I've been testing Webroot and Comodo.
I'm testing both against the two most recent Virussign packs.
Webroot: 85 % upon scan, additional 3 to 12 % upon execution (All Cloud-based query system).
Comodo: 80 % upon scan, additional 1 to 2 % upon execution (AV Cloud lookup; Heuristics).
Even with its improved AV scan engine, Comodo is still lags behind.
Despite this fact, CIS is less problematic than it was back in version 7.
It's resource usage is low during normal workload on my W8.1 system.
It's improving... testament to all the work put in by the dedicated core of users.
They're talented, pretty tough... and thorough.
Interesting- I thought both of these software had novel protection ideas, but it looked like with the right settings, Comodo was much more solid on protection. So, if I understand correctly, even if Comodo doesn't detect on scan or execution, it would still run sandboxed (on default settings as well). In Webroot, if it doesn't detect, you just have the rollback feature where you have allowed your real system to become infected, keystrokes recorded, etc. and then rely on rollback to undue changes (which doesn't work 100% in informal testing). It would be interesting to compare rollback to viruscope (sort of like rollback?)- which I think would be more apples to apples, but you would have to turn off HIPS and sandbox in Comodo to make this 'even' and just test viruscope (which kind of makes it seem like Comodo provides more security layers even with lower detection). Not sure though, they are both really interesting and I was wondering how they compared, so thanks for the test!
I'm also finding that Comodo is running really well on my PC (8.1). I hope they fixed the RAT bypasses that were posted on youtube (ex:
, but there were others). My only other concern is how the trusted file system could be manipulated in Comodo...could a file be classified as trusted but turn out to be malicious? Maybe by not executing in Comodo's testing environment? Or by infecting a previously trusted file? But, I don't know if this is technically possible/feasible.
