I am also on the remove-malware site and I know that Matt (the owner of the site) right now is doing a review of the new CIS 3.9. This should be the first fairly official review. I have been keeping an eye on his tweets, they are as follows:
@nico_V I was surprised too…never seen anything get past comodo yet
about 3 hours ago from Tweetie in reply to nico_V
Working with comodo 3.9 tonight and tomorrow…I actually have to take notes since there are so many things to talk about with CIS
about 3 hours ago from Tweetie
@nico_V it was tested with d+ on safe mode.
about 3 hours ago from Tweetie in reply to nico_V
I’m submitting this virut sample to the comodo team. Heads up guys… It’s called mail.exe
I wonder if using Proactive Security (all monitor settings checked and image execution set to Normal) would have prevented Virut from bypassing D+. It makes me doubt the effectiveness of the default Internet Security settings (Window Messages, DNS/RPC Client Service, Computer Monitor, Disks, and Keyboard are unchecked and image execution is Disabled). Matt should review CIS using Proactive Security.
The only thing I would like to see added was like he said, alert that maybe would stand out better and that submit to comodo button, how would you do that. You would have to save the file, go under misc tab and submit it. A button on the alert would be best. But I am happy that the antivirus is doing so well, it found what, half of the links just by itself.
I was somewhat disappointed by the review. Not the results but the way it was done. I also would like to see the same sort of test done with the default settings you get when you first install.
I think there should be like on the antivirus pop ups a move to quarantine. then you could submit it from there. Or a single button with quarantine and submit to comodo.
I found it odd that the guy who does these reviews of all the security products doesn’t use any of them. He stated that he uses a free AV and the Windows firewall and called using a software firewall paranoid. I am not impressed.
The most inportant thing this video pointed out is that there is difference as to what Internet security and Proactive setting can prevent… =/
Maby the default Internet security settings should be raised just a little in coming versions to prevent drive by downloads better…
No need for the default to monitor keyboard and stuff, but execution prevention in class with proactive settings by default wouldn’t hurt… =]
