test webroot firewall with comodo firewall leak test

I have d/l and tested that program
 
Win XP with no AV: 20
Win 7 with WSA (Default settings): 190
Win 7 with MSE: 190
 
While I can see what its trying I wouldnt put too much weight in the results. Have you modified your settings in WSA? I am not sure why you are getting 50 in the test. I had a look at the items that WSA "Failed" on, pretty much all of them WSA actually protects against and even if its a brand new threat we can roll back the changes in the worse case scenario.
 
For instance:
 
File drop test is used to drop a file in the system32 folder, plenty of legimate programs will drop files in that folder. Its not a certain indication of malware. The same goes for the services test, if you install a new legimate program that requires a service to be run at startup (like Daemon tools/Nero/Vmware) it doesnt mean its bad.
 
However I can see what the test is trying to do. I wouldnt worry about your low score. I can go into more detail but if you hit the little "?" button that comodo test program it gives you more technical information about what its testing. I`ll be happy to answer any questions you have.
 
 
Thanks,
Roy
Threat Research,

You've hit on the right spot Roy. I wouldn't worry about the test result either.:)

Thanks Roy for your reassurance!
 
WSA usually doesn't seem to be strong in tests because WSA is so smart and intelligent solution which recognizes it's a test and not a real threat :D

Dear ,
Thank you .
 
When We use WSA , must windows firewall ON or Off ?
 
Regards ,
 

Surely ON because Win Firewall controls inbound traffic and WSA Firewall outbound traffic. They needs to be run together to have the complete Firewall protection.

Hi ,
agaian i run test and again give 50/340 .
 
COMODO Leaktests v.1.1.0.3
Date2:08:11 PM - 4/16/2013

OSWindows XP SP3 build 2600

1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerProtected
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationVulnerable
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEProtected
25. Impersonation: CoatProtected
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score50/340

 

Can you uninstall/reinstall Webroot and dont import your settings and then re-run the test.

i reinstall my WSA : and now 30/340
 
COMODO Leaktests v.1.1.0.3
Date2:28:33 PM - 4/16/2013

OSWindows XP SP3 build 2600

1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerProtected
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationVulnerable
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEVulnerable
25. Impersonation: CoatVulnerable
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score30/340

(C) COMODO 2008 and again testCOMODO Leaktests v.1.1.0.3
Date2:30:58 PM - 4/16/2013

OSWindows XP SP3 build 2600

1. RootkitInstallation: MissingDriverLoadProtected
2. RootkitInstallation: LoadAndCallImageVulnerable
3. RootkitInstallation: DriverSupersedeVulnerable
4. RootkitInstallation: ChangeDrvPathVulnerable
5. Invasion: RunnerVulnerable
6. Invasion: RawDiskVulnerable
7. Invasion: PhysicalMemoryVulnerable
8. Invasion: FileDropVulnerable
9. Invasion: DebugControlVulnerable
10. Injection: SetWinEventHookVulnerable
11. Injection: SetWindowsHookExVulnerable
12. Injection: SetThreadContextVulnerable
13. Injection: ServicesVulnerable
14. Injection: ProcessInjectVulnerable
15. Injection: KnownDllsVulnerable
16. Injection: DupHandlesVulnerable
17. Injection: CreateRemoteThreadVulnerable
18. Injection: APC dll injectionVulnerable
19. Injection: AdvancedProcessTerminationVulnerable
20. InfoSend: ICMP TestProtected
21. InfoSend: DNS TestVulnerable
22. Impersonation: OLE automationProtected
23. Impersonation: ExplorerAsParentVulnerable
24. Impersonation: DDEProtected
25. Impersonation: CoatVulnerable
26. Impersonation: BITSVulnerable
27. Hijacking: WinlogonNotifyVulnerable
28. Hijacking: UserinitVulnerable
29. Hijacking: UIHostVulnerable
30. Hijacking: SupersedeServiceDllVulnerable
31. Hijacking: StartupProgramsVulnerable
32. Hijacking: ChangeDebuggerPathVulnerable
33. Hijacking: AppinitDllsVulnerable
34. Hijacking: ActiveDesktopVulnerable
Score40/340

(C) COMODO 2008 interesting .

OK, one minute, let me test it in Win XP as I have only being testing WSA with that program in Win 7. Could just be an issue with XP and its numerous security holes 😃

Looks like its a Windows XP issue, I got 20 in my XP VM. As I said in my initial post I wouldnt worry about the results. If you are using WSA, make sure windows is up to date and update any 3rd party plugins (Java/Flash/Adobe).

Dear Rakanisheu
thank you so much .
i am not worry . :p
after update java and flash  get result 40/340 .
 
np .
 
 
 

i think the "problem" is that the "comodo leak test" really is intended to be a test for HIPS programs.. the comodo firewall functions as a HIPS program.. i don't know it the webroot firewall is designed to function as a HIPS program, or not.. if the webroot firewall is designed to function as a normal firewall, as opposed to functioning as a HIPS program, i think an appropriate test for it would be GRC's "shieldsup".. GRC also has a "leaktest" that can be used to test a firewall's out-bound protection: http://www.grc.com/lt/leaktest.htm

@ wrote:
i think the "problem" is that the "comodo leak test" really is intended to be a test for HIPS programs.. the comodo firewall functions as a HIPS program.. i don't know it the webroot firewall is designed to function as a HIPS program, or not.. if the webroot firewall is designed to function as a normal firewall, as opposed to functioning as a HIPS program, i think an appropriate test for it would be GRC's "shieldsup".. GRC also has a "leaktest" that can be used to test a firewall's out-bound protection: http://www.grc.com/lt/leaktest.htm

Good point. But that doesn't explain the result Roy got in a Win7 system. Also WSA can be configured to act similar to a HIPS to quite some extent.

@Amit wrote:

Also WSA can be configured to act similar to a HIPS to quite some extent.

Yes Amit is right, if you set "Warn when new programs execute that are not trusted" under Heuristics settings you will have almost the full HIPS control.