We are not talking about the DMZ, and besides, no PFW has one, and it is not a FW, period. That's what we are talking about. The junk being called a FW, when it's not that.
When did oil become an animal? I'll put it to you another way. You have been took. You have been bamboozled into thinking that something like Commando is a FW solution.
One can call it Commando, Comodo or Commode it doesn't make any difference to me about a PFW solution. They are all junk. You see any of that trash running on the Linux platform?
No, they don't, when the user is running with admin rights and the malware is running under those rights, which they can and do manipulate the FW rules or some of that, toilet bowl, application control junk in them, punch right through it. And beside, there is the fallible human being factor too. It's not that hard to circumvent them.
Thst's BS, because I have tested the 3rd party PFW(s) for this, and they CANNOT get to the connection first, because they are not an integrated part of the Windows O/S platform. No Windows NT service is dependent upon or is made to wait on the PFW service, none of them. If the PFW service is not up and running, then how is it stopping anything that's gotten to the connection first? It can't do it. The ones that can do it are the Windows XP and the Vista FW(s), that's is, they get to the connection first and protect the network connection, before anything else can use the connection.
You can put it to the test. You install Gator on that machine, and you set all the rules you want to stop Gator form connecting outbound to one of its many sites with your PFW solution, and you see if that PFW you hold in such high regards can stop Gator at boot and logon. You can use Active Ports or Currpotrs, and the best you might see is the connections being closed after Gator has done its thing.
It's doing everything that it's not suppose to be doing. It's doing everything but acting like a packet filter stopping unsolicited inbound traffic from reaching the computer. It's a jack of all trades master of none trying to protect *you* from *you*. If I don't want something to communicate, then I stop with the O/S, or better yet, I don't install the software at all.