CIS on Virustotal detects file but not CIS on computer [WBZ]

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
#1

The bug/issue

  1. What you did:
    Did a scan of a folder filled with malware with heuristics on high. No malware was found. I then checked the files on virustotal and some were even detected with actual detection names (ie not heuristics).

  2. What actually happened or you actually saw:
    I checked the files on virustotal and some were even detected with actual detection names (ie not heuristics).

  3. What you expected to happen or see:
    The detection should have been the same with heuristics on high and cloud scanning enabled.

  4. How you tried to fix it & what happened:
    I checked my settings. For manual scanning everything was selected and maximum size was set to 9999.

  5. If its an application compatibility problem have you tried the application fixes?:
    NA

  6. Details (exact version) of any application involved with download link:
    Virustotal links to the samples in question.
    http://www.virustotal.com/file-scan/report.html?id=8fc05b4bb2e2365f320d596c70b43ed4b2dd94376695d9a7bf1122af03402afa-1288213441

http://www.virustotal.com/file-scan/report.html?id=b4536ec6ba9923b4ea523a60d04edcd454ae1035ab0e21009efcfdaa32aa237e-1288288783

http://www.virustotal.com/file-scan/report.html?id=8e1fbf03626eac6e3ffb2e8d470e1d2891aa335a2f8d30c452f5e3e483c3366c-1288214573

http://www.virustotal.com/file-scan/report.html?id=01d602e84ace9c9e264b8a2bd9a7393852c70a10abfb2993b38e9ceab5126650-1288242203

http://www.virustotal.com/file-scan/report.html?id=ef3252e0f410b1e173dc18443b49300417094d95f5ada671684be2143837d779-1288250231

http://www.virustotal.com/file-scan/report.html?id=957ab7cfb564c9ecd66a21e6ff706147200164ccf96639742c72a36036c35151-1288264486

http://www.virustotal.com/file-scan/report.html?id=46b382304e3f7418e9ef892f0041397ed3277b291774afb43ea7cb605ff27512-1288203725

http://www.virustotal.com/file-scan/report.html?id=6182f9a21de883080319caa7d4ece6ebed19ae33785a5ebdac3f36fb52c0ff41-1287835511

http://www.virustotal.com/file-scan/report.html?id=2a30677fd047dfd789fc80088bfa4993c177ec7292e5d30110c3d9008447ed86-1288265956

I can also provide you with the actual files, or CIMA links if you prefer.

  1. Whether you can make the problem happen again, and if so exact steps to make it happen:
    It happens every time I scan these files.
  2. Any other information (eg your guess regarding the cause, with reasons):
    Unknown

Files appended. (Please zip unless screenshots).
I have attached a hijack this log so you can see the programs running.

  1. Screenshots illustrating the bug:
    See links above.
  2. Screenshots of related event logs and the active processes list:
    NA
  3. A CIS config report or file.
    NA
  4. Crash or freeze dump file:
    NA

Your set-up

  1. CIS version, AV database version & configuration used:
    CIS Premium 5.0.162636.1135
    AV Database version is 6540
    I have it configured as described here. The real-time scanner is disabled and for the manual scanning every box is checked and the heuristics level is set to high. Just to be clear. Enable cloud scanning was checked.
  2. a) Have you updated (without uninstall) from CIS 3 or 4, if so b) have you tried reinstalling?:
    No
  3. a) Have you imported a config from a previous version of CIS, if so b) have U tried a preset config?:
    No
  4. Other major changes to the default config (eg ticked ‘block all unknown requests’, other egs here. )
    Described in my article.
  5. Defense+ and Sandbox OR Firewall security level:
    In general it is set to proactive security. Defense+ and Firewall are in Safe mode. Antivirus is disabled. Sandbox is enabled.
  6. OS version, service pack, no of bits, UAC setting, & account type:
    Windows 7 x64 fully updated. UAC is disabled. Account is admin.
  7. Other security and utility software running:
    No other real-time scanners besides CIS. See log file for any other processes.
  8. Virtual machine used (Please do NOT use Virtual box):
    Not a virtual machine

[attachment deleted by admin]

#2

can you provide me those files so I can check them against my system? TY

#3

Thank you for the bug report.

Moving to format verified.

Dennis

#4

I recall Melih commenting somewhere, cannot find it, that VT does not have v5 console scanner yet. It needs to be written for Win 2k.

That would mean VT scans with v4.x.

#5

Here are following two possibilities:

  1. Sample was malware but at the same time was safe also but via cloud and safe sign may not be part of bases.cav, as CIS uses cloud it may not detect but console scanner can as it doesn’t not use cloud.

  2. Sample was signed and signer was in TVL, CIS uses TVL but console scanner does not.

Thanks
-umesh

Note: We have submitted VirusTotal CIS V5 console scanner which has cloud enabled, awaiting their integration completion response.