AVLab.pl Analysis of system protection against active online malware – July 2025

Status
Not open for further replies.
Disclaimer

  1. This test shows how an antivirus behaves with certain threats, in a specific environment and under certain conditions.
    We encourage you to compare these results with others and take informed decisions on what security products to use.
    Before buying an antivirus you should consider factors such as price, ease of use, compatibility, and support. Installing a free trial version allows an antivirus to be tested in everyday use before purchase.

  • Like
Reactions: Behold Eck and Adrian Ścibor
I was all excited to finally see an actual MD5 for a Comodo bypass! Sadly even after manipulating the sample it still is unable to create a Server to connect out, and pretty much (totally, actually) dies in containment (and not that it matters, but virusscope detects it).

I tried, but maybe next time...
 
  • Like
  • +Reputation
  • HaHa
Reactions: kylprq, topper, roger_m and 6 others
Andy Ful said:
I think it was a moderator (DecimaTech). Melih and @Umut (official Comodo staff) also participated in this thread and did not correct anything posted by DecimaTech. I think that those posts include valid information; however, you cannot take them as an official statement.
Click to expand...
Melih and official Comodo staff don't reply to or confirm the mod comments; I agree you cannot take them as an official statement.

Andy Ful said:
As you can read from the provided links, some restriction levels (higher than partially limited) were intended to prevent bypass, although they did not due to incompatibility with UAC. However, it is not important. There are known ways to tamper with Comodo drivers and services, so the sandbox design can be bypassed (if someone is highly motivated). You cannot assume that malware that bypassed Comodo has to do it without bypassing the sandbox.
Anyway, I think that bypassing Comodo fully from the sandbox will be rather related to possible incompatibility with Windows UAC, like in the recent bypass. Although this particular bypass was patched, there is no information about solving the UAC incompatibility. A similar problem was in Sandboxie, where the higher isolation required disabling elevation to Administrator rights.
Click to expand...
I believe you can break any protection measures. Yes, you can bypass Comodo using vulnerabilities, protection design, etc.

Higher restriction levels mean more limits. They improve security but affect containment usability. The theory that "default security" is weak is misleading. There have been no confirmed Comodo bypasses. At least, I am not aware of any. The recent PoC bypassed default and custom setups. Did the tester disable UAC and test Comodo with restriction levels? Did the PoC bypass defaults but not the higher restriction level?

Shadowra said:
I'll be brief about Comodo:
My message is not intended to insult Comodo's staff or its users, but I am speaking as a tester.

Comodo as an AV engine is a real joke. It detects too few threats, and some of them are even old...
Comodo pushes everything to the Sandbox, which can be a good compromise, but also insufficient.

All it takes is for malware to be signed or steal the signature that is placed in Comodo's Whitelist => No sandbox, malware allowed...
I'm still waiting for Valkyrie to be integrated into the AV engine, at which point its engine will be almost on par with the competition...
Click to expand...
I agree with you about Comodo AV and whitelisted malware. Comodo will not integrate Valkyrie in CIS, as Comodo Cloud provides Valkyrie detection as per Melih.

I don't agree with the statement, "Comodo pushes everything to the sandbox." In a malware-only test, what do you expect from a security layer that protects against malware and unknown files?

You contradict yourself when you recommend, say, a smart-deny program like CyberLock when it blocks everything in your test, but you give the opposite reaction for Comodo when it performs similarly to CyberLock or contains everything, especially when there is no usability test. Comodo's usability is far better than CyberLock's.

Andy Ful said:
Welcome Xcitium team, here on MT.:)(y)
Click to expand...
I guess @Nikola Milanovic didn't mean he is official Xcitium staff. Did you @Nikola Milanovic?
 
  • Like
Reactions: anirbandutta01, Behold Eck and Shadowra
rashmi said:
Melih and official Comodo staff don't reply to or confirm the mod comments; I agree you cannot take them as an official statement.


I believe you can break any protection measures. Yes, you can bypass Comodo using vulnerabilities, protection design, etc.

Higher restriction levels mean more limits. They improve security but affect containment usability. The theory that "default security" is weak is misleading. There have been no confirmed Comodo bypasses. At least, I am not aware of any. The recent PoC bypassed default and custom setups. Did the tester disable UAC and test Comodo with restriction levels? Did the PoC bypass defaults but not the higher restriction level?


I agree with you about Comodo AV and whitelisted malware. Comodo will not integrate Valkyrie in CIS, as Comodo Cloud provides Valkyrie detection as per Melih.

I don't agree with the statement, "Comodo pushes everything to the sandbox." In a malware-only test, what do you expect from a security layer that protects against malware and unknown files?

You contradict yourself when you recommend, say, a smart-deny program like CyberLock when it blocks everything in your test, but you give the opposite reaction for Comodo when it performs similarly to CyberLock or contains everything, especially when there is no usability test. Comodo's usability is far better than CyberLock's.


I guess @Nikola Milanovic didn't mean he is official Xcitium staff. Did you @Nikola Milanovic?
Click to expand...
Hello @rashmi we are employees of Xcitium we work for Xcitium so we are official Xcitium Employees

Best Regards
Nikola
 
Last edited:
  • Like
Reactions: ForgottenSeer 116559
simmerskool said:
yikes suddenly I am getting phone calls to my iphone from Xcitium (sales I presume) I know I did NOT give them my phone number when I signed up for Valkyrie online... :sick:
Click to expand...
hacke your phone to prove their comptence :cool:
subscribe to protect yourself 🤑
 
Nikola Milanovic said:
Hello @simmerskool did this number call you +1 (973) 859-4000 or this number +1 (888) 551-1531?
Please let us know

Best Regards
Nikola
Click to expand...
well I thought I had deleted the call, but at 20:26 UTC my phone shows 973-265-9528 XCITIUM. -- I might have given Xcitium EDR my number 17 months ago, March 2024, when I considered installing Xcitium on a VM, but decided to wait and see... I assume this was a legit call unless someone is spoofing Xcitium -- unsolicited calls will not convince me...
 
  • Like
Reactions: Parkinsond
simmerskool said:
well I thought I had deleted the call, but at 20:26 UTC my phone shows 973-265-9528 XCITIUM. -- I might have given Xcitium EDR my number 17 months ago, March 2024, when I considered installing Xcitium on a VM, but decided to wait and see... I assume this was a legit call unless someone is spoofing Xcitium -- unsolicited calls will not convince me...
Click to expand...
Hello @simmerskool we are sorry for the inconvinience please drop email to support@xcitium.com and any releated screenshots please do drop team will be able to assist you with your query

Best Regards
Nikola
 
Question:

Is anyone here a member of the Comodo Forum? Recent Results » AVLab Cybersecurity Foundation

I'm trying to create an account on the Comodo forum to reply. I'm not receiving activation messages on various emails, password reset also does not work for me. :)

Anyway...

I wanted to explain to them that this is not a mistake, as some people believe of Comodo forum. This sample with a Fail result for Comodo/Xcitium in the test is not our mistake, but the developers / malware researcher in Valkyrie service. Some people still don't believe it and they write nonsense that it is our mistake in methodology or something.

The sample was reported to the vendor and this was changed in the Valkyrie cloud, but the result is the result during the test + we wrote an appropriate statement explaining why this result was obtained. This is not an error in Sandbox Comodo/Xcitium, but human error.

Unfortunately, I cannot explain this on the Comodo forum, which I would like to do, because our reputation suffers from users who write nonsense :/
 
  • Like
Reactions: ForgottenSeer 116559, New_Style_xd, rashmi and 5 others
Adrian- First off, compliments for your site. The fact that you provide a detailed spreadsheet of the malware used with product results speak highly of its integrity.

The issue that I found was with the Comodo result. Although Xcitium relies on an extent on Valkyrie, Comodo does not; therefore, any error (whitelisting of the sample) in the Valkyrie Cloud would not apply to Comodo. The only possibility would be if this sample was added into the LOCAL File Rating database which could not have occurred as there has been no program updates for a while.

My posts are about Comodo (normally the Firewall only setup) without the AV module. Further, when running test malware in Comodo I always disable both the Cloud AV (VirusScope) and File rating components, thus relying only on the strength of the product which are the Sandbox and firewall modules.
Thus, when the sample is run it will go into the sandbox, and not being able to establish a connection to a Server will close. Further, even with Containment disabled the Firewall will block the malicious connection out to Moscow which also results in the malware closing.

In Summary, the statement on your website:

"The results of Comodo and Xcitium are also surprising, as both solutions failed to block a single (same) threat that had previously been classified by the developer as a False Negative: incorrectly marked as safe in the developer’s cloud, which may have affected the global response for workstations."

in actuality may ONLY apply to Xcitium and NOT Comodo, the latter not relying on the Valkyrie Cloud at all.

Regards,
Meghan
 
  • Like
  • +Reputation
  • Thanks
Reactions: kylprq, roger_m, Behold Eck and 4 others
Status
Not open for further replies.

You may also like...