Hi All,
We have made recognizers v1.10.0.105 available via test server for CCAV.
Similar update is released in CIS in RC mode:
Changes:
On top of previously released recognizers v1.9.0.52, following are additional malware families covered:
[ol]- Trojan.MSIL.ProxyChanger.~AK
- Trojan.Win32.Agent.~QMG
- Trojan.Win32.Agent.~RXL
- Trojan.Win32.Emotet.~AW
- Trojan.Win32.Injector.~DRXK
- Trojan.Win32.Injector.~DRYS
- Trojan.Win32.Injector.~DSLO
- Trojan.Win32.Kryptik.~FRYF
- Trojan.Win32.Kryptik.~FWMP
- Trojan.Win32.Kryptik.~FWUH
- Trojan.Win32.Remtasu.~Y
- Trojan-Downloader.Win32.Agent.~CXA
- Trojan-Dropper.MSIL.Agent.~AKH
- Trojan-spy.Win32.Pavica.~CQ
- Trojan-spy.Win32.SpyEye.~BW
- Worm.MSIL.Agent.~KX[/ol]
Steps to test:
1.
Have following entries in Windows hosts file(c:/windows/system32/drivers/etc/hosts)
91.209.196.83 download.comodo.com
91.209.196.83 www.download.comodo.com
Run manual updater, in case you are using latest CCAV version, although it would say “no updates available”, it will still update recognizers as that’s in auto update and also updated whenever you run manual updater. We need to improvise like CIS to explicitly show as what all is updated. Once updated, you will see recognizer version via About interface as shown in enclosed CCAV_Recognizer_v1.10.0.105.png
Looking for product stability while using this recognizer.
Please run applications in Sandbox and report if you see anything abnormal.
Any feedback is highly appreciated.
Thanks
-umesh