App Review Comodo's killer.

[vitao]

In your video, you showed, that for a few-day-old malware samples, the difference can be small. But, that is how the reduced set of signatures is selected. It probably does not contain less than few-hour-old and more than few-month-old malware.

well, if 500 malwares are just "a few"...

anyway, with these 500 malwares cis manual scan detected exacly the same malwares by using its full signature database and the lite database. this proves that there is no difference between the full or the lite signature databases.

maybe another lie from comodo? or just another bug? i dont know. what i know is that there is no point using the full database. this will just use more hd space for no gains...

you said that the difference can be small but youre wrong. there is no difference.

 

[Andy Ful]

anyway, with these 500 malwares cis manual scan detected exacly the same malwares by using its full signature database and the lite database. this proves that there is no difference between the full or the lite signature databases.

Your test strongly suggests that older samples are mainly not reused in the attacks (I believe that this is true).
If you want to see the difference you must test one-year-old samples or few-hours-old samples.
A few days-old samples are useless for that.

 

[vitao]

If you want to see the difference you must test one-year-old samples or few-hours-old samples.
A few days-old samples are useless for that.

ohhh i understand now. ok. ill do it soon..

 

[Vitali Ortzi]

ohhh i understand now. ok. ill do it soon..

Benefits of Full signatures are usually for older threats in av software would be interesting to see if that the case here too

 

[Sandbox Breaker - DFIR]

Not sure that's exactly fair
But since you use prevention and then manual submission and wait till it's clean/ malware
You should be safe against most of the malware in the wild 99.99%+ except a few tactics shown in this fourm
And Andy gave some solution for most of the 0.0001 percentage

Amen