Which Product to develop next?

[Guest]

[DaRtH VaDeR.]

I would like to see Comodo to develop a app like Returnil. The possibility to work in a virtualized environment

I believe they already are developping such a product, but more powerfull....

[Melih]

I believe they already are developping such a product, but more powerfull....

called Comodo Time Machine.... (it was initially called Comodo Disk Shield)..

Melih

[.FaZio93.]

called Comodo Time Machine.... (it was initially called Comodo Disk Shield)..

Melih

i'm guessing that's the "cure" in CIS?....

 

[3xist]

i'm guessing that's the "cure" in CIS?....

 

Yes... And from what I hear it will be the cure being integrated into CIS.

Cheers,
Josh

[.FaZio93.]

Yes... And from what I hear it will be the cure being integrated into CIS.

Cheers,
Josh

yea, i think Melih kind of leaked that in another thread (or just felt like teasing us.) 

[SecurityManiac]

Great. I guess I missed that one. I'll have a look right a way

[andyman35]

Seems promising.

It certainly does ! From the bits of information that have surfaced so far this could well be an industry-leading product,very exciting.

[.FaZio93.]

What about a memory scanner? The way ThreatExpert Memory Scanner works (http://www.threatexpert.com/memoryscanner.aspx).

Just crossed my mind, as I was at that site.

Regards

COMODO BOClean maybe?

[.FaZio93.]

Can BOClean do this?

Sometimes threats may potentially slip under the radar of conventional malware scanners by engaging in stealth techniques to hide their presence on a PC. Often, in such a scenario, the original threat file is encrypted with polymorphic encryptors which rely on anti-debugging and anti-emulation techniques, presenting a challenging task for malware scanners attempting to detect it. Such techniques are used by threat families including Citwail/Pandex/DieHard, Storm, Mailbot/Rustock and some others.

However, when such a threat is loaded in memory, it needs to decrypt its own malicious code, completely or partially, or it is unable to run. This is where TEMS comes in; by using advanced techniques it is able to detect traces of these threats in memory and alert you of their existence.

Regards

I'm not an expert on this, but I would say BOClean is very similar to TEMS in the way that it is not a normal malware scanner and detects those buried malwares in memory.

"In computer terminology, polymorphic code is code that mutates while keeping the original algorithm intact. This technique is sometimes used by computer viruses, shellcodes and computer worms to hide their presence."

Like I said, not sure about all that encryption "stuff" but I do know as long as the original malware sample is in the BOClean database, it can detect all variants of that code (the majority of malware out there today are just variants).

[LeoniAquila]

I think you're right FaZio. As for encryption, I think any encrypted malware needs to decrypt before trying to load and reveal itself in the memory. Then BOClean sits there to catch it.

[BruceFreeburger]

There are all kinds of people in my church and community who are still using old Pentium III computers. I have rebuilt them and bought used P3's at computer shows for others. These are reformated to run Windows 2000 Pro. Comodo Internet Security does not support Windows 2000. There is a real need for a free anti-virus and firewall that does not hog resources on these PIII systems.
  I could understand making CIS run, but not allow Internet Explorer 6. But really, CIS should run on Windows 2000.

[LeoniAquila]

Something slipped my eyes before. ThreatExpert Memory Scanner does not base it's detection on signatures. So, I'm guessing that, perhaps, improving BoClean that way, would be the best way? Perhaps a mixture of both - non-signature and signature. Would cover more bases, I think.

Just something that crossed my mind.

Regards

OK, thx for the info.

[DaRtH VaDeR.]

How about Comodo would develop a personal nanny /housekeeper that would do anything you say....(read: making food, shopping for you, breakfast on bed, cleaning etc...)

Ok, It is a bit off topic, still it is a product and it is security related, the nanny prevents me from eating wrong stuff or hurting myself in another way..... ....

ooh, yeah I see the mods coming..... they are heavily armed and ready to start moderating me to death.....    

[panic]

Comodo obviously need to develop an Off Topic Whacking Stick. 

 

[LaserWraith]

Comodo obviously need to develop an Off Topic Whacking Stick. 

 

Errrr....mods are good enough with whacking already, no need to add..em..."unnecessary bloat".

[Tags:]