We received over 2Gig of Malware last 24 hours from our users!!!!

[Kyle142]

@darcjrt post:39

It is under MISC menu…Submit Susp Files.

The prob is that you can only submit exe, dll, pif, and other files very limited. You cant submit .. So I send a ZIP file with EXE extension and then specify on the description to change the ext back. I would like to know if COMODO see this description.

AHH. I see, Shows how much i know about comodo 88)
I understand now.

[darcjrt]

@.FaZio93. post:40

I always get the 412 timeout error when trying to submit that way.

Really? It always works for me. Make sure you dont have a rule or something on the firewall. I even submit files and get a response back: “ALREADY SUBMITTED BEFORE” or “ALREADY IN COMODO LABS UNDE EVAL.”

@Kyle post:41

AHH. I see, Shows how much i know about comodo 88)
I understand now.

LOL. ;D
that’s ok. It happens to the best of us!

[Melih]

@darcjrt post:37

Melih,

How about the file submission embedded in CIS? Do the COMODO staff get those files? Right now is not my intention to get a response from comodo. On the contrary, I’m interested to know if the COMODO staff get those files and more important, if they get the file description on the file. See attach pic for reference.

EDIT; OMG dont take me wrong!!! I would love to see response from COMODO, however I’ve been submitting LOTS of files using COMODO File Submission!!

Thanks!

Well, we do receive those… but the ones that gets sent to me get priority
So at this stage, until things calm down a bit, i would recommend using me as the point to push these malware into our system. The reason is cos we get huge amount of files (of which majority are non-malware) from these submissions. So sending the malware to me gets on top of the queue.

thank you

Melih

[system]

Great to see that everyone tries their best to help somehow.

(I hope you guys also use honeynets/honeypots)

[jeremysbost]

@Melih post:43

Well, we do receive those… but the ones that gets sent to me get priority
So at this stage, until things calm down a bit, i would recommend using me as the point to push these malware into our system. The reason is cos we get huge amount of files (of which majority are non-malware) from these submissions. So sending the malware to me gets on top of the queue.

thank you

Melih

Is it your private email address, or the “malwaresubmit {at} avlab.comodo {dot} com” one?

[Melih]

@jeremysbost post:45

Is it your private email address, or the “malwaresubmit {at} avlab.comodo {dot} com” one?

private pls.
thanks
Melih

[jeremysbost]

@Melih post:46

private pls.
thanks
Melih

Umm…where do I find your private email? Our am I supposed to PM you?

[alaertsxan]

You can or pm them to melih and upload the malware to a remote server 2share/megashare/rapidshare or such. or follow the rules on this topic

https://forums.comodo.com/false_positivenegative_reporting_is_this_a_malware_that_cis_hasnot_detected/reporting_false_positivessuspicious_files_submitting_them_to_the_lab-t27062.0.html

Xan

[user4]

What happens when trojan downloaders are found\submitted (most of the malware embedded in websites)?

Do you just add those individual files to the database, or do your analysts let that malware do whatever it wants (i.e. download files) and monitor that process, so you can eliminate the entire “system” in one go? In other words, do you deal with a single file or with the x-number of files that automatically follow the first one as well?

[alaertsxan]

AFAIK, they analyze the malware and then add it to the database. So it wil be whole the trojan I think…

Xan

[user4]

Well, lets hope so. The names of these files are a bit odd and non-descriptive, which doesn’t look good to me. Like they can’t come up with a real name for new threats, or don’t check “beyond” the individual file (a trojan downloader in this case).

http://img370.imageshack.us/img370/4416/comodoeu3.gif


http://img370.imageshack.us/img370/comodoeu3.gif/1/w392.png

[deepcut]

I’m a Comodo Firewall 3 and Avast! Antivirus user.
I think I may have tried Comodo AV in the past and decided it wasn’t matured enough.
I’m glad to see that Comodo are now focusing on updating CAV and will certainly give CIS a try at some point.

Regarding this actual topic of Comodo soliciting for submissions I would suggest sites like VirusTotal and Jotti’s Malware Scan. I notice Comodo AV is already listed on VirSCAN.
I personally submit samples through VirusTotal and VirSCAN in the hope that this spreads the benefit to the widest number of people.

I would also like to see Comodo AV listed on AV comparative and testing sites. I would guess this is something Comodo are planning once they feel the new CAV is ready ?
For example: AV-Test, Virus Bulletin VB100, AV-Comparatives.
Much like CFP is listed on Matousec’s Firewall Challenge.

Perhaps the more active forum regulars here can suggest more ?

[Kyle142]

Sure they will Just waiting on detections to increase, Thanks for the suggestions

[jebuchanan]

A

@deepcut post:52

I would also like to see Comodo AV listed on AV comparative and testing sites. I would guess this is something Comodo are planning once they feel the new CAV is ready ?
For example: AV-Test, Virus Bulletin VB100, AV-Comparatives.
Much like CFP is listed on Matousec’s Firewall Challenge.

Perhaps the more active forum regulars here can suggest more ?

The Matousec’s Firewall Challenge site lists Comodo Firewall Pro as free evaluation version, with a paid version that offers additional features.
Correct me if I am wrong, but CFP (now CIS) is completely free, non-limited/non-restricted, and the paid ‘feature’ is an on-line service.
Their information should be updated to correct any errors that may mis-represent the firewall in any way. I did send them a friendly email letting them know this, and the current version available.

[Melih]

@John buchanan post:54

A
The Matousec’s Firewall Challenge site lists Comodo Firewall Pro as free evaluation version, with a paid version that offers additional features.
Correct me if I am wrong, but CFP (now CIS) is completely free, non-limited/non-restricted, and the paid ‘feature’ is an on-line service.
Their information should be updated to correct any errors that may mis-represent the firewall in any way. I did send them a friendly email letting them know this, and the current version available.

You are correct.

Melih

[jebuchanan]

Thank you, Melih.

[Kayrac]

i still got like 50 or so files that are undetected from when i submitted them a while ago

mostly fake antivirus’s left, a few that don’t connect anymore as the phone home is broke(doesn’t mean it won’t come back up), and 2 online games files left, and hmmm think thats it

[ailef]

anyway the version of comodo on matousec site is old build.

[Melih]

@Kayrac post:57

i still got like 50 or so files that are undetected from when i submitted them a while ago

mostly fake antivirus’s left, a few that don’t connect anymore as the phone home is broke(doesn’t mean it won’t come back up), and 2 online games files left, and hmmm think thats it

yes the fake antivirus ones don’t show up as malicious with automatic analysis so they are done manually… (long process )… you can always send those to me if you like for me if you know for sure they are malware… I will tell the guys so that they can push it thru the system…

thanks
Melih

[system]

@Melih post:59

yes the fake antivirus ones don’t show up as malicious with automatic analysis so they are done manually… (long process )…\

Just waiting for that back end infrastructure aren’t ya Melih!! (:WIN)

Josh