submitted possible threats - what next?

[Guest]

[40apple40]

hi,

i've had some possible threats quarantined as they came up as "heur suspicious".

from the quarantine page i submitted these (7 of them) for investigation using the submit option on that page.

what happens now though? how do i find the results to the investigation?

do i just keep restoring them & rescanning to see if they've been added to some safe file data base?

if so, how long does this take?

i'm not sure when to delete these permanantly.

thanks,

apple.

[Endymion]

do i just keep restoring them & rescanning to see if they've been added to some safe file data base?

if so, how long does this take?

i'm not sure when to delete these permanantly.

No clue here as well.

In case users are sure the samples are not malicious they attach them in the False Positive/Negative reporting - (Is this a malware that CIS has/not detected?) and in one/two days the AV database is updated.

As restoring quarantined samples to periodically check if their classification was changed might be unpractical it would make sense to add a lookup button in the quarantine dialog.

This way quarantined samples could be easily checked against the most recent AV DB updates.

[40apple40]

it seems a shame to have such a useful function as this go to waste as it appears that no-one knows how to use it.

if anyone does ever work it out, please let us know.

thanks,

apple

[HeffeD]

If you report it on the FP forum, you will get a response.

[40apple40]

thanks for your reply.

yes, i've done that & i have had a response. i just wanted to know if the submit function in the quarantine page was usable. it seems that no one knows.

if the submit function is used there seems to be no way of knowing if or when the FPs have been fixed.

apple

[HeffeD]

Yes, the submit function works. However, you will not get any sort of response.

The devs have also stated that there is a quicker turnaround time for submissions through the forum or email. I don't know why this is the case.

[40apple40]

thanks for that. it's a shame as the submit function would be a very convenient. not much point submitting though if you never know if the threats are genuine of FPs.


apple.

[Tags:]