[ol]- Files added by CIS to ‘My Pending files’ (eg automatically sandboxed files, and - t.b.c - files submitted from a CIS alerts) are automatically checked (‘looked-up’) against a server-based checklist.
- If this lookup establishes they are safe they are moved to ‘My Safe Files’, and an event is logged in the D+ logs, which says ‘Scanned Online and Declared Safe’. If they are malware they appear to be deleted, and an event is logged which says ‘Scanned online and found malicious’. If of uncertain status they remain in ‘My Pending Files’ awaiting manual submission. You can carry out the same checking process on files you submit yourself by using the ‘Lookup’ button in ‘My Pending Files’.
- Files of uncertain status may be manually submitted for analysis using the ‘Submit’ button in ‘My Pending Files’.
- Submission may fail if server load is high. If this happens the files involved may have a submission date of 1/1/70. Please resubmit these files manually using the submit button. Occasionally files persistently fail to submit. Please report this as a bug.
- If files are analysed and declared safe they are automatically added to the ‘My Safe Files’ list, and removed from the sandbox. Events are logged and action is taken as above.
- The file analysis backlog is still very large at time of writing - 22 June 2010. If you cannot wait for files to be analysed, you can submit them for automated analysis by CIMA here. A result of ‘undetected’ means the files are very likely (but not certain) to be safe, and you can move them to My Safe Files, using the ‘Move To’ button. If you need certainty you will need to wait for the results of full analysis via ‘My Pending Files’.[/ol]
I understand that Comodo is currently working to improve the rate of file processing by using more automated methods, and by uploading millions more signatures to reduce the processing backlog.
[i]Please help us improve this FAQ entry by posting suggestions to the ‘Sandbox help materials - Feedback’ topic here. This topic has been prepared by a volunteer moderator – with input from many other moderators and Comodo staff members. (Thanks everyone, especially Panic, Kail, Ronny, Egemen & Matty_R). It has been produced on a best endeavours basis - it will be added to and corrected as we find out more about this topic. Please note that I am not a member of staff and therefore cannot speak on behalf of Comodo.
Updated: 22 June 2010 to reflect CIS version 4.1.xxx.920
[/i]