App Review Comodo Internet Security 7 review by nsm0220

[nsm0220]

 

[trainbus120]

I had an horrific experience with it resulting in blue screens and finally windows image recovery

 

[Nico@FMA]

Nice review, but Opera's has a better web protection then Comodo it seems and this made me laugh HARD
Granted Comodo's interface looks great other vendors have similair GUI's.
And it looks like Comodo is getting weaker and weaker.
With all do respect but i can hardly call it protection anymore as their rivals just do so much better, considering CIS use to be a rather solid product.
Its running things isolated by default which obviously is nice, as it does make up for their lack of detection, on the otherhand running it in isolation gives the user the idea that the file might be clean while comodo just does not know it and hence run as isolated.

As you know i am NOT a fan of them, and i would not support them ever.
But i hate to see them go as they do have potential.

If you view your own video then you see some files did generate multiple files so these files you found are live ones and missed malware. Also running isolated means if the file is active it runs in sandbox, when the file is no longer in use comodo releases the file and windows takes over again. So if the file is infected then it start infecting otherfiles after being released by comodo sand box.
Because windows index and such will activate the file outside sandbox.
See my point? So if i where to use this program then i would have a very false sense of security and i should worry ALOT because your video does show that Comodo did do a terrible job.
But then again this is just a meaningless sample test, lets hope the do better in realworld.

 

[nsm0220]

Nice review, but Opera's has a better web protection then Comodo it seems and this made me laugh HARD
Granted Comodo's interface looks great other vendors have similair GUI's.
And it looks like Comodo is getting weaker and weaker.
With all do respect but i can hardly call it protection anymore as their rivals just do so much better, considering CIS use to be a rather solid product.
Its running things isolated by default which obviously is nice, as it does make up for their lack of detection, on the otherhand running it in isolation gives the user the idea that the file might be clean while comodo just does not know it and hence run as isolated.

As you know i am NOT a fan of them, and i would not support them ever.
But i hate to see them go as they do have potential.

If you view your own video then you see some files did generate multiple files so these files you found are live ones and missed malware. Also running isolated means if the file is active it runs in sandbox, when the file is no longer in use comodo releases the file and windows takes over again. So if the file is infected then it start infecting otherfiles after being released by comodo sand box.
Because windows index and such will activate the file outside sandbox.
See my point? So if i where to use this program then i would have a very false sense of security and i should worry ALOT because your video does show that Comodo did do a terrible job.
But then again this is just a meaningless sample test, lets hope the do better in realworld.

btw my tests are not meaningless and besides i found a lot of good Zero Day Malware even though there was no rootkit in fodder

 

[Nico@FMA]

btw my tests are not meaningless and besides i found a lot of good Zero Day Malware even though there was no rootkit in fodder

No no the i did not mean to say in a disrespectful way.
I did mean to say that this is just a isolated test where you run all kinds of malware on your pc and this does not happen in the real world.
In the real world comodo does not have to deal with 20 virusses in short succession but just on or 2 a month so i assume that comodo will run a bit better on a real world situation.
Thats why i said meaningless its just a snap shot you see, maybe with the next update the suddenly become better as comodo does jump around in detection rates and effectivenes percentage wise.

Cheers

 

[nsm0220]

No no the i did not mean to say in a disrespectful way.
I did mean to say that this is just a isolated test where you run all kinds of malware on your pc and this does not happen in the real world.
In the real world comodo does not have to deal with 20 virusses in short succession but just on or 2 a month so i assume that comodo will run a bit better on a real world situation.
Thats why i said meaningless.

Cheers

okay i understand but you know why i do zero day testing

 

[Nico@FMA]

okay i understand but you know why i do zero day testing

I understand hence why i said nice review.

 

[cruelsister]

Comodo at default levels will allow a trojan to spawn a daughter, usually into Roaming or temp. This always happens. To see if it is any way relevant you must check to see if on reboot any malicious files are actually being loaded into memory (which in turn would verify if any autostart procedures were dropped).

Also another thing that should be done in testing Comodo (either CIS or CF) is to actually run the daughters that were dropped to see how Comodo will react (invariably these also would be sandboxed in turn). Some will consider what is in essence orphaned files an issue, but if a trojan is not currently running in memory and does not have the ability to start on reboot does this actually constitute an infected system? If this test had been run in Full V mode anything spawned off will go into the virtual Roaming (or temp) directory and will be obliterated on Sandbox reset. Nothing would have remained on the actual drive.

Another good thing about Full V is that for any application sandboxed the resultant application windows will have a Green border, so there is no guessing whether it is being contained or not.

But thank you for taking the time to do the test!

(Not that I want in any way to burden you, but if you ever find the time try this:
1). Install Comodo Firewall.
2). Shut off HIPS
3). Set sandbox to Full V
4). Run 10-20 files known to be malicious (don't bother with malware links).
5). Either clean sandbox or reboot and seek any system changes to the best of your ability.)

 

[nsm0220]

Comodo at default levels will allow a trojan to spawn a daughter, usually into Roaming or temp. This always happens. To see if it is any way relevant you must check to see if on reboot any malicious files are actually being loaded into memory (which in turn would verify if any autostart procedures were dropped).

Also another thing that should be done in testing Comodo (either CIS or CF) is to actually run the daughters that were dropped to see how Comodo will react (invariably these also would be sandboxed in turn). Some will consider what is in essence orphaned files an issue, but if a trojan is not currently running in memory and does not have the ability to start on reboot does this actually constitute an infected system? If this test had been run in Full V mode anything spawned off will go into the virtual Roaming (or temp) directory and will be obliterated on Sandbox reset. Nothing would have remained on the actual drive.

Another good thing about Full V is that for any application sandboxed the resultant application windows will have a Green border, so there is no guessing whether it is being contained or not.

But thank you for taking the time to do the test!

(Not that I want in any way to burden you, but if you ever find the time try this:
1). Install Comodo Firewall.
2). Shut off HIPS
3). Set sandbox to Full V
4). Run 10-20 files known to be malicious (don't bother with malware links).
5). Either clean sandbox or reboot and seek any system changes to the best of your ability.)

btw i did reboot the vm after the 1st time scan with hitman pro and the scan still found the files in ?. aslo i will let comodo know that type of zero day protection let bad malware like that in the windows folder is a big no no.i mean even gdata behavior blocker would had stop the malware in ? as well