Serious Discussion Comodo Internet Security 2025 was obliterated by an exploit!

[Andy Ful]

hmmm.. so.. if this kind of thing goes live and people target cis users, just for fun, god help us... as comodo doesnt seems to care too much... right?

I do not know if they care, but a non-enterprise user should probably live a thousand years to be a victim of such malware.
I am unsure if Xcitium also has this issue (poor DLL detection).
Other AVs also do not care about some rare attack vectors.

 

[vitao]

The PowerShell script (detected by Kaspersky) was blocked by Comodo via Script Analysis. The PowerShell CmdLine was converted to PS1 script and copied to C:\ProgramData\Comodo\Cis\tempscript folder.

not the powershell. the exe that runs and cis do nothing about it. i posted the sha256 for the file

 

[vitao]

I do not know if they care, but a non-enterprise user should probably live a thousand years to be a victim of such malware.
I am unsure if Xcitium also has this issue (poor DLL detection).
Other AVs also do not care about some rare attack vectors.

ive posted a video showing xcitium getting r#ped by it too. the same problem persists as xcitium is cis but with edr on top.

 

[vaccineboy]

Can you just stop using the word rape? It is not what you want to describe and there are tens of other words that can perfectly convey what you want to say. Why do you have to keep using a word that invokes terror to women and mask it? So juvenile.

 

[vitao]

Can you just stop using the word rape? It is not what you want to describe and there are tens of other words that can perfectly convey what you want to say. Why do you have to keep using a word that invokes terror to women and mask it? So juvenile.

ow... sorry dude. not my intend dont get me wrong. english is not my primary language. some expressions this word have more sense of power and meaning in my language. this word can describes better some thing i want to say. as i dont have any problems with this word, i dont see any problem using it. if you have any problem with it, im sorry, ok? but some language costumes are hard to change. a better solution would be you marking my profile to be ignored, or hyde me, something like that. atleast until i can become able to pay more attention to your feelings.

 

[Andy Ful]

not the powershell. the exe that runs and cis do nothing about it. i posted the sha256 for the file

Understand. I mentioned this script because it is most probably not a false positive. Kaspersky correctly detected it as malicious. This script may also be an artifact after running the EXE (detected by Kaspersky). So, those two files can be related to one malware that was mitigated by Comodo Script Analysis.
You can check this possibility by deleting the content of "C:\ProgramData\Comodo\Cis\tempscript folder" and running only that EXE sample. If Comodo does not create the PS1 script, those files are unrelated.

Edit.
It seems that the EXE sample was a downloader, but the domain with the final payload did not respond (dead sample). The payload (exe.exe) would be most probably contained by Comodo.

Malware analysis SoftwareInstaller.exe Malicious activity | ANY.RUN - Malware Sandbox Online

Online sandbox report for SoftwareInstaller.exe, verdict: Malicious activity

any.run

Analysis SoftwareInstaller.exe (MD5: 9CF40A8B46C9552148565D43C3D92465) Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

 

[Andy Ful]

ive posted a video showing xcitium getting r#ped by it too. the same problem persists as xcitium is cis but with edr on top.

This is not good news for Enterprise users.

 

[Vitali Ortzi]

This is not good news for Enterprise users.

Non profits , schools and some enterprise use their enterprise product because they claim 100% bs and are cheaper then any alternative
I really like the idea of not full virtualization that comodo does because it uses less performance then virtualization but both their container can be escaped and trusted dlls ,exes ( trusted lolbins) are automatically run without containment while unlike Kaspersky , other av software it doesn't have good behavior detection to help against a bypass as viruscope is awful
I'm still using comodo on most my PCs (usually as a layer) so some bypasses might be stopped by either hitmanpro.alert or ESET on my system or checkpoint threat emulation that I have in the browser extension so I'm safe against 99.99%+ and I usually submit suspicious files to Broadcom before running them using Sample Submission | SymSubmission

But hopefully one day I could use only comodo comfortably if they do improve it as comodo has excellent performance usage and I have one low end 2gb ram with emmc laptop that can't run ESET on it without performance issues nor defender and comodo didn't seem to slow io , use much ram and it's a gift to low end machines making them mostly secure while not having to go chrome os route or any too restrictive policy config

So I definitely find comodo very useful and because it's not perfect if anyone uses comodo use it as a layer if possible with some free av (Kaspersky free, defender , bitdefender free ,avast free etc )

 

[bazang]

But hopefully one day I could use only comodo comfortably if they do improve it

Now wouldn't that be nice?

After all these years, with its track record, Comodo now is as good as it will ever be as a product owned by Melih. A lot of people do not know this, but he once said "I don't care about bugs" on the old Comodo forum.

I think it is clear by now that the owner is never going to commit the resources to the product required to develop, refine and maintain it to a user experience quality at the same level any of the "big name" security software.

I really do wonder why people just do not acknowledge and accept this fact? Why do they keep thinking that they can get Comodo to fix the product by complaining and demonstrations? Neither of those two things have ever helped improve the product. Rather, they have had the exact opposite effect because Melih views them as "ungratefulness." Just another freeloader as Melih stated it.

If people want a better Comodo, then they have to convince Melih to make it paid and then they must be willing to spend their cash to pay for it.

¯\_ (ツ)_/¯

 

[Vitali Ortzi]

Now wouldn't that be nice?

After all these years, with its track record, Comodo now is as good as it will ever be as a product owned by Melih. A lot of people do not know this, but he once said "I don't care about bugs" on the old Comodo forum.

I think it is clear by now that the owner is never going to commit the resources to the product required to develop, refine and maintain it to a user experience quality at the same level any of the "big name" security software.

I really do wonder why people just do not acknowledge and accept this fact? Why do they keep thinking that they can get Comodo to fix the product by complaining and demonstrations? Neither of those two things have ever helped improve the product. Rather, they have had the exact opposite effect because Melih views them as "ungratefulness." Just another freeloader as Melih stated it.

If people want a better Comodo, then they have to convince Melih to make it paid and then they must be willing to spend their cash to pay for it.

¯\_ (ツ)_/¯

It's a paid product sold to enterprise and the consumer comodo is based on the same client they sell to enterprises
So although the cut down client is free for personal use
The main product is an enterprise one sold with claims that zerodwell(container ) can stop 100% etc

Yet there are a few ways to bypass it that other av software have ways to mitigate either by behavior blockers , hips , other defenses

 

[Andy Ful]

Yet there are a few ways to bypass it that other av software have ways to mitigate either by behavior blockers , hips , other defenses

The research reports suggest that other AV/EDR solutions cannot protect Enterprises much better, although they have some other weak points.
https://malwaretips.com/threads/how...rs-protection-now-in-2024.133301/post-1105300

Nowadays, the recommended solution is the Zero Trust Model, where AV/EDR is only a part of the solution.

 

[Vitali Ortzi]

The research reports suggest that other AV/EDR solutions cannot protect Enterprises much better, although they have some other weak points.
https://malwaretips.com/threads/how...rs-protection-now-in-2024.133301/post-1105300

Nowadays, the recommended solution is the Zero Trust Model, where AV/EDR is only a part of the solution.

Thing is that zerodwell container is marketed as a zero trust solution yet automatically allows trusted lolbins and yeah av software have a hard time as well because they allow trusted lolbins too to bypass and run privileged and many av vendors claim to have an ability to be zero trust and usually fail as well too when you configure them at zero trust and use something they automatically trust in a targeted attack
So how many solutions are actually zero trust

 

[Andy Ful]

Thing is that zerodwell container is marketed as a zero trust solution yet automatically allows trusted lolbins and yeah av software have a hard time as well because they allow trusted lolbins too to bypass and run privileged and many av vendors claim to have an ability to be zero trust and usually fail as well too when you configure them at zero trust and use something they automatically trust in a targeted attack
So how many solutions are actually zero trust

You know that you can use commas and periods?

 

[Vitali Ortzi]

You know that you can use commas and periods?

Sorry for making reading very inconvenient.
As I'm not really the most intelligent guy , and unsure when to use commas and periods , and haven't really forced myself ever to try and improve my grammar.
(Hopefully this is correct usage ,but uncertain if what I'm currently writing is even correct usage of comma and period.)


(if anyone has some good site to practice , and learn you can send me a private message, and or anything to improve grammar , writing skills.)

 

[Andy Ful]

So how many solutions are actually zero trust

There are some leaders:

 

[vitao]

Understand. I mentioned this script because it is most probably not a false positive. Kaspersky correctly detected it as malicious. This script may also be an artifact after running the EXE (detected by Kaspersky). So, those two files can be related to one malware that was mitigated by Comodo Script Analysis.
You can check this possibility by deleting the content of "C:\ProgramData\Comodo\Cis\tempscript folder" and running only that EXE sample. If Comodo does not create the PS1 script, those files are unrelated.

Edit.
It seems that the EXE sample was a downloader, but the domain with the final payload did not respond (dead sample). The payload (exe.exe) would be most probably contained by Comodo.

Malware analysis SoftwareInstaller.exe Malicious activity | ANY.RUN - Malware Sandbox Online

Online sandbox report for SoftwareInstaller.exe, verdict: Malicious activity

any.run

Analysis SoftwareInstaller.exe (MD5: 9CF40A8B46C9552148565D43C3D92465) Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

i understand. so this is a half malware well, cis didnt contain it.

 

[vitao]

This is not good news for Enterprise users.

yep. i see comodo mods and some users saying that "now that the problem is solved there is only the malware to be sent to camas/valkyrie", etc., but they seem to have the need of ignoring that latest cis solved "nothing". the same poc still runs and the same ransomware still runs.

edit.: videos recorded. ill try to edit and public one tomorrow and the second the day after. if all goes well...

 

[bazang]

It's a paid product sold to enterprise and the consumer comodo is based on the same client they sell to enterprises

Xcitium product earns very little revenue. Not enough to justify dedicating a development team to it.

The basic formula in software development is that a software must generate 750,000 Euros in revenue to support 3 employees with a salary of less than 60,000 Euros on the payroll.

Xcitium very likely generates less than 300,000 Euros per year in revenue. That is not nearly enough to even support 1 dedicated development employee. Unless Melih hires developers from poor 2nd and 3rd world nations. He can hire an army of programmers in Zimbabwe or Vietnam for only 100,000 Euros.

The main product is an enterprise one sold with claims that zerodwell(container ) can stop 100% etc

The marketing can say whatever it wants.

The EULA however states that the buyer/end user assumes all risk and the product is sold "AS IS" with no warranty of fitness of purpose. The product is not guaranteed to provide any protection and upon installation the end user agrees to these terms.

What that means is this: "You use this product and if it is bypassed then it is on you, and not on Xcitium or Comodo."

Nowadays, the recommended solution is the Zero Trust Model, where AV/EDR is only a part of the solution.

A true Zero Trust protection begins at the physical layer and goes all the way to the application layer in the network stack. Then on the operating system it is from the physical layer to the application layer. Then in the non-digital security realm, Zero Trust includes physical and personnel security. Next, Zero Trust includes very robust Governance, Risk Management and Compliance (GRC). All of these are combined.

I don't know how many times an enterprise has stated to me "We purchased Product XYZ marketed as Zero Trust and thereby implemented a Zero Trust Protection Model throughout our organization." They are extremely disappointed when I tell them they don't understand Zero Trust and that they need to spend another 5,000,000 Euros to get there.

Very, very few service providers know how to properly implement true Zero Trust and even fewer enterprises and governments can do it themselves. I don't know how many times a government has said to me "We air gap these high sensitivity machines. They are Zero Trust."

It takes a lot of time, resources, patience, knowledge, experience, and money to do Zero Trust the right way. It can be done - and done very well - using 100% Microsoft security. Why is this? Because Microsoft does adhere fully to the first principle of security: "Security is not software. It is a process." Plus it works so closely with the U.S. Government that it integrates many of the capabilities developed by NIST Special Publications that inform & guide virtually 100% of global enterprise security practices.

Lots of people and organizations think "Zero Trust implementation is purchase Zero Trust software and deploy it."

Meanwhile, for a small company, a correct Zero Trust security implementation is a 2 to 3 year process requiring an army of SMEs and implementers. And that usually only happens in very highly regulated industries where serious negative consequences can happen. It is not at all unusual for a financial transaction processor to take a couple of years fully implementing PCI DSS. And that is just the beginning of the security requirements and regulations that are applicable to their operations.

Most every Zero Trust product out there just exploits the words "Zero Trust." Why? Because people have no idea what Zero Trust really is.

Many organizations fail Zero Trust assessments and audits.

 

[vitao]

Video testing COMODO Internet Security 2025 v12.3.4.8162 against a Malware that was not isolated in the previous test:

This video has subtitles and descriptions translated into English, Spanish, Russian, Ukrainian and Hindi. If you need subtitles in other languages, just let me know and I'll provide them.

 

[Bot]

Thank you for sharing the video and providing subtitles in multiple languages. It's a great resource for users trying to understand how COMODO Internet Security 2025 v12.3.4.8162 performs against malware. If anyone needs subtitles in additional languages, please request here.