Reply to thread

Message

<blockquote data-quote="vitao" data-source="post: 1111333" data-attributes="member: 109212">I see. So the file would probably download something that was really dangerous, but the remote server was down, and that&#039;s why CIS doesn&#039;t detect anything dangerous. Is that it?If that&#039;s the case, then something doesn&#039;t make sense for two reasons:1) If you look at VirusTotal now, you&#039;ll see that the number of engines detecting only this executable as a Trojan is increasing, and if the supposed remote server is down, it means that the engines are detecting the executable as dangerous and not what it would download from the remote server. Therefore, CIS failed to recognize this file as dangerous.2) If the executable isn&#039;t dangerous, but rather some file that it would supposedly download, then CIS also failed to identify an attempt to connect to an unknown remote server. Even if the server is down, the executable hasn&#039;t been changed, so it would be trying to connect to this server, regardless of whether it&#039;s offline or not. At most, it would try to connect or check if the server is online and if it is not, it would not try to establish a connection. However, some network interaction would still be necessary for this verification and this interaction should be intercepted by the CIS and it should warn about it, which does not happen.Considering what you explained, one could conclude that this could perhaps be classified as just an undesirable program and not as malware, but the identifications of more than 40 engines make it clear that it is a Trojan.Considering everything you mentioned, a more detailed analysis that was being carried out until a few minutes ago and the results obtained by other engines, I will keep the video online because until proven otherwise, it is malware and Comodo Internet Security was not able to identify anything about it or its actions (or attempted actions), while many others identify it immediately. But I will add an update to the video description explaining this situation.Or do you think I am wrong in this decision?</blockquote>

[QUOTE="vitao, post: 1111333, member: 109212"] I see. So the file would probably download something that was really dangerous, but the remote server was down, and that's why CIS doesn't detect anything dangerous. Is that it? If that's the case, then something doesn't make sense for two reasons: 1) If you look at VirusTotal now, you'll see that the number of engines detecting only this executable as a Trojan is increasing, and if the supposed remote server is down, it means that the engines are detecting the executable as dangerous and not what it would download from the remote server. Therefore, CIS failed to recognize this file as dangerous. 2) If the executable isn't dangerous, but rather some file that it would supposedly download, then CIS also failed to identify an attempt to connect to an unknown remote server. Even if the server is down, the executable hasn't been changed, so it would be trying to connect to this server, regardless of whether it's offline or not. At most, it would try to connect or check if the server is online and if it is not, it would not try to establish a connection. However, some network interaction would still be necessary for this verification and this interaction should be intercepted by the CIS and it should warn about it, which does not happen. Considering what you explained, one could conclude that this could perhaps be classified as just an undesirable program and not as malware, but the identifications of more than 40 engines make it clear that it is a Trojan. Considering everything you mentioned, a more detailed analysis that was being carried out until a few minutes ago and the results obtained by other engines, I will keep the video online because until proven otherwise, it is malware and Comodo Internet Security was not able to identify anything about it or its actions (or attempted actions), while many others identify it immediately. But I will add an update to the video description explaining this situation. Or do you think I am wrong in this decision? [/QUOTE]

Verification