CIS V4 Testing

I have been testing Comodo Internet Security version 4 for the last few days and I figured I would post my findings so far


Full Security Suite 4.0.1352393742 virus database 4208 on demand right click scan

546 samples tested

Rootkit Detection: 5 of 5 samples found
Backdoor Detection: 24 of 24 samples found
Exploit Detection: 30 of 30 samples found
Flooder Detection: 30 of 30 samples found
IM Worm Detection: 29 of 29 samples found
IRC Worm Detection: 28 of 28 samples found
Nuker Detection: 29 of 29 samples found
P2P Worm Detection: 33 of 33 samples found
Packer Detection: 16 of 16 samples found
Trojan Clicker Detection: 30 of 30 samples found
Qhost Detection: 5 of 5 samples found
Macro Detection: 2 of 2 samples found
Spoofer Detection 5 of 5 samples found
Spam Tool Detection: 19 of 19 samples found
Trojan Downloader Detection: 60 of 60 samples found
Trojan Dropper Detection: 44 of 44 samples found
Trojan IM Detection: 26 of 26 samples found
Virus Detection: 79 of 79 samples found
Worm Detection: 42 of 43 samples found

This test set yielded a 99.8% detection rate

The missed sample was “Worm.Win32.netop.a” which was detected by 35 of 40 scanners on virustotal.com

In my testing of the firewall the default configuration scored I believe it was 130/340 on my first run of Comodo’s own leak test it seems Comodo is taking a different approach to the way the firewall is setup in V4 with V3 I was able to achieve a 340/340 very quickly but it took a little playing around with V4 to get a perfect score here is what I did:

I set the configuration to “Firewall Security” with “Safe Setting” applied and alerts on “Very High” and in the advanced section I have all options checked except for Monitor NDIS protocols other than TCP/IP I then ran the “Stealth Ports Wizard” and chose “Alert me to incoming connections and make my ports stealth on a per-case basis” and reran leak test and finally got a 340/340

So far things are looking pretty good I will have to do more testing I plan to try this out next on a infected machine to check it’s removal ability

Just an update I installed V4 today on a client machine and got a 320/340 right out of the box so they must be tweaking the firewall I have read people complaining over at the Comodo forums about it also virus database today is at 4216

on a side note the new Comodo V4 no longer alows for turning of the firewall activity animation on the system tray icon I have always turned it off in the past I find it a bit distracting.

We Mods are currently testing the as-yet unreleased v5.0.
With a new GUI and many enhancements and new features, it is very promising.
Better sandboxing and control of is also included.