Reply to thread

Message

<blockquote data-quote="BVLon" data-source="post: 867764">In my opinion,everything in this alert looks right, except I would not recommend Auto-Quarantine here, as it&#039;s only 10 engines (if Bitdefender is one of them with its multitude of forks, in reality it&#039;s no more than 2-3)... I would say &quot;Our Analysis (without using VoodooAi) did not find suspicious characteristics, but 10/70 engines detected a threat. We recommend that you keep the file blocked and we&#039;ll rescan it again in 12 hours.&quot;if they press &quot;Allow false positive&quot; I would say pretty much what&#039;s on the message. I would actually remind them again &quot;10/70 engines detected malware&quot; with bigger letters and then &quot;By allowing this file to run you understand that this could introduce malware&quot;.And then do 2 buttons &quot;I accept the risk&quot; and &quot;Block file&quot;If they did not click &quot;allow false positive&quot;, it would be good to really rescan the file in 12 hours and report changes...show a message like &quot;+4 engines now detect a threat in this file, so it looks like brand new malware. We recommend that you quarantine this file&quot;Of course this is just how I would do it...</blockquote>

[QUOTE="BVLon, post: 867764"] In my opinion,everything in this alert looks right, except I would not recommend Auto-Quarantine here, as it's only 10 engines (if Bitdefender is one of them with its multitude of forks, in reality it's no more than 2-3)... I would say "Our Analysis (without using VoodooAi) did not find suspicious characteristics, but 10/70 engines detected a threat. We recommend that you keep the file blocked and we'll rescan it again in 12 hours." if they press "Allow false positive" I would say pretty much what's on the message. I would actually remind them again "10/70 engines detected malware" with bigger letters and then "By allowing this file to run you understand that this could introduce malware". And then do 2 buttons "I accept the risk" and "Block file" If they did not click "allow false positive", it would be good to really rescan the file in 12 hours and report changes... show a message like "+4 engines now detect a threat in this file, so it looks like brand new malware. We recommend that you quarantine this file" Of course this is just how I would do it... [/QUOTE]

Verification