Comodo AV better now?

We've recently rolled out the AV and D+ components of CIS onto a state Government LAN of a little over 3,500 seats and its performance over the past three months has been remarkable.

Previously, we had used an enterprise version of a major AV for a little over 6 years. We had trialled CIS AV in our test lab (48 seats) and on a minor segment for over 6 months prior to the rollout.

Over the past three months, we have saved over $11,000 (approximated to US$) and AV incident/ resolution (and its accompanying costs) has dropped more than 85% when compared to our previous solution.

We are eagerly awaiting the release of the updated Comodo Security Endpoint Manager which will work with the latest CIS. This will greatly reduce the bandwidth costs currently caused by each workstation updating over the internet, rather than from a central internal instance.

In short - we love it!! It's is a far more cost effective solution and, after configuring the D+ component and Parental Controls (we use this to supress dialogues, auto-quarantine and protect the configuration from alteration) to suit our MOE, we have far less incidents to manage.

Admittedly, we operate strictly managed environments and workstations with a limited range of software, and this is ideal for a locked and pre-configured installation of CIS. Having said that, CIS is still providing us with better protection and lower operating costs.

CT
Comodo Forum Moderator

P.S. In case this is viewed as an intrusive post - although I am a moderator on the Comodo forums, I recused myself entirely for the selection, testing, approval and implementation process, as is required by our internal ethics guidelines. I have only involved myself once the entire selection/implementation process was completed. The time/cost figures quoted were produced by our internal accounting staff.

 

According to Comodo's website you can choose to install either or both the antivirus and firewall. I'd imagine that the real-time part of the av could be disabled.

 

Hello,

I am a Global Moderator on the Comodo Forums. Here are the download links for Comodo Security Endpoint Manager with latest CIS:

http://download.comodo.com/cesm/download/setups/CIS_RM_Setup_3.8.65951.4
77_XP_Vista_x32.msi
Size:47M (48830464)
MD5:1e746485e2b7a359562fbd1dfe2a493b
SHA1:4571cfbe07528573b5d26f144405c495fbe16077

http://download.comodo.com/cesm/download/setups/CIS_RM_Setup_3.8.65951.4
77_XP_Vista_x64.msi
Size:50M (52164096)
MD5:51e8b4085e183947dd5da819250075b4
SHA1:e0e81d0825bb4c3ef1b409e88f71e9d67f234f7d

http://download.comodo.com/cesm/download/setups/CESM_Setup_1.1.1813.31_X
P_Vista_x32.msi
Size:15M (14713344)
MD5:c64165fc95709908033c4981c4e7db2f
SHA1:848f81f998bfa9cbf18f70bbb4c3b65a11a1794f

http://download.comodo.com/cesm/download/setups/CESM_Setup_1.1.1813.31_X
P_Vista_x64.msi
Size:15M (1521100
MD5:47e2cc5e19e3355e54d5a8182c04bea9
SHA1:b5271e82a7aabda91537ee2e84c54b7a6d952f74

Website is here: http://enterprise.comodo.com/security-solutions/endpoint-security/

That enterprise website was launched in February... Let me know if you need anything.

Cheers,
Josh

 

I wasn't impressed with the new AV heuristics engine in the latest Comodo Internet security. The Heuristics ruined a legitimate program, that being Webroot window washer. Comodo stated that it had quarantined those files, so I thought I could recover them easily and all would be well....but No sign of the files in the quarantine for some reason. I reinstalled Window washer and removed Comodos Junk from my system.

 

Wierd.. Quarantine working fine here..

I neither was impressed with 3.8's heuristic. But it might become by 3.9.. Currently in Pre-Alfa

As for the threads subject.. Comodo AV better now, It now got a 2.67 million DB.. Instead of the 1.7 M that it had when this thread started out..

Hopefully its better..

 

I am sure it is better after the many database updates. Yes when the heuristics were first rolled out there were some false positives, but I am surprised that any experienced user would quarantine heuristic detections rather than checking them out first and then reporting them as fps.

The next version with heuristics based on CIMA should be a great step forward again, but for now it is working well and to describe it as 'Comodos Junk' is a ridiculous statement.

 

Well, current heuristics are a joke and shouldn't even be called heuristics.
CIMA thing will be something different.

 

I didn't ask Comodo to quarantined or should I say remove these files. When I installed Comodo IS the software quarantined the files without asking me , just a pop-up telling me it had 'quarantined' my Webroot Window washer files.This was before I had run a scan, Comodos real-time protection. When I checked the quarantine folder the files weren't there, so the software had removed legitimate files without my consent.

Any sercurity software that does what I describe above is complete Junk, I'm sorry but it is. I prefer software that's properly tested and Comodo needs more of this.

 

This is really odd, to say the least! I haven't heard of any other reports of CIS AV auto-deleting any files.

When you say "This was before I had run a scan", do you mean that Webroot was running (or you had just attempted to run it) and the realtime component of CIS AV detected it and auto-removed it?

When you re-installed Webroot Windows Washer (before removing CIS), did it auto-remove the files a second time?

What version of CIS did you install? V3.8.X.477 does not have auto-quarantine enabled as default and there is no setting to auto-remove.

This is probably best reported on the Comodo support forums (https://forums.comodo.com).

CT

 

Webroot was already running yeah, CIS real-time scanner detected then removed a couple of Webroot program files, but comodo told me they were quarantined...but nothing was in the quarantine.

I didn't try a second time..I just removed Comodo. It seems that my above statement was not worded to well "I reinstalled Window washer and removed Comodos Junk from my system" I should have said that I removed than re-installed webroot...sorry.

Not quite sure on the version, but it had the new heuristics that were set on the default low...so presuming the latest? I didn't change any default settings BTW.

 

Thanks for the follow-up.

I am still at a loss to explain why it deleted rather than quarantined, let alone quarantined at all if you had not enabled auto-quarantine.

Auto-quarantine has been available since V3.5.X but has NEVER been enabled by default. This has always been a user selectable setting.

If it's any comfort, your report is unique - I've just checked back through all CIS posts on their forums and there is no mention of any other users having files deleted rather than quarantined.

CT

 

Comodo ppl just confirmed today that they are bunch of incompetent noobs.
They want to live in a world where their beloved software is a form of unmistakable perfection. And i'll let them live in their fairy tale because they don't give you any other option.
You tell them that whole bunch of stuff is designed badly and they ban you in return. Gee, thanks.
Get rid of stupid fanatic fanboys and Comodo software might some day actually be good. I'm returning to ALWIL Software where they appreciate any feedback, be it good or bad. They also act like professionals and i don't have to explain myself 50 times for my statements. And even though there is a language barrier (Czech-English-Slovenian) we always manage to communicate properly. But with Comodo ppl i always felt like i'm talking quantum physics to a 2 years old kid... And that applies to volunteer members and official staff members.
I was totally shocked when i needed 3! forum pages of explaining regarding Memory Firewall development just to find out in the end i'm not going anywhere with the conversation.

 

i was just gonna say it doesnt work on windows 7 but seems i wont even bother to say it if thats the case lol.

 

I hear you. There are good folks that left them for obvious reasons.

 

Funny you say this, I thought I was the only one not getting thru. I think I was the first person pointing out in their CPF v3 beta that it was smoking the cpu. I had to explain myself about 10 times but they kept telling me it was software I had installed on my machine. Finally, after 2 weeks of frustration, they fixed it. I was willing to help them debug the problem but no one listened. That being said, I can't criticize people for making free software. I can only try and help, which I know you had been doing. They have a lot of potential but I got tired of beta testing. I wish Comodo the best but for now I'll stick with stuff that works.

Ice

 

Please stay on topic guys.

Cheers,
CT

 

BTW It does work.

 

They are on topic.
RejZoR, lodore, Miyagi and IceCube have experience and do not go around bashing products for the hell of it.
Since you are new here, 5 posts, you might want to listen to them.
What they say could affect the development of their av.
I use CIS but not a fan boy by any means.
I use what works for me and my computer.
Personally I think the av has improved. No troubles with it, no fp's and runs great for me on XP.
On Vista it's a problematic whore and after going around with them I gave up and will not use it any longer.
Good forum help, stateing problems and resolving them are important with any software.
If they don't provide this I'd like to hear about it.

 

No comodo bashing here, but trying to find out some info on the forums.

But I have to say, that is a lot of forums and sub-forums. Some are three levels deep! More than 100 forums! Trim the fat, dudes!

More than double the number of wilders forums and, wilders has a of diversity with their products. Get me outta there!

 

I hear you.
You need a road map over there!

 

[at] danny9 and normishmael,

I was simply trying to retain focus on the original topic "Comodo AV better now?". I interpreted this as asking whether the raw performance (prevention, detection and cure) of Comodo's AV had improved and was just trying to stick to it, as I had noticed from browsing these forums that the mods regularly post asking users to remain on topic or lock topics if they have run to a logical conclusion.

I was not, in any way, trying to deflect the arguments away from whether Comodo, as a company, is good, bad or indifferent. Comodo are big enough and ugly enought to stand up for themselves.

While I agree that there is a higher degree of "fanboy" within the Comodo community than within other software communities, I would like to think that I, personally, am not included in that bunch, either by my actions or by the suppositions of others.

Cheers,
CT

 

I did deviate off-topic a bit. But to answer your question, the last iteration I used of Comodo AV did get better from the previous one but I still received too many FP's. I was using the CIS package 3.8, forgot the sub version. They will in time have a solid AV. I think what RejZoR and myself are trying to say is that we have reported some issues with the AV or other modules and Comodo was slow to act on them. Like I said in my previous post, I can't criticize any company that will give free software away. I really hope Comodo succeeds in their philosophy because it will only make PC security that much better for the rest of us. Other companies will also improve their products. It's a win/win situation.

thanks danny9 for watching my six

Ice

 

Well, if you can't criticize free software, i can. If they want to play software development, they can play it just like everyone else. And thats with critics and all.
If they ask for feedback and then disregard it, why they even asked for it?

I've said many times that their so called heuristics are just packer detection and should be optional (even when CIMA heuristics will be a part of CIS). No one even cared.
I've said that doing so would decrease false positives greatly. No one cared.
I've said that keeping Memory Firewall as stand alone tool would be a good idea. After 3 pages i've ended up in a "word fight" with a mod and Melih that was basically caused by themself (especially Melih was insisting on BOClean analogy that i used there).
We were collecting a list of programs with digital signature that were suppose to be added in CIS to decrease popups on known software.
They never implemented it and that thread is now lost who knows where.
I've reported a bug during beta testing, Comodo programmer assured me it was going to be fixed in final release. The bug was not fixed at all.
I've said that Defense+ is way too chatty for casual users and that they should convert it into behavior analyzer (the stuff is basically there, they just have to build it on top of Defense+). They again flooded the thread with praise how their whitelist rocks. Well i'm still seeing loads of popups when i install programs and games, so what gives?
I've said that even memory scanner can be easily circumvented from detecting supposedly unencrypted malware. Melih again disagreed and again caused a word fight by himself.
And the list could go on and on.

Why they even need forums if there is zero productivity from them?
Just so bunch of fanboys can gather around and hail Comodo?
That won't improve anything lol

If ppl like Comodo software as it is, fine, but if you have intention to have serious feedback and recommendations, don't even bother.

 

Comodo has the right intent in developing their programs.

But a comodo forum member or a wilders forum member is vastly different from a regular user.

So as the AV improves, if the program doesn't reduce its popups, a regular user will not be able to handle comodo in its current format. They would panic at anymore than two popups in succession.

Regarding your thread RejZor, it made sense. Continue developing their memory firewall as a standalone program.

 

The problem with some posters here (you know who you are) is that they want to have features from paid software suites incorporated to a FREE software suite.

Well, if you do not like the features and the benefits of D+ giving total control over your system, you always have the choice to choose a much inferior, paid software alternative.

In all honesty, D+ is literally the most comprehensive classical HIPS module available in the market, paid or free.
If you find it obstrusive and too complicated for you to configure/understand, then don't use it. Simple as that.


Anyways, back on topic.

No, Comodo AV has yet to improve its heuristics detection. I expect improvements with the next update with CIMA engine.