Chinese signed malware VS CIS 5 RC2

Comodo Internet Security - CIS Beta Corner - CIS
#1

Hi all

i give you a link to test somes chinese signed malware which seems to give hard time to RC2.

Someone can test it?

Byebye, have fun and take care!

Link to live malware removed

What changes to Cis Beta 5 are happening on Friday?.
#2

Malware is malware no matter were it comes from all av’s should detect some of it it’s no excuse not to and ignore it.

#3

:-\

[attachment deleted by admin]

#4

http://camas.comodo.com/cgi-bin/submit?file=ea7219e9861eda27606317e95e04967ef82c8b5d5cd766ddfabbb98a65e88a90

#5

what does cis cloud say ? >:-D ;D

#6

Comodo detect nothing! :-TD

#7

Well its true but only if you hit Allow!

#8

Hi tommymacangel.

Please don’t post any links/attachments relating to live malware as per forum policy:

#9

Any developer have the link and is working on this?

I try it yesterday and I found that only makes shourcuts and a toolbar in IE, no running process any file start with windows. Anyway they should take a look

#10

Just checked the CIMA analysis. Publisher is “Beijing Gigabit Times Technology Co., Ltd”. It is not on the local Trusted Software Vendors list of v5 RC2. Is this the name of the signature the executable is signed with?

If it not has been sent to a Comodo staff member or another mod could it be sent to me? Send me a pm.

#11

Yes, this is the name.I’ll send you a link on PM.

#12

Already done. :wink:

#13

May be it gives hard times to comodo AV (it’s not the best time now for its detection level) but CIS as suite should still block it even without users participation, cause they should be automatically sandboxed

#14

Thx. All 3 of y’all for sending.

#15

I still have link if someone need!

#16

I don’t like the fact that “local trusted vendors list” is bypassed in favor of cloud beh. blocker, I think only info from cloud should be provided and clear prompt… and ask-checking-determination-AV prompt from cloud if program is signed and in local list of trusted vendors but not yet seen in the cloud… also some malware are aware of CIMA sandbox but that is another and OT story…

CIS logic need to be changed here for particular case IMO

#17

it says scanned online and found safe

[attachment deleted by admin]

#18

http://camas.comodo.com/cgi-bin/submit?file=96c52cc748779f09fb6226b52067c91b76ec696e207317043c89aba34d0a019c

For CAMAS is suspicious, so maybe is because the CLOUD is not working 100% we have this kind of problems.

http://www.virustotal.com/file-scan/report.html?id=96c52cc748779f09fb6226b52067c91b76ec696e207317043c89aba34d0a019c-1283811071

#19

In virus total Comodo detects it and even giving a name to this malware ???

#20

Well I realized that RC2 not good at detection but vertion 4 is good and the beta was amaizing (In virus total they use v4)