Test Your HIPS - Comodos 5 New Security Tests

FYI : Dynamic Security Agent passed (or "errored") all except the first one, on a test XP pro, under admin account.

slight and non-constructive disgression : I've to admit that, as usual, I'm a little undecided towards those tests.

 

Just tried the Free GesWall on my system; Win XP Pro.

Different from LoneWolf's results above. Any idea why?

 

Dismal results for TF!

ProSecurity passed all tests.

Did anyone test SSM?

 

I'll surmise that is simply because there is no actual "rootkit installation" or "dll injection" in these leaktests, which are most certainely *not* tailored made to test behavior blockers, but rather classic HIPS or FW with HIPS like features.

 

Are we sure with sandboxie that it actually failed some of them? Could it be that the programs are just running in the sandbox and it thinks it got the computer but it actually dosen't?

 

Sure? I tried with prosecurity 1.43 and the second test is vulnerable. I can not finish the fifth because of an error message windows. Some idea of diversity results?

 

With its default file rules, PS 1.43 will fail the second rootkit test because there is no rule to filter the *.sys_old file extension.

Nick

 

You need to add a broader rule to pass the test...

 

I can't download it. It does not let me hit OK. Also what do I do after I download this

 

thank you very match

 

EQSecure 3.41 passes all but the BITS test.

ProcessGuard full version 3.51 passes both rootkit tests and dll injection 2. It fails dll injection 1 and BITS.

The test GUI claims that EQSecure and PG both fail rootkit 2 test. This is incorrect. Both pass the test.

 

https://www.wilderssecurity.com/showpost.php?p=1225400&postcount=24

Now confirmed by another EQS user.

 

defensewall gives me Vulnerable on the last item.

 

Interesting. Could you send me DW's log file on the last test?

 

On my system Defensewall 2.30 passes BITS Hijack test and all others except DLL Injection 1. This test seems to hang. See screenshot.

 

Good to know!

 

I,ve tested REAL rootkits and severe malware samples at EQS so these test successes with EQS are not exactly surprising. PE386, Haxdoor, etc now those are real nail biters and what about ADS, they are still very much a threat as they ever were. I even use an ADS on one of my disk for fun that launches an .exe rubberball everytime i access either a notepad or some other %WinDir% system file.

I think this was more of a showcase then any real HIPS test IMO.

 

Hi, make sure that all thre files, clt.exe, dll.dll and driver.sys are marked isolated. I get same results for GW free and Pro, on XP Home.

 

Comodo will always impress me (sarcasm).

 

SSM Pro:

Rootkit 1----------Protected
Rootkit 2----------Vulnerable
DLL1--------------Testing.....
DLL2--------------Protected
BITS--------------protected

Neoava Guard:

Rootkit 1----------Protected
Rootkit 2----------Error
DLL1--------------Error
DLL2--------------Protected
BITS--------------protected

 

So will EQSecure (COMPLIMENTS!)

 

Tested with DefenseWall HIPS v2.30 / Vista-32:

all tests passed.

Good job Ilya!

 

If anyone here is running DriveSentry, will you please test it against Comodo's 5 bagger, and post results?