App Review Comodo Firewall vs a new Data Stealer

It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
Content created by
cruelsister
So in the end, Comodo Firewall will block it, or it will be user dependent?
Yes it was stopped. Initially the VirusScope Cloud would have immediately deleted it (but in the video I ignored that warning, which as noted is unwise). But the other important thing is that a Firewall alert popped up which, especially in the case of Data Stealers, should never ever be ignored (which I did anyway).

This latter point is essential to note as any Stealer cannot succeed if it is unable to transmit the stolen data out to Malware Command. This is also why one should never, ever just rely on Windows Defender Firewall (no matter how tricked out) as it is barely an inconvenience to shut it down prior to transmission.

Finally if CF was put into Silent Mode (like in the 2nd part of my last Comodo video) there would have been no popups at all- the file would have just been deleted prior to activation.
 
Last edited:
Sim, foi parado. Inicialmente o VirusScope Cloud o teria excluído imediatamente (mas no vídeo ignorei esse aviso, que conforme observado não é sensato). Mas a outra coisa importante é que surgiu um alerta de Firewall que, especialmente no caso dos Data Stealers, nunca deveria ser ignorado (o que eu fiz de qualquer maneira).

Este último ponto é essencial a ser observado, pois qualquer Stealer não poderá ter sucesso se não conseguir transmitir os dados roubados ao Comando de Malware. É também por isso que nunca se deve confiar apenas no Firewall do Windows Defender (não importa o quão enganado seja), pois é um inconveniente desligá-lo antes da transmissão.

Finalmente, se CF fosse colocado no Modo Silencioso (como na 2a parte do meu último vídeo do Comodo), não haveria nenhum pop-up - o arquivo teria sido excluído antes da ativação.
I always watch your videos, they are very well made. It would be perfect if you were talking in the video as if it were a tutorial.

You could create videos showing how to configure everything, but you could talk in the video.

Hugs.
 
How boring...:not being hit by a real virus for a couple of decades! I dont remember what it was,but it happened more than 20 years ago, then I discovered the great Kevin McAliveley BOCLEAN and i was glad to pay for it,as it assured a complete protection,especially if you added Melihs new firewall; a pity the two divorced,something really good might have ensued from their collaboration,but ,anyway,nowadays we could take advantage from what cruelsister suggested regarding firewalls and other progs, so everything-in spite of continous attempts to enlive the scene- keeps being as boring as ever....
 
I always watch your videos, they are very well made. It would be perfect if you were talking in the video as if it were a tutorial.

You could create videos showing how to configure everything, but you could talk in the video.

Hugs.
Nah, with notepad I think it`s easier to pick up points by pausing it. Also that heavy Bronx accent would make the use of an interpreter a must.

Regards Eck:)
 
Finally if CF was put into Silent Mode (like in the 2nd part of my last Comodo video) there would have been no popups at all- the file would have just been deleted prior to activation.
According to your configuration, "restricted" mode blocks network connections from unrecognized programs, as mentioned in your videos and some user posts. I would like to confirm if this is the case, as the help files mention nothing about network connection prevention.
 
  • Like
Reactions: [correlate]
Yes it was stopped. Initially the VirusScope Cloud would have immediately deleted it (but in the video I ignored that warning, which as noted is unwise). But the other important thing is that a Firewall alert popped up which, especially in the case of Data Stealers, should never ever be ignored (which I did anyway).

This latter point is essential to note as any Stealer cannot succeed if it is unable to transmit the stolen data out to Malware Command. This is also why one should never, ever just rely on Windows Defender Firewall (no matter how tricked out) as it is barely an inconvenience to shut it down prior to transmission.

Finally if CF was put into Silent Mode (like in the 2nd part of my last Comodo video) there would have been no popups at all- the file would have just been deleted prior to activation.
Viruscope clearly stopped the sample with the option to clean by the user presented in which you ignored once to demonstrate further. There is no doubt the product is capable. As noted I was not mentioning anything about the product, only the method and the unnecessary commentary.

Only have a couple questions that clear things up for me.

1. Is the product at default settings out of the box?

2. Is it possible to make demonstrations without product bashing other products, since true real world testing does not take place in this forum?

These two things make what you are doing more credible all the way around.
 
I just tried 2 different samples of the same malware, and a solution "oblivious to malware".
Before the file could even be saved:
1722003475068.png
 
The file would still be contained for those using Xcitium ;)
The signature on the file is also invalid :ROFLMAO:
All in all... Nice find.

View attachment 284459View attachment 284460
From Second ZERO it was contained. Unless they actually stole a CERT from MS HEHEHE. Nothing is truly bullet proof. It's just amazing to see how many different security technologies can either detect it or not. Its like eye candy
 
From Second ZERO it was contained. Unless they actually stole a CERT from MS HEHEHE. Nothing is truly bullet proof. It's just amazing to see how many different security technologies can either detect it or not. Its like eye candy
A lot of the stealers invoke the browser. This means that your browser is put into the container and unless access to the network is restricted, passwords, and more crucially session cookies, also enter the container. They are then ready for exfiltration, just like the stealer would do without containment.

So the containment is not the magical pill that will solve all your malware problems.
 
A lot of the stealers invoke the browser. This means that your browser is put into the container and unless access to the network is restricted, passwords, and more crucially session cookies, also enter the container. They are then ready for exfiltration, just like the stealer would do without containment.

So the containment is not the magical pill that will solve all your malware problems.
I have it set to restricted modes and disallow reads and writes to chrome profiles and other directories. Just like you... I make the tool better. I miss Harmony to be honest.
 
Comodo is not a Security System; it's merely a security layer.
The issue arises when irresponsible fanatics attempt to market pangasius (security layer) as salmon (Security System).

Comodo is not a virus or malware detector. It functions solely as a binary blocker, and its ability to automate blocking does not transform it into an antivirus or antimalware solution (painting a pangasius with orange color, does not turn it into salmon). The binary function is always the same: either block (unknown) files or allow (known) files (where the criteria of "known" and "unknown" is dependent on a obscure subjective database). Consequently, Comodo effectiveness is entirely dependent on the user.

There is nothing inherently wrong with this approach. As a security layer, blocking or not blocking may be useful for some users, and they are free to use and advocate for this software as a security layer. However, this approach is ineffective for 99% of users (this is one of the reasons why the market largely buried Comodo years ago).
By the way, by hardening Windows security settings, users can achieve same Comodo blocking capabilities. Windows itself doesn't do that, precisely because it knows that "blocking" is not suitable for 99% of users.

Being a software user-dependent creates two main problems: 1) 99% of users lack the expertise to decide what to block or allow; and 2) A blocker does not identify virus or malware, which leads to tons of false positives and, worse, can lead to allow the execution of threats it mistakenly identifies as "known" (it already happened in the past).

The malware shown in the video posted in this thread had already been detected by most other security software on the market. It's a strain of an older, well-known malware, originally developed by teenagers. There is nothing particularly unique about this malware. Additionally, Viruscope is notorious for its inconsistency; its threat detection capabilities are erratic and unreliable. Using Comodo Antivirus or Comodo Viruscope modules carries a high 100% risk of infection.

Furthermore, the video in this thread illustrates that containerization becomes ineffective when the user authorizes the executable through Viruscope. It's also important to note that Comodo has been abandoned since 2018. In 2024, it was rebranded as "2025" just with a new facelift, without any upgrades, nor new features, nor fixes for the old bugs.

In summary, although Comodo is free, it's not recommended for 99% of users. And most users do not need a blocker like Comodo when many of the leading security systems on the market are genuine virus and malware detectors (not mere user-dependent blockers) and are available for free.
So you are saying CF's strength is in the fact that it will deny unknown vs known, and that the success is based upon the quality of the known database, and user response, kind of like PCMatic
 
According to your configuration, "restricted" mode blocks network connections from unrecognized programs, as mentioned in your videos and some user posts. I would like to confirm if this is the case, as the help files mention nothing about network connection prevention.
I'm pretty sure running Restricted will just block the connection rather than showing a firewall alert.
 
I've played with CIS since back in the day before it was a suite and just a firewall. With a knowledgeable user in the right hands, it can be an effective measure. The problem is most users do not understand the operating system and its functions well enough to do so. This not only for all the advanced options and tweaks, but also to understand the issues that locking a system down with cause, and of course I have yet to see this product bug free. Its a fun tool for enthusiasts to play with, but honestly I would never use it as my daily driver for security. As before, I did not enter this thread to go product bashing. I came in to clear some misleading things up because too much emphasis is placed on improper testing methods and sheds a terrible light on products more than capable of keeping users safe. People like myself, use this, as I did, when I discovered this website back in 2011, trying to learn about securing my system. My first year around this place was full of listening to misleading crap that led me to multiple fresh installs from system crashes. Of course on the bright side I'm became proficient with fresh installs. Many of those were attributed to playing with Comodo. I can remember just getting it installed and having to get through the first restart without the system crashing was a feat.

This is all fun and games for enthusiasts but we must remember not all who frequent here are those exactly, and they need straight honest answers not misled. Saying CIS is for average users is misleading for example. Saying tools that require input from users is absolutely ok for average to novice users "which so we are straight here, means they do not know the operating system, its services and uses well enough" to know how to handle such an application, is as stated misleading.

Its not rocket science, and all understand what I'm conveying here.
 
Last edited by a moderator:
I'm pretty sure running Restricted will just block the connection rather than showing a firewall alert.
 
Totally agree that Comodo is not for the average user but I do think it has improved slightly over the past year or so with the install/uninstall problems that really bugged me in the past. They could do away with that Cleaning Essentials thing as it totally messed up my Win10 start up some time ago. Like a lot of things in life I have to learn the hard way but tis better to learn from someone else`s mistakes.

Anyway the firewall/Hips/autosandboxing still works and importantly for me is very light on system resources. A good addition for any geeks setup especially with CS settings.

Regards Eck:)
 
Comodo follows a default-deny approach, allowing approved and blocking unrecognized programs. Combining firewall and antivirus, Comodo introduced CIS in version 3. The antivirus served as a supportive addition to the default-deny setup. As a result, there have been no notable enhancements to the antivirus. Comodo is not suitable for users seeking an antivirus with powerful signatures. Average users shouldn't use Comodo, but it's one of the easiest default-deny setups to learn and use. I suggest installing Comodo on average users' systems, as long as you can handle it.
 
Comodo is not suitable for users seeking an antivirus with powerful signatures. Average users shouldn't use Comodo, but it's one of the easiest default-deny setups to learn and use. I suggest installing Comodo on average users' systems, as long as you can handle it.

I'm confused how you came up with the underlined. Wouldn't one need to know the operating system at an intimate level to know how to set and adjust a default deny set up? As far as toggling a few settings sure it's easy enough compared to making rules in a custom manor but still if you have no idea what you are toggling and how it affects the system I wouldn't recommend it.
 
Thee ole expression if you don't like the weather wait around 15 minutes it will change does not apply to this thread, nope, it's more like the 5 year old with a light switch analogy, where they are flipping it back and forth so feverishly that it's a matter of time before the bulb shatters. 🤪
 
I suggest installing Comodo on average users' systems
Average user's need to learn how to clean install Windows anyways.

People do not learn by having the software do it all for them. The last thing the world needs are billions of ignorant, incapable users that do not know what to do. That is exactly what the world is full of. Until that problem is fundamentally solved the malware problem will never stop. It will only get much, much worse in the coming years because the bad guys are much better funded, have better resources, and they got Thug Life AI on their side. They just cannot lose.