Comodo V3.0 alpha is out

CRC32? That would be disappointing... I have no idea, I ditched the snapshot with CFP3, but my guess is MD5. How can this be checked?

 

isolate is just a security policy option that is there out of the box, you can make more policies and name it whatever you want. I looked at the settings given by "isolated applications" it's not very isolated.

 

Really I don't like it

The HIPS is so Simple and use CPU very much in BT

 

Hmm, sounds familiar... I would have to try to reproduce that as well. Could you please try to disable "monitoring DLL injections", see if that helps... (I don't have this v3 installed at the moment)

Cheers.

 

Let's hope the vomit green isn't one of the themes. LOL

 

http://i7.tinypic.com/4l92o90.png

Hm, in some way we have problems, the ě rootkit has stepped inside. http://i10.tinypic.com/5xfu3vs.png

Appinit.dll method is risky.

But there is hope! SystemIdle Intrusion has been blocked! The Linux based view is great!

http://i13.tinypic.com/6gvbjpj.png

 

SJ in English please.

 

Maybe you need glasses or do you belong to the part of profs that are called the 100%´ter, this here is no school class and there is no grammar controler.

Information is the only thing that count. Understand or was that chinese in your decoding brain system?

 

Ok, I just want to know when this is coming out of Alpha or any idea when it'll be? Thanks

 

It is only first version of an Alpha.
Then it has has to go through Beta versions.
Then Release Candidates.
It will months or several months (maybe even up to a year)
before the Final is released.

 

The attackers only needed 3 days to make comodo pro alpha totally useless,
all hooks were there, everything looked fine on desktop surface, but Comodo turned into zombie, no more reaction, absolutely nothing. All apps were able to communicate with internet, the latest beast comes from system idle process.

 

This is interesting... can you elaborate more?
Direct connection to internet? Router?
Local or remote exploit?

Usually such claims will need to be backed up with some details of the attack, otherwise most will think this is just trolling...

Thanks,
Fax

 

I use Router. No not trolling, probably polymorphic infector, I am still occupied in doing research.

One thing is for sure Pid 0 is the key problem. I actually don´t understand how this thing is able to persist in Pid 0.

Actually I uninstalled and reinstalled Comodo 3 Alpha and know it works again so far.

 

Thanks for the info...
Fax

 

look, maybe fp, but it´d enforce my worries:

http://i7.tinypic.com/5y2nu6w.png

Beside Gmer seems to be incompatible to comodo alpha pro, always receive bsods.

Jotti found 0 related to wudfhost. But Sandbox took long time so they gave a attention signal. (eventually malware)
Packprog: PE_PATCH.

 

Here again, after some reboots, silently bypassed, no unhooking, nothing.. spooky silent bypass.

http://i11.tinypic.com/6g0ta3r.png

 

So how is Comodo Alpha 3 doing for you guys so far? I just want everyone to give me some up-to date stories and info, thanks!

 

Nobody scared about my posted screen?

Some stealth Keylogger easily bypass Comodo 3.

 

I would be scared/concerned if it happened in one of Comodos' RCs.

 

Did you test the same on Comodo 2.4 ?
I should be scared if the keylogger bypasses Comodo 3, and not 2.4

 

Shouldn't it be the other way around?

Did you notice the word "alpha"? Do you know the giant difference between an "alpha" and "Final"

3 is an "ALPHA" and 2.4 is a "FINAL".

 

Lol

Maybe I should include this distinction in my further thoughts.

Something I wonder if there´s no better way of hooking, then appinit? Actually every security suite uses appinit, so if I want to use two different apps that may produce more problems especially because appinit is easy to erase by other apps so the protection may also be very easy to kill.

 

Glad to see you have a sense of humor SystemJunkie . I can appreciate that. This version of Comodo has high expectations. I would also take your tests seriously after the final is released. I'm willing to bet that they will pass all 'leak tests' by default. That's just my opinion.

I don't know about all the hooking. It's way above my head. I am starting to get concerned about all these security programs digging deeper and protecting themselves. I sense some sort of conflict eventually. Again, just my opinion and not based on anything factual Lol. Call it a gut feeling .

 

Not really surprising, this is known since sometimes...
Very few HIPS pass all AKLT test.

http://www.firewallleaktester.com/news.htm

Cheers,
Fax

 

yes, very funny, haha, I hope we all will be able to regain a new kind of (gute) good feeling as the time may come (sometimes) when security apps become solid and bullet proofed.

Don´t focuss only on AKLT, I mean latest commercial stealth keylogger.
It´s not useful if the firewall can block aklt but in realtime attacks is
bypassed easily by commercial software. But let´s wait until the next beta.

Beside Gmer is actually incompat. to Comodo Pro Alpha:
BSOD: 0x00000005 / INVALID_PROCESS_ATTACH_ATTEMPT