Is COMODO good choice for Antivirus ?

[JakeXPMan]

I would not depend upon Comodo AV for anything but malware older than 4 weeks...
To me, for the typical user, it is better to prevent malware from getting onto the system in the first place; the AV and web protections should be equivalent to, if not stronger than, the sandbox module in terms of quality of protection.

All this is debatable...

Is there any AV's free or paid that would be strong enough to prevent most malwares from reaching the system?

I always thought the best bet was Avast w/settings, Comodo w/settings. Also Qihoo.

 

[hjlbx]

Is there any AV's free or paid that would be strong enough to prevent most malwares from reaching the system?

I always thought the best bet was Avast w/settings, Comodo w/settings. Also Qihoo.

There is also different approach: anti-executable (AE).

With AE softs can be downloaded, but not executed\installed - this includes exploit payloads. Plus, all interpreters (e.g. commandline, powershell, cscript.exe, wscript.exe, etc.) are disabled by default.

1. Start with clean PC (clean install of OS).
2. Custom install desired softs.
3. Install anti-executable.
4. White-list all softs on system.
5. Lock-down system.

Anti-executable, used properly and with discipline, essentially negates over-dependence upon AV signatures. However, you still need outbound network notifications... The AV and firewall are there to protect the system should the AE ever be bypassed (it is very rare, but it can happen = AEs are not absolutely bullet-proof, but they are extremely close).

Freeware anti-executables = VooDooShield and NoVirusThanks Exe Radar Pro (beta versions at Wilders Security; betas extremely stable).

You can also create rule in Comodo sandbox to block any Unrecognized files (almost as good as AE, but current version can be bypassed by certain types of installers).

 

[JakeXPMan]

That has more to do with exposed ports\port detection\inbound penetration by others.

If your system sits behind a NAT router you have to set up port-forwarding for any firewall - not just Comodo's - to fully manage ports via the firewall.

Yes lol. All firewall settings, set! Comodo FW might have had trouble with my old CPU, as the instructions are missing SSE2? or 3... I can't remember but I have a new PC on the way to replace this outdated HP Compaq.

I did notice when I uninstalled CIS 8.1 the cloud dissolved, or things got a second faster, even the mouse,... like a magnet was pulled off the PC. This is what you talked about before, that CIS applies "weight" on the system.

Not a big weight overall, it just indicates its working!

 

[hjlbx]

I did notice when I uninstalled CIS 8.1 the cloud dissolved, or things got a second faster, even the mouse,... like a magnet was pulled off the PC. This is what you talked about before, that CIS applies "weight" on the system.

Not a big weight overall, it just indicates its working!

After version 8.2.0.4508 the system impact went down dramatically on my systems. Versions 4508 and 4591 have been only noticeable at system reboot - or when running a full system scan (any AV has this problem - even Webroot takes over an hour to complete full system scan; their default scan is "Custom" and only scans a very limited number of directories + registry entries).

 

[JakeXPMan]

There is also different approach: anti-executable (AE).

With AE softs can be downloaded, but not executed\installed - this includes exploit payloads. Plus, all interpreters (e.g. commandline, powershell, cscript.exe, wscript.exe, etc.) are disabled by default.

Freeware anti-executables = VooDooShield and NoVirusThanks Exe Radar Pro (beta versions at Wilders Security; betas extremely stable).

Nice info on how the AE's work. How would MB Anti-exploit do in the line of fire... ?

I used to use this, but after months I removed it, never got an alert from it.

 

[hjlbx]

Nice info on how the AE's work. How would MB Anti-exploit do in the line of fire... ?

I used to use this, but after months I removed it, never got an alert from it.

I use MBAE free... but I rely upon keeping all softs that are routinely exploited fully updated with security patches.

MBAE free will only protect browsers - so it is really limited protection. I question its value, but I am too lazy to uninstall it.

My current favorite freeware system setups = CIS free + PeerBlock free + MBAE free + VooDooShield free + MBAM free. On other system instead of VS I use NVT ERP + PhrozenSoft Virus Total Uploader (free).

They all work together (except on W8.1 PeerBlock startup must be created using the built-in Windows Task Scheduler).

If you have Windows 7 then it will be worth your time to look into Quarri My POQ. Do Google search for "Quarri MY POQ."

 

[Tony Cole]

On the Comodo website it states:
Compatibility Windows 7, Windows Vista and Windows XP (32-bit and 64 bit versions available).

So, does it fully work on Windows 8/8.1?

 

[hjlbx]

On the Comodo website it states:
Compatibility Windows 7, Windows Vista and Windows XP (32-bit and 64 bit versions available).

So, does it fully work on Windows 8/8.1?

Yes. Enhanced Protection Mode = 64-bit system hooking.

I use CIS, ESET and Emsisoft on different W8.1 systems.

 

[Tony Cole]

Wow, that's a lot of security software to run, that would confuse me, as it would need expertise, something I lack. Do you have to set up any exclusions?

 

[hjlbx]

Wow, that's a lot of security software to run, that would confuse me, as it would need expertise, something I lack. Do you have to set up any exclusions?

Not as bad as you might expect... all of it is essentially "set-and-forget" - except Comodo, of course.

Once one learns how to configure CIS - and what to expect - it is essentially "set-and-forget" too.

CIS has some quirks - just like every other AV - that may initially confuse novice user; as well all know, Comodo is not perfect - but it is improving. The user can configure CIS to be "noisy" or silent. In "silent mode" it simply requires an occasional gander at the logs - and perhaps a tweak or two now-and-then.

VooDooShield and NVT ERP are easy to learn.

No exclusions required.

For typical use I am finding CIS is more than enough - just like all other AVs I've tested; most advanced AV features - from all vendors - are there "just-in-case" and very rarely, if ever, necessary.

I am a proponent of the deny-by-default school of IT security... so CIS is right up my alley.

 

[Tony Cole]

Which other security suite offer(s) a default deny policy, I believe Kaspersky now does and offers dynamic whitelisting?

 

[hjlbx]

Which other security suite offer(s) a default deny policy, I believe Kaspersky now does and offers dynamic whitelisting?

Comodo and Kaspersky... that is it as far as I know... and both require settings\configuration changes to enable default-deny.

Kaspersky just needs to fix that Application Control - Trusted Application Mode bug.

Comodo just needs to fix its AE bypass by certain types of installers bug.

If I only used "perfect" security software I'd be using nothing...

 

[darko999]

I run ESET nod32 AV alongside Comodo firewall HIPS Only works great.

 

[hjlbx]

I run ESET nod32 AV alongside Comodo firewall HIPS Only works great.

I was thinking about Avira free + CF, but in the end didn't do it = too lazy...

NOD32 and CF is solid combo.

 

[Kate_L]

They also need to fix the installer, a lot of people told me that the during the installation it will get stuck at 65% and then the internet settings will be messed, you can't connect. Also if you get an error during the installation you will get half COMODO installed and you can't remove it from Control Panel, the leftovers will not let you do anything, there is a low chance that you will install other security product, the diagnostic tool doesn't work at all.

Another downside is that you can bypass with portable applications or .pfa

If you can install and configure it, you can have a small fortress

 

[Tony Cole]

How do you stop data being sent out via the Comodo firewall? Yes I agree 110% they need to fix their application control and trusted applications mode. I did try their business select package and it's very, very good - expensive, but good.

 

[hjlbx]

They also need to fix the installer, a lot of people told me that the during the installation it will get stuck at 65% and then the internet settings will be messed, you can't connect. Also if you get an error during the installation you will get half COMODO installed and you can't remove it from Control Panel, the leftovers will not let you do anything, there is a low chance that you will install other security product, the diagnostic tool doesn't work at all.

Another downside is that you can bypass with portable applications or .pfa

If you can install and configure it, you can have a small fortress

I haven't experienced any of the installation problems since version 8.2.0.4508, but I know they've been reported. Bummer. I know what it is like as I had a lot of problems with version 7 and early 8 installations.

I, as well as others, have active bug reports about .pfa bypass. We'll have to wait and see what Comodo development does - if and when...

I have mine configured to block all Unrecognized files (deny-by-default)... CIS web protections are absent but I've added PeerBlock.

CIS can be a mean little beast if properly configured\supplemented.

 

[hjlbx]

How do you stop data being sent out via the Comodo firewall?

For Unrecognized files you can set the firewall to block all network requests... alternatively, you can configure the sandbox to block the execution of any Unrecognized files (same as Kaspersky's Application Control "Untrusted" zone).

There are multiple ways to achieve the same or equivalent results in CIS - which - can cause confusion and drive some people crazy...

I suppose typical user just needs one way to solve problem... I, on other hand, don't mind permutations.

 

[Rolo]

My current favorite freeware system setups = CIS free + PeerBlock free + MBAE free + VooDooShield free + MBAM free.

Wouldn't PeerBlock be redundant with CFW and wouldn't VooDooShield be redundant with Comodo's sandbox?

 

[hjlbx]

Wouldn't PeerBlock be redundant with CFW and wouldn't VooDooShield be redundant with Comodo's sandbox?

CFW does not block IP addresses.

CFW sandbox is not an anti-executable... unless you create rule for it.