FMA Intel-Secure CBAD Cloud Antimalware 2014 (BETA 2 FREE Version)

[Nico@FMA]

If ur start detecting them in the future, so ur detection is crappy too? that makes no sense. Ur to harras to some companies, srsly. How u can even call Qihoo have crappy detection. Better learn to respect the hard work from other ppls.

Lol you joking me right? I was meaning this in a sarcastic way against Qihoo.
Obviously their product is good, no doubt. Its just that i do not like the fact that every single time its always the same AV company that detects new software as malicious by default.
Out of all the versions we have released i have like 300+ complains per version that Qihoo detects us.
So here is the 100 million question: How can it be that every single AV vendor in the world does class us as clean? yet Qihoo keeps bitching about trojan here and malicious there? So as a joke i said we might start detecting them and give them some ugly name.
It was just a joke man. Lighten up.

 

[Kate_L]

Hello Nico

Can you make the detection names more specific like Trojan@ZBot~RandomID ? With all this stealing signatures, it is also good to know what malware was.

Since every AV vendor has his own way, I think you should also make some unique signature name. CBAD.Detected it is vague.

It is just a suggestion and keep up the good work.

 

[Av Gurus]

I have 2 malware folder on desktop, one folder with .exe and in another folder with .vir extensions.
This folder with .vir didn't detected?

 

[Nico@FMA]

Hello Nico

Can you make the detection names more specific like Trojan@ZBot~RandomID ? With all this stealing signatures, it is also good to know what malware was.

Since every AV vendor has his own way, I think you should also make some unique signature name. CBAD.Detected it is vague.

It is just a suggestion and keep up the good work.

Hello OpenSec,

Thank you for the suggestion,
In regards to your question i understand its vague when our detection only shows CBAD.Detection
Yet you have to realize this is due to the very nature of our cloud.
We do not use a database, so our cloud has no way of knowing what name a malware has because its detection is strictly based upon the internal code and deep details of the scanned file.
So in short said our cloud does not give names, as we do not use a database.
Now how this works i am not going to explain again so i suggest you go to the first post in this topic and read it and then scroll to the updates.
I know its a lot of reading but it will explain pretty much in detail.

Obviously in the future we will come up with some way to at least class the detections as:

1: Virus
2: Rootkit
3: Trojan
and so on.

But this requires a massive overhaul in the engine and its detection algorithm and right now i have no intention of changing the detection names in favor of maturing the cloud and getting the program polished as detection names are pure cosmetic candy.
However your suggestion has been noted as you where not the first one to suggest it.

Thanks,.

 

[Nico@FMA]

I have 2 malware folder on desktop, one folder with .exe and in another folder with .vir extensions.
This folder with .vir didn't detected?

View attachment 33052

Yes you are right it did not detect those, as the cloud detection is running in skeleton mode.
Thanks for pointing it out tho.
And please send the files to me and ill see here locally if the new engine does detect it on a local test system (yes the engine is going to be updated again... lol)

Cheers

 

[Av Gurus]

All files are from Virussign and in one folder files was renamed (.vir with .exe ).
I did a Quick Scan.

 

[Av Gurus]

There is more detection on VirusTotal 4/53

 

[Nico@FMA]

All files are from Virussign and in one folder files was renamed (.vir with .exe ).
I did a Quick Scan.

I just did a right click context scan on the a Virsign pack (The first one)

Still scanning and its seems to be working.
Please tell me did you uninstall the old version completely and download and install the new version?
Because on my end as you can see its working and working well.

 

[Av Gurus]

Context scan is OK, i just run Quick Scan

 

[Nico@FMA]

Context scan is OK, i just run Quick Scan

View attachment 33056

Ahh quick scan, right the quick scan is only looking at specific places. It would be worthless for folder scanning.
Quick scan would be critical area scan, while manual scan and context scan would be more general scan across the area you select.
But i will take note of it and have it changed.

 

[Nico@FMA]

There is more detection on VirusTotal 4/53

View attachment 33055

https://www.virustotal.com/en/file/...556c61292e00cb5e8fdd605a/analysis/1416558859/

0 detections?

 

[Av Gurus]

My was old scan results from VT, now it is all Clean, tnx.

Righ Content Scan only show for .exe files not for folder, any news about that?

 

[Xtwillight]

Update
https://www.virustotal.com/de/file/...905ff08acf7fbccfbae607c4/analysis/1416558803/

 

[Nico@FMA]

Brilliant.

 

[Nico@FMA]

@Av Gurus context scan works on my end on folders, files and zipped files.

 

[RmG152]

How i can report FP?
https://www.virustotal.com/en/file/...fc43d0440cc91e80ed8f814bdbf77defb4a/analysis/

i have no idea how to submit to them.

I want to report FP generated by your program.


--------------------------------------------------------------------------------
If you want to report FP to 360 use this form: http://www.360totalsecurity.com/en/suspicion.html

 

[Nico@FMA]

I want to report FP generated by your program.


--------------------------------------------------------------------------------
If you want to report FP to 360 use this form: http://www.360totalsecurity.com/en/suspicion.html

Fixed. please test and confirm.

 

[RmG152]

Fixed. please test and confirm.

Fp Fixed.

 

[Nico@FMA]

Fp Fixed.

jay...

 

[Cch123]

Hi Nico, just some suggestions for you:

1. I think you should submit your software for those whitelisting programs by AV vendors, so that there would be fewer/no false positives by vendors.
2. As for the detection name thing, perhaps based on the structure of the malware, you can classify them accordingly. It would be great if Intel-Secure could let us know the capabilities of its detections. For instance, if there is a RAT on my computer and Intel-Secure detects it, it would be great if I could view the capabilities of this RAT. Intel -Secure can list the capabilities like this:

• Keylogger
• Connects to XX.XX.XX.XX
• Screen capture
• Anti-VM

That way users can use the tool to make informed decisions on what kind of threat they are facing, and perhaps this software can be part of a malware analysts' companion as well