defence+ (comodo) worth it?

(not sure if this counts as firewall or av, so I'll try here).

I've been using Comodo Firewall for a few years now, and the same goes for Avast AV. They seem to work ok together so far.

But I've never been sure about Comodo's Defence+ feature. I left it disabled for years, as I thought it sounded like a waste of resources. Then one update a while back i turned it on.

But it generally just leads to lots of confusing popups every time I install new software... which often sound scary but I end up allowing most of them as it's the only way to get the software to work.

Is there a consensus on whether this kind of software (what would it be called?) is worthwhile? Is it thought to have much impact on resources? Do people generally leave it on or off?

 

I personally think if you are not familiar with HIPS, I wouldn't use it. It would be better off with what you have now, probably add an ondemand scanner like Hitman Pro or Malwarebytes Anti-Malware. As far as resources, I personally don't see any slowdown with it on my laptop.

 

yeah you'd be better off with a behavior blocker which comes integrated with any av including avast......just add what 1chaoticadult suggested plus sandboxie and a good imaging software......

 

He could also enable the sandbox in Avast. Although I don't know how effective it is.

 

I'm not sure the behavior blocker in Avast is considered fully featured yet or not. OP what are you hoping to be protected from and what is your operating system?

If you are not familiar with the pop ups and consider them annoying then do as others suggest and try a different type of security strategy. Maybe use snap shot (1 click restore) or roll back program (returnil?) or if your issue is key-loggers then maybe try key scrambler or another program that protects in a silent manner.

Just remember that for every security you add there is some freedom taken away. And I've not come across a security program yet that did not cause issues or problems at some point.

 

the same happens to me when i use Malwaredefender or Processguard
they have more popups than other hips

But a Great advice to OP
is try to Learn how to use the HIPS in Virtual Machine

 

Well said

 

well....the op did say avast av.......so it has automatic sandbox.....only triggers off when a suspicious file tries to execute.....one can't possibly sandbox the browser or email client or p2p software with that.....

 

One possibly can with avast! Pro but you're probably correctly assuming that wild_bill is using avast! Free.

 

I think it's worth it.

Whenever I install Defense+, I always leave it in Training Mode for at least one week. This is generally enough time for it to learn my habits and programs I use. When it comes out of Training Mode, I find the popups are reduced dramatically for those programs that I've run already.

When I install new software, the option to "Treat this application as an installer or updater" works wonderfully for me. I get at most two alerts for the duration of the install.

After I run the new program for the first time, I just check the box "Remember this setting," and then the next time I run that same program I get no popups!

And I have it running on Proactive Security with all monitoring states checked, and in Safe Mode.

Alternatively, install Defense+ and then just leave it in Clean PC Mode. It'll assume everything on your computer is already safe, so that will minimize popups.

As for your question on performance, I have the full suite of CIS installed and it's very easy on resources. I'll admit that at first install I did notice some degradation in performance: my boot to the Desktop was slightly longer and programs took a little longer to load at first, while COMODO was intercepting them and learning them. This lasted for about three days. After that, the performance improved dramatically.

 

Just run it and at the same time learn it
Once you're used to it and have it all set up it's a breeze. If you don't like it just remove it

 

Easy for you to say. You love HIPS and popups

 

Thanks for the advice.
It's not that i'm looking for protection from anything in particular - it's that, by virtue of having comodo firewall on my system already, I already have Defence+, but I'm not sure of the pros and cons of using it.

While I'm reasonably tech savvy, and I know enough to handle AV and Firewalls, HIPS is something I've never really dealt with. (now I know the name I guess i can google it and find out more).

It's not a huge hassle, as by now it has learnt all the software on my PC.. it's just occasionally a hassle for new software. It's also not that I don't understand the pop-up messages - it's that I don't know whether they are good or bad. I can understand that program x has launched service y, and know what x and y are - yet does x need y, or would it work ok without y, or does allowing x to launch y have any security issues? That's what I usually don't know - so assuming I installed x i have to click yes.

So I wonder, if I'm allowing all the software on my PC to do everything it wants, or if the software is in learn or clean pc mode, then what advantage is it providing me? Does it have other benefits in the background?

Early win95 years of lightweight AV/firewalls turning into bloatware seem to have made me distrustful of the new wonder-features that keep getting added. ;-)

I'll go google hips..

PS/ Comodo has a sandbox too... again, it's not something I use, but I wonder if i should enable it for firefox. Not sure about performance issues.

 

You can try it again if you want. Let it grow on you and you will see it's worth it learning how Comodo HIPS behave and protect you.
There are a lot of guys here who can help you set it up for your needs. And there are some good posts at the Comodo forums that maybe of help. As compare to some suites I like the firewall plus D+ some points are mentioned in an earlier post for a friend here,

xttp://www.wilderssecurity.com/showthread.php?t=313664&page=4

Setting it to learning mode will "learn your applications" but for some specific applications that need not to be doing something it will spring into action telling you about it's behavior. As with setting a firewall you have to learn to set it up so less pop-ups will show. D+ alerts to some activity that other applications do not need to do...global hook installations of nVidia is an example. D+ also helps me block applications that call home who cannot be blocked in the firewall. Some games do that(which is also mentioned in the link above). Restrictions tha cannot be set in the firewall or Av can be set there in D+. Maybe guest, Tech or kjdemuth (to name a few but others can help you here really) can set you up if you contact them.

Try here,

xttp://www.techsupportalert.com/content/how-tame-comodo-defense-without-disabling-it.htm

It's much more silent now as compared to OA and Outpost.

 

You may prefer Malwarebytes Antimalware. It works great as a companion to any Antivirus, is very comprehensive and also blocks malicious websites. You won't get lots of popups asking you questions, unless it has intercepted something nasty. I've got it on my main pc running alongside the apps in my signature. Also have it on my laptop running with Kaspersky Pure. It cohabits very well.

Paul

 

defence+ (comodo) is probably worth it but, like others have said, you have to be smart about the settings. I have learned this personally, while spending solid time trying to find various issues I thought were OS problems. I don't get ANY popups. Then again I'm on a x64 system. Now if I switch to my 32bit xp system the pop ups are somewhat frequent like any other defense type system. Anyway, leave it in training mode if your worried or rely on UAC or malware bytes or the on access av defense.