COMODO Cleaning Essentials 1.6.183539.73 has been released!

[Guest]

[Tech]

Speedy, I've found 16 files detected by CCE today. I'll post them. Not all of them are false positive: one is a keylogger and few others are PUPs. But the majority are false positives, regardless the virustotal mimic reaction to them. I'll post the virustotal links also here:
https://forums.comodo.com/av-false-positivenegative-detection-reporting/post-here-your-unfixed-fps-only-after-2-days-t36306.0.html

[kail]

.. regardless the virustotal mimic reaction to them. ..

I don't understand, what is this? Thanks.

[Tech]

I don't understand, what is this? Thanks.

One detection is followed by the others. It's the sheeper behavior. Already proved by Kaspersky (legally or not).
http://www.theregister.co.uk/2010/02/10/kaspersky_malware_detection_experiment/
http://scforum.info/index.php?PHPSESSID=68c9179e3139a66e8ee4d7500fdf8c30&topic=3772.msg9828#msg9828

Blog refers to a trap created by kaspersky, to show that many antivirus companies do not make a dynamic analysis of the samples that come to their laboratories, but rather copied the detections that appear on VirusTotal.
http://forums.comodo.com/other-security-products/kaspersky-created-a-test-which-demonstrated-problem-with-av-detections-t51344.0.html;msg366615#msg366615

Be sure that I'm not accusing any company of doing so, just that some "false positives" replicate in virustotal until the companies correct the detection.

[languy99]

One detection is followed by the others. It's the sheeper behavior. Already proved by Kaspersky (legally or not).
http://www.theregister.co.uk/2010/02/10/kaspersky_malware_detection_experiment/
http://scforum.info/index.php?PHPSESSID=68c9179e3139a66e8ee4d7500fdf8c30&topic=3772.msg9828#msg9828

Blog refers to a trap created by kaspersky, to show that many antivirus companies do not make a dynamic analysis of the samples that come to their laboratories, but rather copied the detections that appear on VirusTotal.
http://forums.comodo.com/other-security-products/kaspersky-created-a-test-which-demonstrated-problem-with-av-detections-t51344.0.html;msg366615#msg366615

Be sure that I'm not accusing any company of doing so, just that some "false positives" replicate in virus-total until the companies correct the detection.

 That is one thing I will give comodo, they do analysis on their own ( this forces the people in the company to learn and improve processes, instead of just using others info), I remember that trap from Kaspersky and comodo did not fall for it. Most of comodo's analysis is done dynamically by the servers, that is why they can handle so much malware all at once. But as we know this does lead from time to time an increase in FP.

[Tech]

Thanks languy, right now it taking me some hours to report CCE false positives. Hope I'm helping improving detection.
There are some "problematic" VT analysis on my files. But they're clean for sure (I'm also posting where to download the setup files when possible).

[SpeedyPC]

WOW Comodo really does need a big whip to clean out the CCE false positives and this doesn't look good

[Solarlynx]

Yes, false positives give great disadvantage to CCE.

[Tech]

WOW Comodo really does need a big whip to clean out the CCE false positives and this doesn't look good

In fact, they're working hard on it. No problem.

Yes, false positives give great disadvantage to CCE.

Of any detection tool... It will always be this way: cat and mouse fighting, malware and detection...

[Solarlynx]

Of any detection tool... It will always be this way: cat and mouse fighting, malware and detection...

Yes, but all detection tests show that antiviruses having equal detection rate may have very different false positive rate - up to zero. Unfortunately Comodo has the highest false positive rate among the best antiviruses.

[Tech]

Yes, but all detection tests show that antiviruses having equal detection rate may have very different false positive rate - up to zero. Unfortunately Comodo has the highest false positive rate among the best antiviruses.

Oh, I see.

[wasgij6]

In fact, they're working hard on it. No problem.
Of any detection tool... It will always be this way: cat and mouse fighting, malware and detection...

what are they working on? how are they going to fix this?

[EricJH]

CCE is now officially launched on Comodo website!:

http://www.comodo.com/business-security/network-protection/cleaning_essentials.php


thank you!

Melih

[trscsaeg]

my response to Dave1234 didn't post correctly and i can't seem to fix it so i'm reposting here.

"i'm aware now that DACS currently scans in memory only and that DACS is only in 1.5 version because of your previous post which i read. i assume that DACS has the capability to one day scan all unknown files and not just the ones in memory once it's integrated into CIS and don't see why it couldn't one day do the same in CCE so i assume already that this could be a possibility in the future. and i know CIS AV scans unknown files other than memory but i never asked about that.

But my questions are:

will DACS one day scan unknown files other than just the ones in memory? not is it a possibility

will DACS be back in the next version? meaning i know i.6 is the latest and am asking if it will be in the version following 1.6 or a variant of 1.6? not if it's available in an older version.

i know this comes off as rude and i really don't mean for to be but it's the only way i know how to put it because my objective for these questions are to get concrete answers from someone who knows for sure the answers to them such as melih or other comodo staff.

but i do thank you for your reply because i did learn that DACS is in 1.5. you sound like you keep up with this stuff pretty well and i appreciate that"

[Tech]

will DACS be back in the next version? meaning i know i.6 is the latest and am asking if it will be in the version following 1.6 or a variant of 1.6? not if it's available in an older version.

Also wants to know

[Tags:]