Is COMODO good choice for Antivirus ?

[Rolo]

I should clarify: Wouldn't any AE be redundant with any whitelisting/default-deny software, even if it jails it in a sandbox?

 

[hjlbx]

I should clarify: Wouldn't any AE be redundant with any whitelisting/default-deny software, even if it jails it in a sandbox?

Comodo calls their system default deny, but it is not true default deny like an anti-executable. When Melih speaks of default deny he means sandbox isolates physical system from softs run in sandbox. A true AE blocks the execution of a soft...

Comodo can be configured to be an AE by creation of a sandbox rule to block all Unrecognized files and de-selecting "Trust files installed by Trusted installers and Trust files signed by Trusted vendors."

If you configure Comodo to be an AE then the introduction of any new software - including Windows updates - is problematic. They will install, but be treated as Unrecognized. User can solve this issue by either disabling the configuration before installing softs\updates or add the new softs\updates to the local Trusted file list. Adding to the Trusted file list can take about 20 - 30 mins for C:\Windows... so some will find the second method a nuisance.

 

[Rolo]

Isn't that essentially how VoodooShield works? You turn it off so it adds what you're running to the whitelist and you turn it on to use said whitelist.

 

[hjlbx]

Isn't that essentially how VoodooShield works? You turn it off so it adds what you're running to the whitelist and you turn it on to use said whitelist.

VS adds files to whitelist automatically in Learning Mode (off). Alternatively you can train Comodo HIPS in Training Mode to create Allow rules - but for best results I add files/folders to Trusted file list manually.

Comodo does not automatically add files to Trusted file list - even System32 files - since not all are digitally signed by Microsoft. This means user must manually manage Comodo local file list... it is a bit of a rigmarole.

VS is faster and more efficient for user. Comodo's AE is not perfected... some file types can bypass it - and no one is sure if it will be fixed.

So in meantime, I use VS on one system and NVT ERP on another. On third I use AppGuard.

 

[Sloth]

First of all, sorry for bumping an old thread as I'm unsure if its allowed in this forum.

I would not depend upon Comodo AV for anything but malware older than 4 weeks...

I gather Comodo's approach is that an AV and malicious web/content filtering are auxiliary layers of protection since the sandbox will "handle" whatever is downloaded and run on the user's system.

If you would not depend on Comodo AV then your signature says that you are using CIS?

 

[hjlbx]

First of all, sorry for bumping an old thread as I'm unsure if its allowed in this forum.



If you would not depend on Comodo AV then your signature says that you are using CIS?

@Sloth

I do use CIS. I rely upon the sandbox, firewall and rule sets much more than the AV. For typical use - my use - which is rarely download and install new softs and even more rarely visit questionable sites - CIS has proven to be quite good for me.

Best Regards,

HJLBX

 

[VladDracul]

Totally true- that's why CF has a Firewall setting to prevent sandboxed files from accessing the network.

Where is that setting btw?

 

[hjlbx]

Where is that setting btw?

Select Do NOT show firewall alerts and set firewall to "Block all requests." That this setting blocks Unrecognized file access to the network is not immediately obvious...

but think about it... firewall alerts are generated generally only for Unrecognized files making outbound connects, right?

 

[MalwareT]

I use block option to prevent some programs accessing internet.

 

[VladDracul]

Select Do NOT show firewall alerts and set firewall to "Block all requests." That this setting blocks Unrecognized file access to the network is not immediately obvious...

but think about it... firewall alerts are generated generally only for Unrecognized files making outbound connects, right?

Okay...that's why i always set my Comodo FW to "Custom Ruleset" and i want to be always alerted by new connections.

 

[Sloth]

@Sloth

I do use CIS. I rely upon the sandbox, firewall and rule sets much more than the AV. For typical use - my use - which is rarely download and install new softs and even more rarely visit questionable sites - CIS has proven to be quite good for me.

Best Regards,

HJLBX

Select Do NOT show firewall alerts and set firewall to "Block all requests." That this setting blocks Unrecognized file access to the network is not immediately obvious...

but think about it... firewall alerts are generated generally only for Unrecognized files making outbound connects, right?

Great, I'm using that setting now. Thank you very much.

 

[Derek J O'Brien]

I use Emsisoft and Malwarebytes as my anti malware, with Online Armour as my firewall; I have few problems, even with outlandish plugging around different sites. I recently updated Comodo Dragon, and since then I have been pestered with nagging popups asking me if I want to instal Comodo Security.
If Comodo have to go about nagging their browser customers to instal their security system, they are making a big mistake as it infuriates the customer to have nagging popups appear every 12 hours.
In my case I am giv ing Comodo 48 hours to kill the popups by update, else Comodo becomes history as far as I am concerned.

 

[shmu26]

last time I used comodo, try as I might, it kept on sandboxing a couple processes, even after whitelisting them and making sure they were trusted vendors.
One of them was an intel process, I think it was the gui for the integrated graphics.
any insights on this?

 

[SHvFl]

last time I used comodo, try as I might, it kept on sandboxing a couple processes, even after whitelisting them and making sure they were trusted vendors.
One of them was an intel process, I think it was the gui for the integrated graphics.
any insights on this?

Did you try CIS/CFW or CCAV? Because CCAV used to have the problem you mentioned but not CIS/CFW from what i know.

 

[shmu26]

Did you try CIS/CFW or CCAV? Because CCAV used to have the problem you mentioned but not CIS/CFW from what i know.

thanks
I am pretty sure it was CCAV, actually.
btw, does CFW get along okay with HMPA?

 

[SHvFl]

thanks
I am pretty sure it was CCAV, actually.
btw, does CFW get along okay with HMPA?

No idea. CFW really hates other programs a lot though. Try it because i didn't.

 

[yigido]

last time I used comodo, try as I might, it kept on sandboxing a couple processes, even after whitelisting them and making sure they were trusted vendors.
One of them was an intel process, I think it was the gui for the integrated graphics.
any insights on this?

If the files were Intel files (with digital signature of Intel).. there is no option to sandbox them.
Are you sure about they are digitally signed files by Intel?

 

[Tony Cole]

Antivirus i.e., detection abilities (simply put) NO! Firewall and sandbox is very good - I just do not trust them, never keep their promises re: version 9.

 

[yigido]

Antivirus i.e., detection abilities (simply put) NO! Firewall and sandbox is very good - I just do not trust them, never keep their promises re: version 9.

There will be no version 9.. it is now version 10. You can follow it. They just changed the name.
Comodo never keeps promises about the release dates..you are right about that.

 

[LukeNukesEm]

I should clarify: Wouldn't any AE be redundant with any whitelisting/default-deny software, even if it jails it in a sandbox?

Yes and no. Comodo has one of the best firewalls and I like the sandboxing. As far as detection ratio it sucks, but if a virus does get on it the firewall will most likely stop it from doing anything. Because of that I like to think comodo as one of the top dogs, but not necessarily the best.