AVLab.pl Analysis of system protection against active online malware – July 2025

Status
Not open for further replies.
Disclaimer
  1. This test shows how an antivirus behaves with certain threats, in a specific environment and under certain conditions.
    We encourage you to compare these results with others and take informed decisions on what security products to use.
    Before buying an antivirus you should consider factors such as price, ease of use, compatibility, and support. Installing a free trial version allows an antivirus to be tested in everyday use before purchase.

People must understand that Comodo's sandbox was not supposed to let anything run outside the box, with the lack of sandbox updates it is passing threats.

That is kinda true, but not exactly as you presented the problem.

Missing EXE samples by Comodo do not necessarily mean that the Comodo sandbox was bypassed. Sometimes it can be Comodo's false negative detection (the file is not contained at all). This can usually happen when:
  1. The malware uses strong anti-analysis features. In this case, it does not activate malicious actions when analyzed in the Comodo Valkyrie, which ends with false negative detection (file is recognized as trusted).
  2. The malware is a short-lived downloader, and it is analyzed by Comodo Valkyrie after some hours/days (did not infect Comodo users in the wild). During the analysis, the malware cannot download payloads (dead URL or removed payload). Even if the malware leaves some traces in the registry or drops some intermediate files (scripts, DLLs, etc.), it cannot seriously infect the system and can be recognized by Valkyrie as trusted.
There are also some bypasses related to the abuse of truly benign files. I posted about it many times.

Post corrected (text in italics)
CIS uses by default the partially limited sandbox the autocontainment without setting the "Restriction Level", so evasive malware can sometimes escape from it (as documented by Comodo) or contact with the C2 server. For more protection, the user can use Restricted or Untrusted containment settings.
But all those problems do not follow from the design weaknesses of the Comodo sandbox. Furthermore, they are sufficiently rare in the home environment, so Comodo can still compete with top AVs.
 
Last edited:
  • +Reputation
Reactions: simmerskool
The Valkyrie verdict is Trusted. So this probably was not the Comodo Sandbox bypass, but a false negative (I explained this possibility in my previous post).
However, the current verdict does not completely exclude the possibility of escaping the partially limited sandbox. To be sure, we had to see the Valkyrie verdict during the AVLab test in July (Verdict Unknown = sandbox bypass).

1756076415532.png
 
Last edited:
This is correct, but I'm unsure where Kaspersky comes into this discussion. Guess I'm not paying attention or reading every post in the thread.


Kaspersky is an issue for US GOV agency networks due to the data collection and file harvesting. Not all US GOV networks are disconnected from the internet - and one of the reasons Kaspersky got banned was that it uploaded secret files from US Government and contractor systems to Kaspersky. Now, to his credit, Eugene Kaspersky did quickly inform the US Government and the contractors about the file uploads, but the prevailing view is that it does not matter much when the files are already out of your control - and therefore the secrecy is lost. Same happened in the UK and Lithuania. Same experience with Kaspersky being a huge data collector and file grabber. The overall concern being that while there is no active cyber-espionage being performed by Kaspersky using its software that has been proven to date, it certainly has the capabilities to do so. Combine that with the fact that there's a significant number of ex-KGB and FSB personnel at Kaspersky - or their family members are ex-KGB or FSB, it just comes down to a matter of being prudent not to use Kaspersky products within government systems.

Much of the issue centers around Eugene Kaspersky's very close relationship with the FSB. Kaspersky is naturally pro-Russian and will do what is required if requests are made by the Russian government. Eugene and his company always have worked against the US Government and NATO nations in subtle ways.

There's way more to it than that, but since no one is going to publicly release the intelligence there's a lot of misinformation circulating about the Kaspersky ban that is not accurate.
KAV came into the convo when OP explained the reason why it wasn't tested this time around: do to large upload size etc
 
These tests aren't a perfect measure, they are just a baseline to evaluate a product's general effectiveness.
Sandbox failed once again, is anyone using it still safe?


If Comodo is unsafe, then what would you say about this?

View attachment 290490


It is risky to make conclusions on the example of one particular test.

People must understand that Comodo's sandbox was not supposed to let anything run outside the box, with the lack of sandbox updates it is passing threats.

Here is the report of how it happened, it really proves that the sandbox has a problem... lol

This has been clarified in the article accompanying the results: Analysis Of System Protection Against Active Online Malware – July 2025 » AVLab Cybersecurity Foundation

"Some of the tested solutions failed to detect between one and several malware samples. In the case of Aura Antivirus, the solution is relatively new on the market, certainly with less experience than its competitors, so it is understandable that the engine is not yet trained enough to catch all popular threats found on the web. The insufficient number of Aura users may also have an impact on the result when it comes to collective protection – sharing telemetry data from devices with the developer.

The results of Comodo and Xcitium are also surprising, as both solutions failed to block a single (same) threat that had previously been classified by the developer as a False Negative: incorrectly marked as safe in the developer’s cloud, which may have affected the global response for workstations."

This was not a Sandbox issue.
 
The results of Comodo and Xcitium are also surprising, as both solutions failed to block a single (same) threat that had previously been classified by the developer as a False Negative: incorrectly marked as safe in the developer’s cloud, which may have affected the global response for workstations."

This was not a Sandbox issue.

Yes, this can also be an example of why retesting some samples might be interesting. The modified sample would be recognized by Comodo as Unrecognized and (most probably) auto-contained. On the contrary, some AVs that detected the original sample by signature might be bypassed by the modified sample.
The above scenarios could make tests more realistic.
The Excellent scoring should be reserved for those AVs that consistently were the best both in the standard test and in the "modified test".
 
What do you mean by this?

1756129655283.png


Yes, I noticed that the restriction level is unchecked. I corrected my previous post.

Could you please provide a link to the document?

I had in mind the Comodo help documentation (containment restriction levels) and some technical posts from the Comodo Forum (related to the recent sandbox escape). This information is not new to you.
 
Last edited:
Are these some sort of fairytales? Where do you think the combined revenue of 7 BN comes from? From the sky? Also, Kaspersky is far from being forgotten, Russia by itself is massive and so are other Russia-supporting countries that have no problem with Kaspersky. All together these 3 generate 10 billion revenue. Not sure how this is “stuff from stories”.
A little off-topic because I wasn't there.

Sorry, but what nonsense? Do you have any reading comprehension skills? I clearly wrote "in my country." And it's banned in other countries as well. But that doesn't mean it's banned worldwide and can now close down the business. The brand is too strong and has a good product to defend itself with.

I won't explain simple things. You clearly don't understand this. The sales figures achieved by large companies mean nothing in terms of product quality.
I don't mean to offend you, but you clearly don't understand why these large corporations are so powerful. You see the numbers, their results, but you don't see where it comes from.
I'll skip over what I wrote – a large company with resources, people, processing capacity, know-how, etc., built the current version of Norton on the engine of a smaller competitor, Avast, which they acquired. They have such resources, and they can't build their own engine?
Symantec (I'll focus on it as an example so as not to mention every AV brand) or whatever they're called now, isn't just about AV. It's a large corporation with many solutions on the market. A corporation is a large company that needs to be managed. And often in such a large corporation, collaboration between multiple departments, even with resources, cash, etc., doesn't always work.

Remember, the USA has half the population of all of Europe. That's a large market in itself. And what do Americans choose? Mainly their own products, perhaps even forced ones. Americans are known for their patriotism.

When Kaspersky was banned, the US pressured governments and institutions in many countries, including mine, to buy their solutions instead of Kaspersky. I'm sure it was similar in other US-allied countries.

Many brands sell today because they've built their brand over years – through marketing. McDonald's and Coca-Cola also earn billions, but the quality of their products is poor. People buy because everyone knows it and "millions of flies can't be wrong."

People, in most cases, don't know anything about a given industry's products, and the average person who goes to a store to buy AV systems buys what they know—Norton, McAfee, Kaspersky, etc. People who don't know anything about a given industry choose not the quality of the product, but the brand, because they recognize the brand. Because a well-known brand is immediately associated with quality. And I'm not surprised at all. A physics professor, for example, doesn't need to know anything about AV systems, because there's no one on earth who knows everything.
In F1, we have Ferrari. A huge company, with many successes throughout history, great achievements. They are large and self-sufficient. They have their own engines, build their own cars, and even have their own wind tunnel.
So what? Where are they now? They've been mismanaging and failing to achieve success for years (the last one was in 2007). And then a team like Red Bull came along, even without its own engine. But smaller, with a creative mindset, a good management team (a much smaller corporation like Ferrari), and under Vettel, they won everything. No patents, no extensive know-how, etc.

You can even see this in real life. Now streaming is all the rage. Netflix has built a brand. So what if every competitor is producing better-quality content these days? Netflix continues to grow because it built a brand, is the only one making money off of it (the rest are struggling), and because it's making money, it spends huge amounts of money on marketing. Practically speaking, if it weren't for the wealthier Apple (which makes money from hardware, not streaming), Netflix would win almost every auction. Because it can afford it.

In 2023, I read that they spend more on advertising than HBO does on producing its shows. And when someone thinks about streaming, they choose Netflix first, despite the fact that its quality is currently a shadow of what it was a few years ago (protesters will probably come calling soon, but that's the way it is – it's the most overrated). Netflix is popping up these days, it's all over the place, and people choose it because "millions of flies can't be wrong."

Also, big can do more, and often the choice is primarily price. Such large corporations, which make a fortune, often use dumping prices because they can afford it, thus excluding competition from their target customer base. And I'm referring to large contracts with large companies.

A few years ago, Samsung faced a lawsuit because in some Asian country (I don't remember which one) it paid people to write negative reviews about HTC phones. There, it captured the market, made billions, and paid peanuts – probably around 500 or 700 million. Today, HTC probably doesn't even exist anymore. Samsung calculated its losses on a potential lawsuit, but it could afford it, because a large company can do more.

Brand and brand again. Norton has built a name for itself worldwide over the years. It hasn't had any major setbacks. Their products aren't the best, but they're far from weak. Their products don't have to be the best, and I don't think they will be. Their products simply sell themselves, thanks to their established brand.

I could write a long story here. I could provide many examples, but why bother? If you ever step outside your bubble, maybe you'll understand.

Thank you for the exchange of views.

End of off-topic.
 
We usually test the solutions you have indicated at least a few times a year. Except for AVG = Avast. Avira does not want to participate in our tests, but we will see in 2026.

Check out previous editions:
View attachment 290469


Thanks for the reply. I'm constantly reviewing the tests.

You only mentioned the new rules, so I asked about other AV solutions.

Except for AVG = Avas
Expect for AVG=Avast=Norton?


I'm eagerly awaiting the results of these tests. And I hope to see more AV results at the same time ;)

Best regards.
 
Netflix has built a brand. So what if every competitor is producing better-quality content

I could write a long story here.
Of course, Netflix has "Wednesday" QED. You did write a long story: 5,404 characters & 963 words. So... some small(er) companies have better quality products than some large corporations & good marketing can boost sales. Got it. ;) :rolleyes:
 
The results of Comodo and Xcitium are also surprising, as both solutions failed to block a single (same) threat that had previously been classified by the developer as a False Negative: incorrectly marked as safe in the developer’s cloud, which may have affected the global response for workstations."

This was not a Sandbox issue.

Uh oh. This is going to hurt some minds.

giphy (1).gif
 
When the posts are of a certain length, I just suspend reading and comprehending after the 5th-6th line 🤷🏻‍♂️

This post has some good points (although not always on topic). I used ChatGPT to make a summary::)

🔑 Core Message:

Big brands succeed not always because of better quality, but because of money, marketing, and reputation.


💡 Key Points:​

  1. Brand vs Quality:
    • A strong brand doesn’t mean a good product.
    • Big companies like Norton or Netflix sell well due to brand recognition, not necessarily because they offer the best quality.
  2. Power of Marketing & Influence:
    • Companies like McDonald's or Coca-Cola earn billions through marketing, even if their product quality is poor.
    • Netflix spends more on ads than HBO spends producing shows — and wins because of it.
  3. Market Manipulation by Big Corporations:
    • Large companies can buy out smaller ones (like Norton using Avast’s engine).
    • They can afford dumping prices, influence governments, or even smear competitors (e.g., Samsung allegedly paying for bad HTC reviews).
  4. Consumer Behavior:
    • Most people buy what they recognize, not what’s best.
    • Average buyers often don’t know how to judge quality — they go with famous names.
  5. Example Analogy – Ferrari vs Red Bull (F1):
    • Ferrari has resources and experience but poor results.
    • Red Bull, a smaller and more creative team, beat them through smarter management — proving that big doesn’t always mean better.
  6. Geopolitical Pressure & National Preference:
    • In the U.S., people and institutions tend to choose American products (like Norton) — sometimes due to government pressure or patriotism.
    • Kaspersky’s ban is used as an example of how political influence shapes markets.
 
Last edited:
I used ChatGPT to make a summary::)

🔑 Core Message:

Big brands succeed not always because of better quality, but because of money, marketing, and reputation.


💡 Key Points:​

  1. Brand vs Quality:
    • A strong brand doesn’t mean a good product.
    • Big companies like Norton or Netflix sell well due to brand recognition, not necessarily because they offer the best quality.
  2. Power of Marketing & Influence:
    • Companies like McDonald's or Coca-Cola earn billions through marketing, even if their product quality is poor.
    • Netflix spends more on ads than HBO spends producing shows — and wins because of it.
  3. Market Manipulation by Big Corporations:
    • Large companies can buy out smaller ones (like Norton using Avast’s engine).
    • They can afford dumping prices, influence governments, or even smear competitors (e.g., Samsung allegedly paying for bad HTC reviews).
  4. Consumer Behavior:
    • Most people buy what they recognize, not what’s best.
    • Average buyers often don’t know how to judge quality — they go with famous names.
  5. Example Analogy – Ferrari vs Red Bull (F1):
    • Ferrari has resources and experience but poor results.
    • Red Bull, a smaller and more creative team, beat them through smarter management — proving that big doesn’t always mean better.
  6. Geopolitical Pressure & National Preference:
    • In the U.S., people and institutions tend to choose American products (like Norton) — sometimes due to government pressure or patriotism.
    • Kaspersky’s ban is used as an example of how political influence shapes markets.
I don’t disagree, but the statement wasn’t about what’s best, it was that Norton has been forgotten. A forgotten product doesn’t generate billions in a highly competitive field.
That came with additional clarifications (people at work, people in my country and so on). I doubt the OP has inspected everyone at work/in their country’s devices to find out what they use.

Because there is no reliable data to suggest what’s forgotten/what’s not, the only definitive source of truth can be hard facts like how much money a company makes through bookings/customers. The rest is assumptions and presumptions.
 
Status
Not open for further replies.