I downloaded and installed COMODO Internet Security 5.8.202876.2065 BETA. The installation was swift. I was surprised that I cannot make a custom install as I have AIS v6(without the firewall and Behavioral Shield) but proceeded to go on. Upon restart it disabled Avast. I allowed that telling myself "why not --test the Comodo AV for a change.
So I updated and it seemed like forever to download the updates for the virus database update which was 78.9mb. Waited until it finished.
Scanned “My Computer” and it detected a whole bunch of trojan/malware and suspicious files.
Now I scanned with Avast and it said I was clean. Scanned with Malwarebytes and it said I was clean except 1 file.
An encrypted .rtf file (encrypted with Glary Utilities) was detected as Heur.Dual.Extensions[at]1z141z3. It was surprising to see that it was just a confidential file I saved from the office which was scanned gazillions of times with Norton 360(office)/ APSS v10…etc.
A driver file from the Asus website for an old P4S133 mobo was detected as TrojWare.Win32.Inject.~AF[at]hzje. Scans for Avast/Mbam are clean.
There were a lot of files marked as Suspicious[at]#2njp71ngjzbsk mainly a driver (Promise SATA378 Driver) from Asus website for the old mobo K8VSE Deluxe. Even my Everest Ultimate Edition ver4 and SensorsViewPro32 which I use to check motherboard/core temperature/performance is “suspicious”. Picpick.exe --screen capture utility too. Particular files are legitimate and as previous scans with Avast/Mbam was clean.
I also have a copy of all those files in another pc which had Avira Premium Security Suite v10(without the firewall) Outpost Pro v7.5.1, Mbam Pro, PrevxSOL. All my security apps did not detect “all that CIS detected except the single file I mentioned earlier”.
That particular single file has been placed in Quarantine/removed/deleted.
Now this is a first for me having a whole lot of FP’s on a first scan but then again It’s been years since I tried the Comodo AV component again.
Normally I often get FP’s from Avira and some from Avast/PrevxSOL/HitmanPro(not on a single pc).
I will send what I can to VT for testing but I am hindered by the file capacity sealing. My internet connection is a dial-up and it’s only seldom I use my dsl connection as it’s flaky and often when your in the middle of something…bam…server timeouts for what like seem to go for yonder.
That too maybe the case with Comodo as earlier I wanted to submit a file and it said “file is too big”.
Questions:
a. Is the virus database update normally around the area of 78.9mb or it’s more? I ask because as my connection is slow I may have a problem with it.
b. What url servers can I use/add to the Preferences/Host to make my update a little faster? I am in the Asia. If I get a URL to place there, say, 2 o3 3,is it advisable to check it all?
c. When it showed the detections, there was “Clean” and “Ignore” button. I did not opt for that but closed the pop-up for I needed to see the results for Avast and Mbam . Then I changed the appearance from “silver” to “black”. I was surprised to see in the “Summary” that there is “0” detections in the AV component.
Is that normal or it was the way I responded(or not responded) to the pop-up? It asked if I was sure to close the results window. Does closing that window result in what happened?
I went through Windows Explorer to look for the files. CIS AVgave a pop-up whenever I was to right-click the file in question for Scan with either Avast/MBAM. There was a pop-up>Ignore>Once/Add in Trusted/Submit to Comodo/
d. This particular version is very light! I am testing it alongside AvastIS with the exception of WebShield and seems okay. But I do not intend to run both the AV component at the same time. It’s only now as I am testing/doing second opinion scans.
All exclusions have been set on both parties so if there would be some incompatibility it would be as little as possible. I seldom use(don’t like) the Avast Sandbox and the Auto-Sandbox/SafeZone is disabled. I am using SBIE paid version in all browsers, all with Drop-My-Rights.
Is there anything that I should be wary about?
e.If I can’t send the FP files to Comodo or VT, what can I do further? Seems to me the suite is okay. Been using CIS without the AV component since 2007(I think) so this FP’s are a shock to me. I scanned with CIS AV again and the result was the same.
I mentioned earlier I never had any experience like that. A missed file ot two but never that many AND no serious infection since 2007. I am really careful now(running second-opinion scans with on-demand security apps). But my main goal is to later light to I go for testing the whole suite.
If I can’t send the FP files to Comodo or VT, what can I do further?
f. I have a problem with shell32.dll. CIS says it’s “unknown” and I cannot send it becaue it’s too large. Scans via Avast and Mbam are clean. See pic.
http://www.freeimagehosting.net/t/704d3.jpg
All in all I seem to like it. Just the AV part is making me think…
It’s been a long one and I’ll finish up now.
Thanks and I hope to hear from you soon.
malik
[attachment deleted by admin]
