Comodo Cloud AV -- only 3 MB--- with full containment and sandboxing included

[Janl92l]

Source: Comodo Cloud AV -- only 3 MB--- with full containment and sandboxing included - News / Announcements / Feedback - CIS


This seems to be interesting. pure cloud av and a auto sandbox and only 3 mb,the folder is only 7, something mb.

 

[Moose]

Salutations, Friends!

> Wondering if Comodo Cloud AV will work with AV's?
> Also, will it be as light as Webroot?
> Cleaning abilities? Detection? Protection?

 

[Deleted member 178]

And another potential "powder in the eye" product...

 

[Kardo Kristal]

> Wondering if Comodo Cloud AV will work with AV's?

@Moose Siketa asked: Is it going to be compatible with another AV on PC?

and Melih answered: yes

You can find question and answer from here.

Regards,
Kardo

 

[Alex BK]

And another potential "powder in the eye" product...

I was thinking exactly the same. Their product line and performance in general is going down hill.

 

[Sven]

Comodo is not a detection-depended antivirus solution, it's more of a prevention one. That makes me wonder, how Comodo will act now. Two different softwares at the moment ; CIS and Cloud. One depends on cloud (this one) and other one (CIS) on... hmmm.. what the heck?! Why they did not implement the Cloud feature to CIS already and put more trust and efforts into their already well-known product?

 

[jtshadow92]

Possibly they're trying to compete with Panda and Webroot?

 

[Deleted member 178]

Yes old CIS were bloatless, extremely light and focused on security aspects. Now CIS is full of fancy fluff and useless features.

I hope v9 is not just v8 with a new skin...

 

[Av Gurus]

There is already cloud componenet in CIS:

Perform cloud based behavior analysis of unrecognized files – When checked, any file that is marked as unrecognized and is sent to the Comodo Instant Malware Analysis (CIMA) server for behavior analysis. Each file is executed in a virtual environment on Comodo servers and tested to determine whether it contains any malicious code. The results will be sent back to your computer in around 15 minutes. Comodo recommends users leave this setting enabled (Default=Enabled).

More details. The behavior analysis system is a cloud based service that is used to help determine whether an unknown file is safe or malicious. Once submitted to the system, the unknown executable will be automatically run in a virtual environment and all activities, host state changes and network activity will be recorded. The list of behaviors recorded during this analysis can include information about processes spawned, files and registry keys modified, network activity, and other changes. If these behaviors are found to be malicious then the signature of the executable is automatically added to the antivirus black list. If no malicious behavior is recorded then the file is placed into 'Unrecognized Files' (for execution within the sandbox) and will be submitted to our technicians for further checks. The behavior analysis system takes around 15 minutes to report its results back to CIS. If the executable is deemed a threat then it will be automatically quarantined or deleted. This threat report is also used to update the global black list databases and therefore benefit all CIS users.

Automatically scan unrecognized files in the cloud – Selecting this option will automatically submit unrecognized files to our File Lookup Server to check whether or not they are on the master Comodo white list or black-list (White list = files that are known to be safe. Black list = files that are known to be malware) and the files are rated accordingly. The important features of the cloud based scanning are:

• Cloud based Whitelisting: Safe files and trusted vendors and trusted publishers can be easily identified;
  

• Cloud based Antivirus: Malicious files can be detected even if the users do not have an up-to-date local antivirus database or a local antivirus database at all;
  

• Cloud Based Behavior Analysis: Zero-day malware can be instantly detected by Comodo’s cloud based behavior analysis system, CIMA.
  

The cloud scanning, complemented by automatic sandboxing and application isolation technologies, is very extremely fast and powerful in preventing PC infection even without a traditional antivirus signature database while keeping the user interaction at minimal levels.

Comodo recommends users leave this setting enabled (Default = Enabled).

 

[jtshadow92]

Yes old CIS were bloatless, extremely light and focused on security aspects. Now CIS is full of fancy fluff and useless features.

I hope v9 is not just v8 with a new skin...

eh, I think we all know what's coming at this point.

 

[Janl92l]

There is already cloud componenet in CIS:

yes but not fully functional like the new one. valkyre and other components are implemented with this cloud av. so the detection rate will be much more higher than the normal cis at this time.

 

[Andrew999]

yes but not fully functional like the new one. valkyre and other components are implemented with this cloud av. so the detection rate will be much more higher than the normal cis at this time.

that's great I hope the detection will be a bit better then. I like good detection even though people say it is not the most important thing in a antivirus program.

 

[Atlas147]

A cloud based AV is useless without good cloud signatures

 

[hjlbx]

Cloud AV I think Melih is serious about it... I think Melih is in the process of building a malware database system that will compete with Virus Total. I have no official confirmation of this. My statement is just based on what I have seen over the years, especially the last two years...

Why even worry about detection when Comodo can be configured to either contain and\or block any Unrecognized files ?

With correct settings CIS will behave exactly the same as the AppGuard + Sandboxie combo. All the additional CIS block settings are simply more layers of protection (e.g. Block by HIPS, Block by Firewall) beyond the sandbox.

The only way a malware is going to get past CIS configured for anti-executable is if:

1. The file completely disables CIS; or
2. The user allows it to run.

Like everything Comodo, it behooves one to be patient. All one can do is wait and see what becomes of it all...

 

[SD-ahmad]

 

[Alex BK]

Cloud AV I think Melih is serious about it... I think Melih is in the process of building a malware database system that will compete with Virus Total. I have no official confirmation of this. My statement is just based on what I have seen over the years, especially the last two years...

Why even worry about detection when Comodo can be configured to either contain and\or block any Unrecognized files ?

With correct settings CIS will behave exactly the same as the AppGuard + Sandboxie combo. All the additional CIS block settings are simply more layers of protection (e.g. Block by HIPS, Block by Firewall) beyond the sandbox.

The only way a malware is going to get past CIS configured for anti-executable is if:

1. The file completely disables CIS; or
2. The user allows it to run.

Like everything Comodo, it behooves one to be patient. All one can do is wait and see what becomes of it all...

Sorry, but a product based only on "unrecognized file" detection system is incomplete and misleading... What if I download 2 executables: game.exe and virus.exe... Both are unrecognized but game.exe is a legit game and virus.exe is a malicious file??? Maybe I don't know who to trust and I remove game.exe and execute virus.exe? Virus detection is EXTREMELY important to have, even classic signatures are good, not to mention HIPS-like things, behavioral modules and so on...

So the statement: "Why even worry about detection when Comodo can be configured to either contain and\or block any Unrecognized files ?" is a great joke.

 

[Anupam]

Sorry, but a product based only on "unrecognized file" detection system is incomplete and misleading... What if I download 2 executables: game.exe and virus.exe... Both are unrecognized but game.exe is a legit game and virus.exe is a malicious file??? Maybe I don't know who to trust and I remove game.exe and execute virus.exe? Virus detection is EXTREMELY important to have, even classic signatures are good, not to mention HIPS-like things, behavioral modules and so on...

So the statement: "Why even worry about detection when Comodo can be configured to either contain and\or block any Unrecognized files ?" is a great joke.

I completely agree with you. Few people thinks default denial is the best protection. Well if I know every new file will be treated as malware then why I need AV. My UAC also tells me the same

 

[Alex BK]

I completely agree with you. Few people thinks default denial is the best protection. Well if I know every new file will be treated as malware then why I need AV. My UAC also tells me the same

Exactly. Why should I burden my system with that kind of program if UAC does the same? Also, I can't figure out why people are trying to hide the fact that COMODO is in a bad spot right now, slowly going downhill... OK, it's a product with nice features, cool history, free, but why should we hide the fact that its detection ratio is poor and disappointing and maybe they should fix that rather than working on a new product that requires a lot of effort and attention...I don't get it. I've been using COMODO since its 5th version but a couple a months ago a program update of the latest release of CIS nearly destroyed my OS because of an error that caused lots of BSODs... People forgive, but I can't forgive that, the BSODs were very frequent until I decided to uninstall and all problems ceased. Maybe they should polish CIS rather than releasing pointless stuff.

 

[Deleted member 2913]

yes but not fully functional like the new one. valkyre and other components are implemented with this cloud av. so the detection rate will be much more higher than the normal cis at this time.

Where did you get this info?
And if Valkyrie will be implemented with this then I think it will be implemented with CIS too.

So Its kind of a stripped down CIS & like CFW minus FW.
The good thing is the installer size & no added bloatware. Download/Install would be quick.

And I think this is a pure cloud AV. By pure cloud AV I mean execution/running of files will be blocked for the cloud verdict. Like Panda cloud vendor mention the default max time block is 30 secs for the cloud verdict but 99.99% cloud verdict will be instant & users will not notice delay in file execution, etc... Panda cloud use to have this option i.e you can increase/decrease the max time. Dont know if the new/latest Panda cloud still have the option. Bd free & I think all cloud AVs acts this way i.e block execution for cloud verdict.

I think Cloud part in CIS is not a pure cloud AV i.e doesn't blocks file execution/running of files for cloud verdict. I think its simply an online/cloud connection for online/cloud databases.

 

[Deleted member 178]

For the moment it is just a screenshot...we are not even sure it will become real.