Melih,why it is so difficult to create heuristic for similar Brazilian trojans ?

General Discussion (off topic) Anything and everyt
1

Are thousands of similar Brazilian Trojans disseminated every day that Comodo Antivirus does not detect.

https://forums.comodo.com/news-announcements-feedback-cis/why-comodo-antivirus-does-not-detect-encrypted-installers-t114631.0.html

2

Are they detected by valkyrie? Remember, detection is not a primary line of defense for Comodo.

3

Yes, Valkyrie detect.

Yes, I know it detection not a primary line of defense, but why no have a heuristic for the numerous similar brazilian trojans daily ?

Thanks

4

I couldn’t find the samples in the other thread. Let me analyze them, and find out why they are not detected first.

5

I will send to you by MP

Done !

6

What the result the analyze ?

7

Melih ?

Somebody ?

8

It’s weekend now. I would expect an answer as early as Monday.

9

See that there are thousands of similar Trojans entire month being created to achieve a nation ( Brazil ) of 200 million people.

10

I am not disputing the potential urgency of your observations. My concern is with the forum etiqutette. There is not much sense to urge outside the work hours. That doesnt’ mean I am not curious to learn about fatih’s findings.

11

Melih should give the answer always given to that detection is only a first line of defense.

And we would go for that.

12

From previous topic.

13

Fatih asked me the files and did not give me any answer.

14

Detection is not the first line of defense.
We put all unknowns into Sandbox/containment, thats your first line of defense!

15

Please note it may take some time.

Dennis

16

So why antivirus?

So why offer the antivirus to be tested in institutions such as the AV-Test ?

Detection is the first line yes, if not, not exist.

Thanks for your reply, Melih.

17

Every additional layer helps.
Besides. Occasionally you may allow a file to run, and it may be virus infected.
Nice to know you are always protected.

18

Why not create a heuristic line for these thousands of similar brazilian trojans daily?

Why not ? ? ?

It simple !!!

The single line of heuristic code.

Is it so difficult ?

19

Let’s hear what Fatih Orhan tells us after the weekend. We all know that Comodo is only slowly working on generic signatures. Although recently there have been observed some noticeable decreases in the size of the AV database.

20

Why Antivirus: For usability. no point in putting a known malware into sandbox. thats why Antivirus.