I’ve noticed that Comodo and Defense+ have to be fully running before it starts to detect behaviour. If you have files in your startup locations in XP SP3, and they load up before Comodo has initialized, they go undetected.
I tested this by giving Explorer.exe ask permissions, including when executing another file as it may do on startup, then placing a shortcut in the startup folder calling an external unrecognized exe file. When Comodo was fully loaded, it detected Explorer.exe trying to run a file. On boot however, it didn’t initialize in time to catch it.
Now, there is an option in defense+ to block all files when Comodo isn’t loaded. This works as advertised, but it also stops the blocked files from loading so breaks the Windows startup procedure and therefore can’t be left enabled.