- Feb 28, 2023
- 126
"The big problem with Comodo is its anti-malware engine which is for me the BADGEST I've ever tested!"
Because you did not zoner/zillya/protegent
Because you did not zoner/zillya/protegent
Comodo Internet Security Premium Free 2023
- Thread starter Shadowra
- Start date
It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
@Shadowra
I rewatched the video. It's hard to review the test without text or voice, and things are tiny in the video. What I could make out is that the malware encrypted the files in the Downloads, two files on the Desktop, and the only file on the DVD. Am I right?
DVD: It contains the malware folder you copied on the desktop, right?
Downloads: Comodo containment excludes it; the contained malware can modify the files. @cruelsister Please correct me if I'm wrong.
Desktop: What are the two files the malware encrypted?
I rewatched the video. It's hard to review the test without text or voice, and things are tiny in the video. What I could make out is that the malware encrypted the files in the Downloads, two files on the Desktop, and the only file on the DVD. Am I right?
DVD: It contains the malware folder you copied on the desktop, right?
Downloads: Comodo containment excludes it; the contained malware can modify the files. @cruelsister Please correct me if I'm wrong.
Desktop: What are the two files the malware encrypted?
Last edited by a moderator:
- Sep 2, 2021
- 2,586
Ransomware encrypted malware folder, desktop and download yes.
And it is visible
Sorry if it's tiny, I render in 1440p but Odysee force in 1080p....
I already posted about the downloads folder.Ransomware encrypted malware folder, desktop and download yes.
And it is visible
Sorry if it's tiny, I render in 1440p but Odysee force in 1080p....
Did you insert the DVD with the malware folder in the DVD drive (to have it in the drive ready for the test) before the CIS installation?
It would be helpful if you could tell me about the two files the malware encrypted on the desktop.
Last edited by a moderator:
YT takes down a lot of AV videos for stupid reasons ranging from biased to "hacking"
- Sep 2, 2021
- 2,586
Why are you talking about DVDs?
The malware package is a RAR archive that is copied after the installation of Comodo and after the URL test and the fake crack test.
The 2 files on the desktop, you have an .ini of my desktop configuration and the .txt that contains the malicious URLs.
YouTube doesn't really appreciate tests and the AI detects it as hacking
the channels that stay usually have a network or don't have the same visibility as my channel (and I made a post when I had my YouTube channel removed... and Odysee I'm free to do what I want on it, and I like that )Ok, I just want to know how you copied the malware package.
from the host machine?
from a location on the VM you were testing CIS on?
from a disk or USB, and were they inserted or attached before the CIS installation?
- Sep 2, 2021
- 2,586
Yep it's copied from my host PC
If you install VMware Tools, you can copy files from your host PC to your VM
Of course, my VMs are isolated so that a malware can't attack my home computer.
Btw @Shadowra you should note in the main post that this is the basic protection from CIS, not that of CFW CS because everything would be blocked, unfortunately CIS is still very bad at protecting anything, they know it but wont change it (maybe after the brand name changes but for Comodo its not happening)
- Sep 2, 2021
- 2,586
You can ask the questions about my review, I will be happy to answer them!
@Shadowra I appreciate your work. Keep it up. Thank you!
I believe the malware could encrypt the files in the downloads folder because of a weak containment setting, "do not virtualize access to the specified files or folders." It is not a Comodo containment bypass.
From Comodo help files: Containment Settings, Containment Computer Security, Desktop Software | Internet Security
By default, contained applications can access folders, files, and registry keys on your local system, but cannot change them.
The "Do not virtualize..." settings let you create exceptions to these policies if required.
The rest is a .txt file encrypted on the desktop. If my memory serves well, there is a minor issue with the default config: ransomware could create the ransom note .txt file on the desktop or could encrypt a .txt file on the desktop, something like this. I guess @cruelsister could shed light on this.
I believe the malware could encrypt the files in the downloads folder because of a weak containment setting, "do not virtualize access to the specified files or folders." It is not a Comodo containment bypass.
From Comodo help files: Containment Settings, Containment Computer Security, Desktop Software | Internet Security
By default, contained applications can access folders, files, and registry keys on your local system, but cannot change them.
The "Do not virtualize..." settings let you create exceptions to these policies if required.
The rest is a .txt file encrypted on the desktop. If my memory serves well, there is a minor issue with the default config: ransomware could create the ransom note .txt file on the desktop or could encrypt a .txt file on the desktop, something like this. I guess @cruelsister could shed light on this.
Last edited by a moderator:
- Aug 19, 2019
- 1,169
The default is having that ticked which is why @cruelsister unticks it in her configuration Cruelsister Config
- Aug 19, 2019
- 1,169
Similar threads
-
- Locked
