CIMA Wishlist

[Guest]

[idem]

Please try now.

New version is out...and I have something to say:

I don't like two scroll bars.
See attached.

Otherwise this release is great!

[LaserWraith]

Please try now.

Wonderful!  Thanks. 

I also like how quick you were.  :comodorocks:

[gjmveloso]

Maybe a button with "I believe that is a real malware" for non rated as suspicious by CIMA files.

With this action files not rated as suspicious goes direclty to AV Lab for further analysis. Surely, works with CIMAS submitted samples are easier than work with VirusTotal submitted samples.

[fazio93]

Maybe a button with "I believe that is a real malware" for non rated as suspicious by CIMA files.

With this action files not rated as suspicious goes direclty to AV Lab for further analysis. Surely, works with CIMAS submitted samples are easier than work with VirusTotal submitted samples.

+1 

[Jim__]

Windows Explorer
Context menu "send to" function to submit a file. See VirusTotal Uploader as an example http://www.virustotal.com/metodos.html

[The Joker]

I'd like to have the option to choose the sample type (1. Malware (Viruses, Trojans...), 2. Spyware, Adware, Riskware and 3. False positive) like in https://analysis.f-secure.com/

[Commanding The Celsius]

Better noticing of keyloggers.
Usually slips by..

[eXPerience]

I'd like to have the option to choose the sample type (1. Malware (Viruses, Trojans...), 2. Spyware, Adware, Riskware and 3. False positive) like in https://analysis.f-secure.com/

That's for submitting samples only, it won't generate a report

Better noticing of keyloggers.
Usually slips by..

The same problem as with most rogues. Those are the installers and as they won't do anything harmfull, nothing will be said ...

Xan

[The Joker]

That's for submitting samples only, it won't generate a report

I'd like submit samples (with a report), but also submit false-positives, as F-Secure (without report) does.

[eXPerience]

So I assume that you want this :

please choose from
1) Create a CIMA Report
2) Send malware to the developers
3) Report a False Positive

Good idea, I asked for that before, but ... 

Xan

[The Joker]

Yes, that's it!

[salmon]

Be able to download files created my only wish 

[IBadget]

I would like to see CIMA integrated into CIS. That way, users can analyze a file's behavior without having to block requests one by one. When D+ presents an alert, the following options should be available:

• Allow this request
• Block this request
• Treat as ...
• Perform CIMA

Performing CIMA within CIS will allow users to study the file's behavior at their own convenience. Going through dozens of D+ alerts to block requests can be tiring and inconvenient.

[Ronny]

Version 3.9 will bring CIMA like heuristics :-))

[OmeletGuy]

To Ronny No it wont. sorry 

I tested a cuple of known trojans and 2 of them were rated suspicious.
The problem i see is that one made OVER 3000 http Queries and that was not suspicious? it should be!
And the other deleted more then 150 values in this folder (LM\System\CurrentControlSet\Control\SafeBoot) if i understand that the right, thats SafeMode Values that should also be suspicious!

[Tags:]