Re: COMODO Anti-Malware Database may reach 3 Million this Weekend

[Jaki]

@RejZoR post:6

Verified keygens and cracks are totally harmless (even though not legal but still harmless). Different small tweak tools and plain small tools also.

My Dearest Educated RejZoR

With all my humility I can sincerely say that you still have not answered the question. What do you mean by “harmless” and “stuff” within the context of computer security. Please RejZoR, answer the question define “harmless” and “stuff”. Moreover, just between you and me, sort of, did CIS delete all of your keygens and cracks? You know, stuff. ;D

Peace. >:-D

[rejzor]

@Jaki post:9

My Dearest Educated RejZoR

With all my humility I can sincerely say that you still have not answered the question. What do you mean by “harmless” and “stuff” within the context of computer security. Please RejZoR, answer the question define “harmless” and “stuff”. Moreover, just between you and me, sort of, did CIS delete all of your keygens and cracks? You know, stuff. ;D

Peace. >:-D

Wtf? What ese should i say too you? Paint the whole thing in MS Paint?!?!?!

[Sliso]

@OmeletGuy post:167

Comodo will most likely reach 3,000,000 Definitions this weekend and it is growing at around 50,000 files per day. This means that if it keeps growing at 50,000 perday at July 1 it will be: 5,100,000 and at the end of year it will be a HUGE: 15,700,000 Definitions
keep track here:
Comodo Firewall | Get Best Personal Firewall Software for $29.99 A Year

I strongly doubt that Comodo will be able to sustain that rate. Most likely it will level off to something like 1000 sigs or lower per day.

RejZoR is right. I can’t see how Keygens and cracks can be classified as malware unless they actually act maliciously. Just the fact that they happen to be that type of software doesn’t mean that they are bad.
If you give antivirus alerts for harmless programs, when who is to say the user will not ignore the alerts for actual harmful ones?

[system]

@Sliso post:11

I strongly doubt that Comodo will be able to sustain that rate. Most likely it will level off to something like 1000 sigs or lower per day.

And I am sure you have some kind of proof to prove that?

Cheers,
Josh

[andyman35]

@Tesk post:7

Avira detects builder for Remote Administration Tools (RAT, backdoors) too. They are harmless too. They are only used to create a trojan, not a trojan. If you are unhappy with Comodo’s efforts and classification of malware I do not know why you stick around on the Comodo forum.

He does make a valid point though.Lumping all this stuff,both good and bad,together does lead to a high rate of FPs which not only cause alarm for average users but also impact negatively upon system functionality.Yes on the whole with unknown files it’s better to be safe than sorry but some of these are in common useage.

[andyman35]

@Melih post:181

Unclassified Malware is NOT unknown files.
these are found to be malware either through automatic analysis or by analysts themselves.

We just haven’t named them, thats all.

All these Unclassified Malware are actually Malware!

If you have an FP being reported as Unclassified Malware then its just that, an FP. Please report it to us so that we can fix it.

Otherwise Unclassified Malware will continue protecting users from Malware (Verified malware).

Melih

In that case it must be just a coincidence that all the FPs I’ve come across have been in the unclassified malware category (none so far with 3.9 it should be said).

[Melih]

@andyman35 post:14

In that case it must be just a coincidence that all the FPs I’ve come across have been in the unclassified malware category (none so far with 3.9 it should be said).

A signature created for a specific malware which is unnamed (aka Unclassified Malware) could be causing an FP. If you pls report these then we fix them asap.

yes majority of the issues with the FPs were fixed with 3.9.

thanks
Melih

[AeoniAn]

@Sliso post:11

…
RejZoR is right. I can’t see how Keygens and cracks can be classified as malware unless they actually act maliciously. Just the fact that they happen to be that type of software doesn’t mean that they are bad.
If you give antivirus alerts for harmless programs, when who is to say the user will not ignore the alerts for actual harmful ones?

+1

I have something else to say:

Since, and IF you have D+ and FW with restricted rules you can “ignore” those alerts. D+ and FW gives you more protection than any AV against this type of files. I’m not the only one saying this.

In my case, since both popular BlockList Manager and X-Setup were rated “as something not so understandable to me” (both reported as FP and they said: “harm application” or something like this - in “computish-short-language”, I just can’t care so much to the advices anymore… D+ and FW are here well tuned, and I feel safe. ;D In doubt, virustotal, SAS, MBAM or google. Included those little, very much popular and well known magic-executables…

What my grandma will think and do is another story… No worries, she doesn’t know how to play with these stuff anyway…

relax…

:comodo110:

[Jaki]

@RejZoR post:10

Wtf? What ese should i say too you? Paint the whole thing in MS Paint?!?!?!

My Dearest Educated RejZoR

WTF is not an expression of an educated person, don’t you think? >:( I have asked you politely, twice I might add, to define “harmless” and “stuff” within the context of computer security and still you have not answered. My only conclusion is that you don’t know what you are talking about; you just shoot with your mouth aimlessly. The mirage of savoir faire that you are trying to project is futile with me. When face with facts illusion and deceit always crumble under the weight of reality, if you know what I mean ;D.

Like I told you before you keep your harmless stuff a.k.a keygens and cracks and I’ll keep them away from my own computer. Fair, isn’t it?

Peace. >:-D

[HeffeD]

@Sliso post:11

RejZoR is right. I can’t see how Keygens and cracks can be classified as malware unless they actually act maliciously. Just the fact that they happen to be that type of software doesn’t mean that they are bad.
If you give antivirus alerts for harmless programs, when who is to say the user will not ignore the alerts for actual harmful ones?

Yep. I tried to get a macro recorder in the Scite editor for AutoIt added to the whitelist because it’s completely benign, but because it is ‘suspicious’ they won’t add it. Yes, it’s a keylogger… How else is it supposed to record your keypresses for the macro you are creating? It’s completely harmless (OK, I guess I could write a macro to steal my passwords… 88) ) but due to it’s behavior, it’s suspicious… :-TD

[Melih]

@HeffeD post:18

Yep. I tried to get a macro recorder in the Scite editor for AutoIt added to the whitelist because it’s completely benign, but because it is ‘suspicious’ they won’t add it. Yes, it’s a keylogger… How else is it supposed to record your keypresses for the macro you are creating? It’s completely harmless (OK, I guess I could write a macro to steal my passwords… 88) ) but due to it’s behavior, it’s suspicious… :-TD

suspicious is different than the signatures as its generated by the heuristic engine.

Melih

[OmeletGuy]

@Melih post:181

Unclassified Malware is NOT unknown files.
these are found to be malware either through automatic analysis or by analysts themselves.

We just haven’t named them, thats all.

All these Unclassified Malware are actually Malware!

If you have an FP being reported as Unclassified Malware then its just that, an FP. Please report it to us so that we can fix it.

Otherwise Unclassified Malware will continue protecting users from Malware (Verified malware).

Melih

Why don’t you just change it to Unnamed Malware or Uncategorized Malware? ;D :ilovecomodo: (V)

[rejzor]

@Tesk post:7

Avira detects builder for Remote Administration Tools (RAT, backdoors) too. They are harmless too. They are only used to create a trojan, not a trojan. If you are unhappy with Comodo’s efforts and classification of malware I do not know why you stick around on the Comodo forum.

One thing is when such tools are detected as such with a describing name (so you knw it’s a RAT tool) and another when they are detected as “Unclassified Malware”.
So to Jaki, if you have problems understanding what “i shoot from my mouth”, maybe you should start actually understanding what i write instead shooting nonsense from your mouth.

[Jaki]

@RejZoR post:21

One thing is when such tools are detected as such with a describing name (so you knw it’s a RAT tool) and another when they are detected as “Unclassified Malware”.
So to Jaki, if you have problems understanding what “i shoot from my mouth”, maybe you should start actually understanding what i write instead shooting nonsense from your mouth.

Well then call my bluff, explain to me in layman terms what did you mean by “harmless” and “stuff”. Come on, I’m waiting. Prove me wrong, even if you used MS Paint like you put it ;D. I don’t care.

Peace. >:-D

[MuziekMeester]

!ot!

@Jaki post:22

Well then call my bluff, explain to me in layman terms what did you mean by “harmless” and “stuff”. Come on, I’m waiting.

Guys, you’re kind of wasting your time. In layman terms, “harmless” is a completely relative term if you consider the multitude of network environments and the vast difference of user experience out there.
As an example, on my computer, I store a copy of sysinternals blue screen screen saver. No big deal so far, until CAV started to complain that it was some kid of nagging device (i forgot the exact wording as i put it on my exclude list). Well, to me it is harmless little stuff, if you like to call it that way. But nevertheless, I can imagine people who’ll get a heart attack (or contact a lawyer for whatever reason :P) if someone installs that screen saver without their knowledge and it surprisingly pops in with tons of open documents while they were getting a coffee.
It’s the same with other programs like key-generators or similar things. While on you’re private computer (or in your private network that is run under your responsibility) you’ll probably have them there for a reason, in a corporate network, things may look completely different.

Well, and “stuff” is just “stuff”. Like, in…well, “stuff”, you know?

So, if you’re annoyed that CIS flags things that you actually don’t consider dangerous, put them on your safe file list. They may be in the 3 million + signatures (have to get back to topic somehow… ) for reasons beyond our imagination. 8)

[andyman35]

False positives might be just a minor inconvenience to technical users able to differentiate the bad from just what is flagged up as bad,but to an inexperienced or average user that tends to be cautious and block everything,they represent a major headache.

[Melih]

@andyman35 post:24

False positives might be just a minor inconvenience to technical users able to differentiate the bad from just what is flagged up as bad,but to an inexperienced or average user that tends to be cautious and block everything,they represent a major headache.

very much so. Hence why we worked very hard to mitigate all these FPs in ver 3.9.

thanks
Melih

[rejzor]

Of course. But you also refused to fix a false positive(s) even though it was clearly a false detection.
It was a loader for some game so it can be used offline. It was not even a correct detection.
Unclassified Malware. So if you refuse to fix something, then tag it appropriately.
Like Application.Loader.Somegame, not Unclassifed Malware 88)

[JoWa]

I wonder what Joke is. 88) This time (in 1121) it’s something called Joke.Win32.BadJoke.Renos.~Q.

[jeremysbost]

@JoWa post:27

I wonder what Joke is. 88) This time (in 1121) it’s something called Joke.Win32.BadJoke.Renos.~Q.

It is a late April Fools day joke, of course. 88)