Protection vs Cleaning….two very different things!

Welcome to the family, brother! :wink:

this was the first time where i saw a promotion video that tries to explain why this product is better when it has less function!?! my view of comodo is, they add stuff against threats. and if they invent an antivirus, i would have thought, this would be made like all their other products, best as possible. this video doesnt fit.

“antivirus was invented as cleaning”… so its not allowed to develop?
anyway, when an unknown threat hits you on monday, why should the antivirus not be able to clean on thursday? you describe antivirus as a static disk, fails today=fails tomorrow. since there is persisting memory, antivirus had to be protecting and cleaning. until default denies came in the spot, antivirus were alone. that is not enough to speak bad about it. i would instead speak good about default deny :wink: .
you might wonder now, but i would re-install my system if i get hit by an infection, even if i would have a superthingpromoted cleaning antivirus. BUT i want all aspects to run the best they can. so i want a good meant antivirus too! i dont feel better if i get a half one. its still a layer.

i began to use comodo defense+ as it was “invented as” purely default deny. no sandbox, no antivirus. it protected you against all things which you wanted to deny. and it was a good decision for sure! but this didnt protected you when you wanted to allow something. and so comodo added other technics (developed the product). for me its the same as a signature update (for pre-alarming AND post-infection-cleaning) of an antivirus.
while default deny is static and very effective! antivirus is “fluid”, but should also be effective in its borders, at least (by design) on “the other day”. they co exist perfect.

this video was in the first place just telling a “logical contrast” of words, which on the second sight was nothing more than saying: we believe in our products protection so much, that we even dont think we would need cleaning.
i would expect a whole program. not a “picture” of your trust on my computer.

comodo does protect, and its a good product. i just dont like this pointing with a finger (or one sided logic) on someone, to say we are better. for me its suspect if someone arguments like this. or at least, its the same as all the others with their “half product” who say “you will get the better best”. in this case i saw: “you will get the best protection, look, we even did not inserted a full aspect antivirus.” …this argument does not give something to the user, it more just underlines your opinion in the first place. (i dont doubt the protection level).
this were my thoughts about the video and the single circle logic in it.
is it difficult to insert the function, or is it difficult to keep the contrast if you insert the function? as you made another product for that, i think its the last point. “creating” a contrast to be seen among others.

Yes, cleaning and protect are two different things - but the end-user expects the two functions to be combined in the one product and not to be patronised with the pontifications of those with a different view. I guess it all comes down to marketing; which leads me to an allied subject, that of CCE

CCE is on the downloads page but the auto email instructions were not provided despite several attempts from different computers in different locations. Emails to the support address given on the website are not followed up.

Also, there does not seem to be a forum for CCE in the morass of Comodo Forum topics.

I downloaded CCE from a magazine site easily enough - but why wasn’t I able to download it from the Comodo site??

It really does look as if nobody cares about anything except Facebook posts about how wonderful Comodo is and how everybody loves Comodo. We live in a world of marketing and ‘smoke & mirrors’ promotions, but it seems that nobody at Comodo really cares about the cares and opinions of their supporters.

I use and recommend Comodo products at every opportunity, but there appears to be a problem with management hubris. This email will probably go unanswered and the CCE download problem ignored. If I am lucky I will be told to send an email to the address that does not follow up their queries.

Hi Topcat, check this link
https://forums.comodo.com/comodo-cleaning-essentials-cce-killswitch-cce-b246.0/

the point is not only are they different but its an oxymoron to expect a “cleaning” product from a company who failed to “protect” you from that specific threat. So AV doesn’t protect you from Virus XYZ and then we expect that AV to clean this XYZ after it infected us.

There is no practical use case to have a cleaning product from the same company who we have the Protection from. Cos if the protection failed its unreasonable to expect it to clean. Any decent malware would then disable the AV that failed in protecting the user. So even if the AV claims that they will add detection afterward, its too late, the infection will stop any communication with the AV company and so on…

So the point is: computer can exist in 2 state
1)clean
2)infected

if its in a clean state, you need protection no need for cleaning. And no point in putting cleaning from the same company as its an oxyhunk.

hope this clarifies

Melih

Mod edit to correct an autocrrect insertion.

in this described ideal “status”, you are right.

but how often did i see situations where someone first tried to let something run with all features enabled. then trying to let things run with more and more reduced features, and in the end its the trainings mode or the disabling which is the “last try”.
default deny and sandboxes have the bad side effect, that they sometimes simply refuse to let you run something (and you have to test, why). having very good protection. but in this cases the USER (especially the average user, the one who is in the first place meant to be protected) can be “tricked” to give up this ideal protection (best example is the “codec” which will never run in the expected way anyway, which only infects. if the user is made convinced about the need for that “codec”, he would in the whole process until infection think, that default deny denied it from running).

an antivirus has by design a very weak point, its the update need, the fact to be maybe unable to detect a zero day thing. but an antivirus doesnt refuse “without reason” to let you run something. it says: danger, thats why!
so its most likely impossible to trick the user into disabling the antivirus. its another form of protection.
its not about “default deny OR antivirus”. its about “both things have their part in a security construction, so both things should be made serious”. for some users infections CAN happen, until user tricking is eliminated in the structure of default deny. until then, desinfection can be needed… when both layers met their “weak point” (user OR too late update).
to make it specific: your argumentation lets (at least me) choose an antivirus from someone else, AND your default deny :wink: … i mean, if you produce an antivirus, why let it look like an unwanted baby? :slight_smile:

the main point why i wrote here is, because you dont argument to let people pay for your product. thats why i take you serious when you speak about protection in the first place!
if we all had said in the past, comodo firewall and defense+ is perfect now, it had reached a “finish”. but this would not have meant, it was finished.

Full Comodo protection PLUS regular scans on two vastly different independent computers in different locations.

Both get the scrambled font virus that hits the registry font entries, and render both computers unusable.

Ask for help on the forum and get redirected to another area where the Comodo man says look at another forum. So i looked at the forum i was referred to and saw only recommendations to do what i said i had already done… Some folk just don’t read what is said.

Not only that but recommendations to use non-Comodo software because CSC is considered unreliable (comments from those we are asking for help).

Get home and check Facebook and get the marketing stuff saying how wonderful Comodo is…

I choose to use Comodo through thick and thin but again I have problems - yet the computers attached to each of my “Comodo” machines via p2p are NOT affected - and they use Microsoft MSE in each location.

Something does not seem right, and nobody seems to care - but I have said that before as you may recall. But i still persevere with comodo. I am starting to doubt the wiseness of my decision however you may be able to help even though you are clearly a very busy man.

I apologise for my reactions to thoughtlessness and stupidity (of others) and ofr my frustration when issues of concern are not addressed but responded to with self-righteous indignation but i really don’t like using forums and only come on to sort out a problem and react when attacked instead of assisted.

Ok, i have a question to Melih.

I use Comodo since version 2ou 3 (don’t quite remember, but i believe i started using it on 2, for testing) and i do love it. Never had a virus problem again and do recommend it to everyone… :slight_smile:

However i have to put a question about the idea expressed on this post:

Imagine i have AV definitions from, for example, Sep 23.
On Sep 24 a new virus reached internet.
On Sep 25 i get infected whit it (since CIS does not know about the existence of this new Virus and i do Allow it to run.)
I update AV database on Sep 26…

Shouldn’t CIS be able to remove this virus i got infected whit?

Thanks

And for all that matters: CIS is the best suite i’ve ever used - You’re doing a brilliant job… (even if i think that the power of CCE should be included in CIS)

  1. AV cloud will warn you.
  2. Auto-sandbox is enabled by default, it’s kinda impossible to get infected.
  3. You can click allow on execution, but there will be more alert that will tell you the risk and I’m sure that you would hit block :wink:
  4. If you would click allow on every alert (even red) it’s your own fault.

well, for all that matters, i kind of think it’s always the user fault. LOL
The fail is always human… so, yes, imagine it’s a very dumb user that does press “Allow” to all…

shouldn’t CIS be able to fix the user’s mistake (since he, latter, would realize his mistake)?

Really, here we need good cleaning functionality.
COMODO refuses to create good healing then maybe COMODO will kindly advise us other AV to clean malware? >:-D

Is this a good start?

Ha, do you expect to install CCE on an infected comp? If to do it in advance - too much fuss in premonition of possible infection.
BTW I filled the CCE form 1 hour ago and no email answer yet and if there were an infection - how long should I wait for email answer? then to download installer, install (and I guess the installer av bases are enormous) … No, that won’t go.

Wow, just found this thread - and I have to say, COMODO has a strange humor…

Melih, may I kindly ask you: What product do you use to protect the PCs of your company?

Neither you nor your marketing department seem to have used your own product - at least you don’t install the AV component, right?

While you’re creating, publishing and promoting a video telling me, that I can’t rely on an AV solution in cleaning, while it failed in protecting me in the first place, your AV component is based on that concept.
It was based on that concept when the video was published 9 months ago and it is based on this concept today!

  • There’s by default a scheduled weekly scan of my hard disk - it’s a waste of resources to scan the hard disk on a regular basis following your argumentation
  • Even worse: A yellow shield warns me, that I didn’t run a complete system scan, when I haven’t completed a full scan for some time - where’s the benefit? If the pc is clean, there will be no benefit in scanning, if the pc is infected, following your argumentation, it’ll be too late.
  • Last, but not least I’d like to mention the stateful file inspection, which scans files only once until the signature database is updated - where’s the benefit in rescanning files after an update, following your argumentation??

Finally, I’d like to come to answer the question, why I’d expect, that CIS has also the best cleaning abilities available:
In the passage about stateful file inspection in the CIS online help you’re writing:

Not only is Comodo Internet Security one of the most thorough and effective AV solutions available, it is also very fast.
You're right - protection is different from cleaning - but a [b]most thorough and effective AV solution[/b] handles imho all aspects related to virus issues. You don't write (and never wrote), that it's just a scanner, you always promised to develop one of the best av solutions.

what does the word “Anti Virus” mean?
CIS is an Anti Virus product…it surely is not “Pro virus” :slight_smile:

but legacy products also call themselves Anti Virus…just like what is a TV in 1960s have changed and what is a TV now in 2011 is a totally different technology.

AV component in CIS is for “usability”. Its not your first line of defense as we made very clear all the time. The main protection is Default Deny architecture with Automatic Sandboxing. The rest (eg: Whitelisting and Blacklisting (AV component)) is purely to improve the user experience.
hope this clarifies.

we use ESM in our office (centrally managed CIS).

thx

Melih

Hi Melih,
thank you for your answer.

Yes, no doubt about that :slight_smile: And yes again, I’m convinced, that HIPS brings a much stronger protection than your (or any other) pure “AV” component in the traditional meaning.

My point is, that CIS’s AV component suggests to raise the security with regularly performed full system scans, but you know - and it’s your official point of view, as this video shows, that this isn’t the case.
Why don’t you change the AV component, so that it reflects your official point of view - that means in the first place - don’t warn the user, when no full system check is performed for a longer period and don’t waste system resources for scheduled scans, since the performance of your file scanner is honestly a pain.

Thank you
Michael

A good start: YES!

now it would be great to see it integrated in CIS!!! And i’m talking specially about this:

Powerful antivirus scanner capable of removing malware, rootkits, hidden files and malicious registry keys hidden deep within a system

I do understand Melih’ point of view, but if you make a poll asking users opinion (which is said to be followed/eared) i believe it will reveal user’s interest in integrate CCE and CIS into one product…

but maybe that’s just me…

(Anyway you do understand more about security than i do, for sure! And, as i said before, since i’m using Comodo, i’ve never had another virus problem again…)

we are working on a much faster scanning engine.

Will it support multicore cpu? Keep up the great work.

I agree with you :slight_smile: