Comodo Cloud Antivirus v1.12.420066.533 RC

[Yousername]

@woodrow post:30

On my end it is the same old song with Valkyrie, is there an ETA when the wait between submit (sandboxed files) and remedy from Valkyrie?

Or is there an “expected” time to wait for Valkyrie?

Or a better answer would be how long the expected wait will be when you (the comodo crew) consider this Vakyrie project final?

/W

Quote from CEO:

@Melih post:2074

We are investing heavily on detection technologies…
We created “prevention” technologies…so we can protect our users and customers…Now we turned our attention to detection technologies…you are seeing the affects of it, and this is only the beginning. We have created some really funky ways to detect malware…it blows your mind…when these capabilities get into production you will see how powerful they are…

Cloud AV users should not have any “Unknowns” after 3 days of seeing that unknown…we are reducing this to 4 hours…So between amazing protection and awesome detection I think we will serve our users well.

[woodrow]

Thx for the info, the thing is that I have unknowns that are weeks old?

From earlier I learned that your computer would not have to be on all the time for Valkyrie to do what it does.
If you sandbox an unknown today it gets submitted to Valkyrie, I close down my computer and start it up next morning and the verdict should be in.
This does just not happen, now I wonder if this problem only exist on my end, or is there others out there who also experience this?

/W

[Yousername]

@woodrow post:32

Thx for the info, the thing is that I have unknowns that are weeks old?

From earlier I learned that your computer would not have to be on all the time for Valkyrie to do what it does.
If you sandbox an unknown today it gets submitted to Valkyrie, I close down my computer and start it up next morning and the verdict should be in.
This does just not happen, now I wonder if this problem only exist on my end, or is there others out there who also experience this?

/W

I think you should try to manually upload them.
It can take a long time. If your unknowns are random obscure unknowns then most likely the files submitted will require human analysis. Valkyrie tries to determine file verdict automatically using automated detection techniques. The obvious safe and malicious files are probably processed quickly, but I imagine that it is harder to provide automated verdicts for files that are more in the gray area, like a clean file that does not have a digital signature or a random dependency of a legit app, so human analysis is required. Human analysis can take a long time with the number of files that need to be analyzed. If you want something whitelisted it is probably better to submit it for whitelisting here Comodo Forum

[pio]

@woodrow post:30

Or a better answer would be how long the expected wait will be when you (the comodo crew) consider this Vakyrie project final?

A final stage of valkyrie ? This question is easy to answer . NEVER EVER !!!

Because the development of malware never stops , the same must also apply to valkyrie ! A never ending story of development and fight for improvements !

Regards !!!

[woodrow]

@pio post:34

A final stage of valkyrie ? This question is easy to answer . NEVER EVER !!!

Because the development of malware never stops , the same must also apply to valkyrie ! A never ending story of development and fight for improvements !

Regards !!!

Maybe I was not clear enough, English is not my native language after all.
I understand that development will never stop, but the question was, how long the expected time for a unknown file should be, until I get a verdict?

/W !!!

[pio]

@woodrow post:35

Maybe I was not clear enough, English is not my native language after all.
I understand that development will never stop, but the question was, how long the expected time for a unknown file should be, until I get a verdict?

Hi woodrow ,

to answer that I quote Melih again .

@Melih post:2074

Cloud AV users should not have any “Unknowns” after 3 days of seeing that unknown…we are reducing this to 4 hours…So between amazing protection and awesome detection I think we will serve our users well.

Valkyrie is constantly evolving . To implement any improvements completely , it takes time . Maybe it is also possible to reduce the waiting time even further . You also have the possibility to upload the file to valkyrie ! >>> Comodo Valkyrie Customer Login | Advanced File Analysis System . At the moment , the waiting time is about 20 to 45 seconds . So try it out if you want ?!

Best Regards !!!

Pio

[woodrow]

Ok, the problem is not that the files needs to be uploaded to Valkyrie, they are already there, since 170623.
CCAV tells me that Valkyrie is still analyzing these 7 files, almost 4 weeks later.
I consider this a problem, (maybe even a bug?) that is why I ask if there are others in the same situation.

From what I know, these are all malware, and they are still sitting on my system.
I know I am safe because of the sandbox, but that is not the question here.

/W

[pio]

hi woodrow ,

i send you an PM !!!

Anyway … , sometimes when valkyrie gets maintenance , then it is possible that some files can not be transmitted correctly . Perhaps you had caught such a moment ?!

Kind Regards !!!

pio

[mad]

I have a similar problem like woodrow.
I am not sure if this is a bug or something that is still being worked on (that is why I have let it be until now).
I attached 2 screenshots. I have 27 being analyzed files (e.g. from the screenshot: it is a Realtek driver and a bunch of MS Office files).
Can someone have a look at this?
If needed, please move post. I can provide additional info if needed. Thank you.

[woodrow]

Ok, then we are two guys with the same problem, only difference is that all mine are malware.
I guess Umesh are sipping drinks on a well deserved vacation, but if you read this, please do not release CCAV final until this is resolved once and for all.
This will be a killer AV if all features that are in now would just work 100%.

/W

[Flykite]

Hi mad & woodrow,

Could you please provide us some “Being analyzed” files? I want to check them on our side.

thanks in advance!

@mad post:39

I have a similar problem like woodrow.
I am not sure if this is a bug or something that is still being worked on (that is why I have let it be until now).
I attached 2 screenshots. I have 27 being analyzed files (e.g. from the screenshot: it is a Realtek driver and a bunch of MS Office files).
Can someone have a look at this?
If needed, please move post. I can provide additional info if needed. Thank you.

[woodrow]

The second screenshot from mad shows the dates, for me these dates change every time to the current date when I open that window.

Could this be an issue? The date should be the date the files were submitted right?

/W

[mad]

@woodrow
The dates do not change in my case. The files and the dates stay the same.
Only when I am installing a new game and give it exception in CCAV, it gets added to the end of the being analyzed list; upon uninstalling the game, the entry disappears.

@Flykite and pio
I send you a link to the archive containing some sample files from the previously posted list.

[umesh]

Hi woodrow,
We are not there yet but working towards that goal.
There are significant improvements but every submitted file can not be classified over night at the moment, some do get analyzed very fast and some don’t.

Rest assured, we are working towards that goal, where you get up and CCAV world is classified into black and white

Thanks
-umesh

@woodrow post:32

Thx for the info, the thing is that I have unknowns that are weeks old?

From earlier I learned that your computer would not have to be on all the time for Valkyrie to do what it does.
If you sandbox an unknown today it gets submitted to Valkyrie, I close down my computer and start it up next morning and the verdict should be in.
This does just not happen, now I wonder if this problem only exist on my end, or is there others out there who also experience this?

/W

[woodrow]

@umesh post:44

Hi woodrow,
We are not there yet but working towards that goal.
There are significant improvements but every submitted file can not be classified over night at the moment, some do get analyzed very fast and some don’t.

Rest assured, we are working towards that goal, where you get up and CCAV world is classified into black and white

Thanks
-umesh

Great Umesh!
Then it is not a good idea to release information that detection should take only 4 hours, this only adds to the confusion. (See posts above)
It is always better to say that this is still a work in progress, or else people trying CCAV will just uninstall it, and start spreading ■■■■.

Keep up the good work!

/W

[woodrow]

Hi guys, what happened to Valkyrie now?
You guys must have found my id or something, poof and all the “Being analyzed” were gone and counter down to zero.
Just for fun I did run 2 of these files again (all malware by the way), and they ended up Being analyzed again… :o
Another thing is even more strange, all the files (malware) are now analyzed, but they did not get removed, Valkyrie had a few to many in these vaccination times or what?

/W

[miloszcz]

We are still missing point 6 in this graphic. Many unnecessary reanalysis and a great delay in protecting the whole community(detecting malware on everyone’s system). This had been working great with CIMA analysis - after finding suspicious behaviour the global cloud signature was made instantly (i.e. from executing new malware in sandbox to global detection of CIS users in ~15 minutes). BTW This is the new MS Windows Defender algorithm.

[umesh]

Hi morphiusz,
Please elaborate as what you mean we are still missing point 6?

Thanks
-umesh

@morphiusz post:47

We are still missing point 6 in this graphic. Many unnecessary reanalysis and a great delay in protecting the whole community. BTW This is the new MS Windows Defender algorithm.

[miloszcz]

No synchronization with verdicts from valkyrie.comodo.com and CCAV.
Are files found by valkyrie as malware (especially human analysis) submitted either via web interface or CCAV itself detected globally ad hoc?
Reanalysis of again executed files despite they’ve got a verdict before (according to woodrow).
I haven’t tested CCAV recently but remember that I had similar experience.

[umesh]

Hi morphiusz,
This is how it works:
1.
A file gets analyzed by any system, Valkyrie/ human, file’s verdict is immediately reflected via FLS (File Lookup Service). This way any new user who sees the file gets benefited immediately.

In case a file has been seen by CCAV and is under analysis on a given client, it is looked up at least once a day to re-check latest verdict if malware or safe.

So we do have all six points firmly in place.

Now regarding problem woodrow seeing that he has files classified in back-end but still not classified by CCAV, we will be looking at those cases if we have syncing problem somewhere between Valkyrie and look up service.

So to answer your questions:

@morphiusz

No synchronization with verdicts from valkyrie.comodo.com and CCAV.

There is periodic look up for files under analysis in CCAV.

@morphiusz

Are files found by valkyrie as malware (especially human analysis) submitted either via web interface or CCAV itself detected globally ad hoc?

Yes, including CIS gets benefited.

@morphiusz

I haven’t tested CCAV recently but remember that I had similar experience.

We did have issues in past where Valkyrie results were not reflect in cloud. Should be all fine now.

Thanks
-umesh

@morphiusz post:49

No synchronization with verdicts from valkyrie.comodo.com and CCAV.
Are files found by valkyrie as malware (especially human analysis) submitted either via web interface or CCAV itself detected globally ad hoc?
Reanalysis of again executed files despite they’ve got a verdict before (according to woodrow).
I haven’t tested CCAV recently but remember that I had similar experience.