

[Evjl's Rain]

yes, other combos please

How about avast free (fully tweaked with hardened mode) + voodooshield autopilot or zemana pandora

 

[jamescv7]

No question on that combination, definitely the threat has no way to escape since it will undergone numerous layers of protection.

HIPS, mechanistic behavior protection, cloud protection, signatures, and autosandbox.

I think users should satisfy on this setup.

 

[cruelsister]

Safe1st- very nice video, and I thank you for taking the time to do it! But a few things:

1). Malwarebytes is detecting things in the Comodo quarantine folder because of the way Comodo places them there. When the Comodo AV detects something it will quarantine it by changing the file name to some random string and will remove the extension (so it can't ever be run); but it will maintain the file ID (the SHA256). Therefore MB is just doing it's thing of dumb detection- alerting you to a file ID without knowing if the file can be run or not.

This pretty much typifies how traditional AV's work (and why I disklike them so much)- an example would be that you would recognize me if I wore my Black dress, but would have no idea who I was if I wore my Red dress.

2). Comodo with the sandbox at the default Partially Limited will allow malware artifacts to be dumped into Temp, as well as allowing various environmental changes to be made; changing the sandbox level to Restricted or Untrusted would prevent these things (I'll be releasing a video this weekend on just this- and I hope you guys like listening to Chill).

3). Unless you are testing something in the sandbox (or have your browser sandboxed), the Firewall settings should be set to prevent anything in the sandbox from connecting out (just like Sandboxie). That setting will be seen at 2:22 of this video- Check the "Do NOT show popup alerts" and change to Block Requests.

 

[ForgottenSeer 55474]

Thanks for the awesome video!

 

[ZeroDay]

Thanks for yet another great video review.

 

[XxX Legolas XxX]

Thanks for the video !!!

 

[tonibalas]

A very good security combo.
I think i will try it when i have the time
Thanks for the great review @safe1st

 

[Anker_by]

nice test, I'm using Avast Free version with Comodo Firewall is also good and Kaspersky anti ransomware! This on my windows 10 machine yet

 

[Deleted member 2913]

Users who can use CIS/CFW dont need any AV, Comodo Cloud part is enough...light & effective online/offline protection.

 

[_CyberGhosT_]

Seeing VS is a main staple on my system I would love to see any combo that has
VS in Auto Pilot beside any companion other than Q-360
Thanks SF, quality Video as always brother.
I will stop by your YouTube later and deliver Props

 

[cruelsister]

For any that feel the need to pair CF with an AV, note that the only difference you will notice is that the amount of things that Comodo will sandbox is inversely proportional to the quality (and timeliness) of the AV's definitions.

For example, use an AV that is not all that good (like Clam) and Comodo will sandbox a bunch; use something like Qihoo or VS and less work will be done by the Sandbox (less with VS, obviously). But with any combination the baseline excellent protection level will be the same.

 

[FrFc1908]

For any that feel the need to pair CF with an AV, note that the only difference you will notice is that the amount of things that Comodo will sandbox is inversely proportional to the quality (and timeliness) of the AV's definitions.

For example, use an AV that is not all that good (like Clam) and Comodo will sandbox a bunch; use something like Qihoo or VS and less work will be done by the Sandbox (less with VS, obviously). But with any combination the baseline excellent protection level will be the same.

well said there @cruelsister most of us ( I for one ) am just terrible and just got to attached to signature based av's I am having trouble to abbandon them becuase my paranoid mode kicks in : I know that signature based detection is dead end technology , but I do not dare to put my trust fully in ONLY comodo firewall..... maybe your next video will make me change my mind indefinately

@safe1st thanks for the vid as always good job!

 

[safe1st]

Safe1st- very nice video, and I thank you for taking the time to do it! But a few things:

1). Malwarebytes is detecting things in the Comodo quarantine folder because of the way Comodo places them there. When the Comodo AV detects something it will quarantine it by changing the file name to some random string and will remove the extension (so it can't ever be run); but it will maintain the file ID (the SHA256). Therefore MB is just doing it's thing of dumb detection- alerting you to a file ID without knowing if the file can be run or not.

This pretty much typifies how traditional AV's work (and why I disklike them so much)- an example would be that you would recognize me if I wore my Black dress, but would have no idea who I was if I wore my Red dress.

2). Comodo with the sandbox at the default Partially Limited will allow malware artifacts to be dumped into Temp, as well as allowing various environmental changes to be made; changing the sandbox level to Restricted or Untrusted would prevent these things (I'll be releasing a video this weekend on just this- and I hope you guys like listening to Chill).

3). Unless you are testing something in the sandbox (or have your browser sandboxed), the Firewall settings should be set to prevent anything in the sandbox from connecting out (just like Sandboxie). That setting will be seen at 2:22 of this video- Check the "Do NOT show popup alerts" and change to Block Requests.

For any that feel the need to pair CF with an AV, note that the only difference you will notice is that the amount of things that Comodo will sandbox is inversely proportional to the quality (and timeliness) of the AV's definitions.

For example, use an AV that is not all that good (like Clam) and Comodo will sandbox a bunch; use something like Qihoo or VS and less work will be done by the Sandbox (less with VS, obviously). But with any combination the baseline excellent protection level will be the same.

Thank you @cruelsister
This test was requested and the setting for this test.

and thanks everyone