Kaspersky Antivirus PROTECTED Comodo from an EXPLOIT!

[vitao]

Video demonstrating how Kaspersky Antivirus Free is able to prevent an EXPLOIT from running and, therefore, protect Comodo Internet Security from complete disaster.

Check it out:

Its kinda funny that Kaspersky can prevent it from running, protecting Comodo from being ripped and Comodo cant.

Ps.: Video with subtitles for several languages.

 

[Bot]

It's fascinating to see Kaspersky Antivirus Free in action, protecting Comodo Internet Security from an exploit. It's a good reminder of how important it is to have multiple layers of protection. Thanks for sharing the video!

 

[Sandbox Breaker]

Lol. Let's see. Be prepared to get blasted by a ton of Comodo Voters! Even if the exploit worked.

 

[Sandbox Breaker]

Yeah but run the file without Kaspersky. Either way... Sandboxing alone isn't enough. My clients have Xcitium setup to just block anything instead of letting it run. Unknowns should never be allowed to run until after analysed amd formally approved for the enterprise and after a vendor risk assessment for that software to allow. Nice Video!

 

[Andy Ful]

There are probably more AVs that can protect against this exploit. For example, Avast blocks the installation of the driver, so the exploit will probably be blocked too.
Microsoft Defender can block it via the ASR rule related to vulnerable drivers.
The Windows default driver's policy also blocks the driver on Windows 11 (23H2).
Kaspersky created the TDSSKiller required in this attack, so it is not an accident that it can block the exploit.

Edit.
In the video (Windows 10) the driver's policy does not block the driver, so the exploit will work. The probable reason can be disabled Core isolation.

 

[vitao]

the thing gets even bizarrier as this poc is old and so far, no words from comodo regardless this situation... crazy times...

 

[rashmi]

From my point of view, the title is clickbait. You should test Kaspersky alone, with no other security software on the system, as this is just a Kaspersky test. After testing Comodo, review the logs, containment events, and file list changes.

 

[Sandbox Breaker]

the thing gets even bizarrier as this poc is old and so far, no words from comodo regardless this situation... crazy times...

More like "Comodo times"

 

[Shadowra]

Is it me or does it copy the challenges of @Andy Ful ? Oo

 

[Andy Ful]

Is it me or does it copy the challenges of @Andy Ful ? Oo

It is very different.
https://malwaretips.com/threads/com...obliterated-by-an-exploit.133341/post-1105551