Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 997691" data-attributes="member: 86910">It is&nbsp; a good sign that manual sample submissions are not processed fully automatically. There is a human looking into them to make sure you get the correct analysis result. This takes time, and it will vary on current workload, urgency and your status as a customer. Generally, false positives on system and production components are more urgent than false negative submissions. Business customers with thousands of licenses are more urgent than customers who use the product for their two home computers.In contrast, blocklisting samples is done automatically and needs to be done fast for protection. Your manually submitted samples might still be put to automatic processing but maybe for whatever reason they are not flagged as malware in the processing backend and the final verdict from a human analyst definitely takes more time.Antivirus companies use different sources of sample streams that they process daily and it is possible that the samples submitted to abuse.ch get a higher priority than some other sample sources. E.g., if the ratio of malware samples is especially high there, it makes sense to assign a high prio to that.But I am sure the samples are not blocklisted without any other checks behind that. That would be too risky for any antivirus company.</blockquote>

[QUOTE="struppigel, post: 997691, member: 86910"] It is a good sign that manual sample submissions are not processed fully automatically. There is a human looking into them to make sure you get the correct analysis result. This takes time, and it will vary on current workload, urgency and your status as a customer. Generally, false positives on system and production components are more urgent than false negative submissions. Business customers with thousands of licenses are more urgent than customers who use the product for their two home computers. In contrast, blocklisting samples is done automatically and needs to be done fast for protection. Your manually submitted samples might still be put to automatic processing but maybe for whatever reason they are not flagged as malware in the processing backend and the final verdict from a human analyst definitely takes more time. Antivirus companies use different sources of sample streams that they process daily and it is possible that the samples submitted to abuse.ch get a higher priority than some other sample sources. E.g., if the ratio of malware samples is especially high there, it makes sense to assign a high prio to that. But I am sure the samples are not blocklisted without any other checks behind that. That would be too risky for any antivirus company. [/QUOTE]

Verification