i test my webroot with comodo firewall leak test and get 50 from 340 score .
it is good ? this test is valid ?
test webroot firewall with comodo firewall leak test
I have d/l and tested that program
Win XP with no AV: 20
Win 7 with WSA (Default settings): 190
Win 7 with MSE: 190
While I can see what its trying I wouldnt put too much weight in the results. Have you modified your settings in WSA? I am not sure why you are getting 50 in the test. I had a look at the items that WSA "Failed" on, pretty much all of them WSA actually protects against and even if its a brand new threat we can roll back the changes in the worse case scenario.
For instance:
File drop test is used to drop a file in the system32 folder, plenty of legimate programs will drop files in that folder. Its not a certain indication of malware. The same goes for the services test, if you install a new legimate program that requires a service to be run at startup (like Daemon tools/Nero/Vmware) it doesnt mean its bad.
However I can see what the test is trying to do. I wouldnt worry about your low score. I can go into more detail but if you hit the little "?" button that comodo test program it gives you more technical information about what its testing. I`ll be happy to answer any questions you have.
Thanks,
Roy
Threat Research,
Win XP with no AV: 20
Win 7 with WSA (Default settings): 190
Win 7 with MSE: 190
While I can see what its trying I wouldnt put too much weight in the results. Have you modified your settings in WSA? I am not sure why you are getting 50 in the test. I had a look at the items that WSA "Failed" on, pretty much all of them WSA actually protects against and even if its a brand new threat we can roll back the changes in the worse case scenario.
For instance:
File drop test is used to drop a file in the system32 folder, plenty of legimate programs will drop files in that folder. Its not a certain indication of malware. The same goes for the services test, if you install a new legimate program that requires a service to be run at startup (like Daemon tools/Nero/Vmware) it doesnt mean its bad.
However I can see what the test is trying to do. I wouldnt worry about your low score. I can go into more detail but if you hit the little "?" button that comodo test program it gives you more technical information about what its testing. I`ll be happy to answer any questions you have.
Thanks,
Roy
Threat Research,
Userlevel 7
You've hit on the right spot Roy. I wouldn't worry about the test result either.:)
Thanks Roy for your reassurance!
WSA usually doesn't seem to be strong in tests because WSA is so smart and intelligent solution which recognizes it's a test and not a real threat :D
WSA usually doesn't seem to be strong in tests because WSA is so smart and intelligent solution which recognizes it's a test and not a real threat :D
Surely ON because Win Firewall controls inbound traffic and WSA Firewall outbound traffic. They needs to be run together to have the complete Firewall protection.
Hi ,
agaian i run test and again give 50/340 .
COMODO Leaktests v.1.1.0.3
Date2:08:11 PM - 4/16/2013
OSWindows XP SP3 build 2600
1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerProtected
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationVulnerable
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEProtected
25. Impersonation: CoatProtected
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score50/340
agaian i run test and again give 50/340 .
COMODO Leaktests v.1.1.0.3
Date2:08:11 PM - 4/16/2013
OSWindows XP SP3 build 2600
1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerProtected
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationVulnerable
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEProtected
25. Impersonation: CoatProtected
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score50/340
Can you uninstall/reinstall Webroot and dont import your settings and then re-run the test.
i reinstall my WSA : and now 30/340
COMODO Leaktests v.1.1.0.3
Date2:28:33 PM - 4/16/2013
OSWindows XP SP3 build 2600
1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerProtected
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationVulnerable
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEVulnerable
25. Impersonation: CoatVulnerable
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score30/340
(C) COMODO 2008 and again testCOMODO Leaktests v.1.1.0.3
Date2:30:58 PM - 4/16/2013
OSWindows XP SP3 build 2600
1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerVulnerable
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationProtected
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEProtected
25. Impersonation: CoatVulnerable
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score40/340
(C) COMODO 2008 interesting .
COMODO Leaktests v.1.1.0.3
Date2:28:33 PM - 4/16/2013
OSWindows XP SP3 build 2600
1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerProtected
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationVulnerable
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEVulnerable
25. Impersonation: CoatVulnerable
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score30/340
(C) COMODO 2008 and again testCOMODO Leaktests v.1.1.0.3
Date2:30:58 PM - 4/16/2013
OSWindows XP SP3 build 2600
1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerVulnerable
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationProtected
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEProtected
25. Impersonation: CoatVulnerable
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score40/340
(C) COMODO 2008 interesting .
OK, one minute, let me test it in Win XP as I have only being testing WSA with that program in Win 7. Could just be an issue with XP and its numerous security holes 😃
Looks like its a Windows XP issue, I got 20 in my XP VM. As I said in my initial post I wouldnt worry about the results. If you are using WSA, make sure windows is up to date and update any 3rd party plugins (Java/Flash/Adobe).
Dear Rakanisheu
thank you so much .
i am not worry . :p
after update java and flash get result 40/340 .
np .
thank you so much .
i am not worry . :p
after update java and flash get result 40/340 .
np .
Cool, due to the extra security options built into Vista/7 I would always expect XP to score lower. Its an interesting tool in anycase, thanks for the info. Always nice to try new things!
i think the "problem" is that the "comodo leak test" really is intended to be a test for HIPS programs.. the comodo firewall functions as a HIPS program.. i don't know it the webroot firewall is designed to function as a HIPS program, or not.. if the webroot firewall is designed to function as a normal firewall, as opposed to functioning as a HIPS program, i think an appropriate test for it would be GRC's "shieldsup".. GRC also has a "leaktest" that can be used to test a firewall's out-bound protection: http://www.grc.com/lt/leaktest.htm
Userlevel 7
Good point. But that doesn't explain the result Roy got in a Win7 system. Also WSA can be configured to act similar to a HIPS to quite some extent.@ wrote:
i think the "problem" is that the "comodo leak test" really is intended to be a test for HIPS programs.. the comodo firewall functions as a HIPS program.. i don't know it the webroot firewall is designed to function as a HIPS program, or not.. if the webroot firewall is designed to function as a normal firewall, as opposed to functioning as a HIPS program, i think an appropriate test for it would be GRC's "shieldsup".. GRC also has a "leaktest" that can be used to test a firewall's out-bound protection: http://www.grc.com/lt/leaktest.htm
Reply
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.