Mediaboss Marketing

The folks at Comodo clearly enjoy assembling different applications out of the same building blocks. Their Comodo Internet Security Pro 2012 ($4.99/year direct) security suite is a construct containing the firewall component from Comodo Firewall 5, the antivirus component from Comodo Antivirus 2012, and the Defense+ behavior-based malware detector shared by both.

The one big bonus in the inexpensive suite is support from Comodo's GeekBuddy service. In testing the other products, I repeatedly encountered screens offering cleanup by a GeekBuddy expert, but at an extra cost. GeekBuddy support is included with the suite. Note that this is not the same as the $49.95/year full GeekBuddy service, which promises live remote-control help with every kind of PC Problem. With the suite you specifically get help for malware removal.

Low Scores from the Labs
The independent labs don't give Comodo's basic antivirus technology high marks. ICSA Labs and Virus Bulletin certify it for virus detection, but not virus removal. Virus Bulletin has tested it five times, and all five times it fell short of VB100 certification. It also failed to achieve certification in a whole-product test by AV-Test.org last year, scoring especially poorly in the malware repair test. The chart below summarizes Comodo's lab test results along with those of other current products. For details on how I interpret the various tests, see How We Interpret Antivirus Lab Tests.

Firewall and Defense+
My review of Comodo Antivirus 2012 (free, 3 stars) covered the company's Defense+ technology, and my review of Comodo Firewall 5 (free, 3.5 stars) offers details on the firewall component. Please refer to these articles for full details; I'll summarize here.

Defense+ aims to keep your system safe from malware by blocking access to sensitive system areas. When it detects an access attempt it pops up a yellow, orange, or red alert and asks you what to do. Some alerts specifically identify the program in question as malicious; others specifically state that you must make the decision yourself.

I don't approve of security software that pushes important decisions off on the user, since most users aren't trained in security. For testing, I blocked all activity reported as a red alert and allowed yellow and orange alerts. If the alert recommended running the program in Comodo's sandbox, meaning limiting its access to sensitive areas, I always chose the recommended option.

I found that Defense+ detected suspicious activity by every single one of my malware samples. However, it also popped up red alerts for every single PCMag utility I tested. I specifically used old utilities that aren't digitally signed. The majority either wouldn't install or wouldn't run when I followed my block-on-red rule.

The firewall itself properly stealthed all ports and resisted Web-based attacks, though it did nothing to block attacks attempting to exploit system vulnerabilities. In its default program control setting it blocks outbound connections and allows inbound connections. However, also by default it automatically allows any questionable connection, so in effect its program control isn't active.

Antivirus Alone
In testing the standalone antivirus, I found that it did a mediocre job of malware cleanup, especially against rootkits. Even when I turned on the hidden option to scan for rootkits, it left some rootkits running.

Blocking malware from attacking a clean system was a team effort by Defense+ and the antivirus. Defense+ was always first to the crime scene, but in quite a few cases the antivirus jumped in to quarantine known malware. Comodo's malware blocking score was excellent, though tarnished by its high incidence of false positives in my testing with PCMag utilities.

I didn't invoke GeekBuddy help for each individual malware sample. Doing so would have taken an impossibly long time, and in any case Comodo scored quite well without GeekBuddy. For an explanation of how I test and score malware blocking, see How We Test Malware Blocking.

See original here:
Comodo Internet Security Pro 2012