Author Topic: CyberCapture  (Read 138082 times)

0 Members and 1 Guest are viewing this topic.

Offline Gopher John

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2098
Re: CyberCapture
« Reply #195 on: July 29, 2016, 02:52:21 PM »
Peace at home makes it easier to concentrate on what's necessary at work. ;)
AMD A6-5350M APU with Radeon HD Graphics, 8.0GB RAM, Win7 Pro SP1 64bit, IE11
i7-3610QM 2.3GHZ, 8.0GB Ram,  Nvidia GeForce GT 630M 2GB, Win7 Pro SP1 64bit, IE 11
Common to both: Avast Premium Security 19.7.2388, WinPatrol Plus, SpywareBlaster 5.5, Opera 12.18, Firefox 68.0.2, MBam Free, CCleaner

Offline lukor

  • Administrator
  • Super Poster
  • ***
  • Posts: 1884
    • AVAST Software
Re: CyberCapture
« Reply #196 on: July 29, 2016, 03:00:03 PM »
So Clarify this one "Allow me to run Susp files" the paid users are using it in Sandbox but what about free users?
you say that "we are still working with this idea."Pls keep free users also in mind.They don't have Sandbox.Have a great day.

Sorry, thats not correct. "Allow me to run Suspicious files" brings you back the "run anyway" option and the file is run without sandbox when you enable that in settings and click on that in the CyberCapture dialog. We might change it to "run anyway inside Sandbox" in the future - but this is not yet decided and ready.

Offline Be Secure

  • Long Time Avast User(10years.....) Security Enthusiast.
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1908
Re: CyberCapture
« Reply #197 on: July 29, 2016, 03:05:14 PM »
So Clarify this one "Allow me to run Susp files" the paid users are using it in Sandbox but what about free users?
you say that "we are still working with this idea."Pls keep free users also in mind.They don't have Sandbox.Have a great day.

Sorry, thats not correct. "Allow me to run Suspicious files" brings you back the "run anyway" option and the file is run without sandbox when you enable that in settings and click on that in the CyberCapture dialog. We might change it to "run anyway inside Sandbox" in the future - but this is not yet decided and ready.
Thanks.It would be nice if Help(i) is include in next version for both.It makes more clear.
PC- Windows10 EDU 64Bit,avast! free 21.1.2449,uBlock Origin,NVT_OSA,GoogleChrome(64bit),CCleaner,Unchecky,ZAM Free,Shadow Defender.
Security Enthusiast

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48700
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: CyberCapture
« Reply #198 on: July 29, 2016, 03:09:33 PM »
So Clarify this one "Allow me to run Susp files" the paid users are using it in Sandbox but what about free users?
you say that "we are still working with this idea."Pls keep free users also in mind.They don't have Sandbox.Have a great day.

Sorry, thats not correct. "Allow me to run Suspicious files" brings you back the "run anyway" option and the file is run without sandbox when you enable that in settings and click on that in the CyberCapture dialog. We might change it to "run anyway inside Sandbox" in the future - but this is not yet decided and ready.
Why isn't there an option like "Allow me to decide" which would happen after a warning comes up ???
Right now it looks like either "block and scan" or "bypass altogether" are the only two options.
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v24H2 64bit, 32 Gig Ram, 1TB SSD, Avast Free 24.4.6112, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline Be Secure

  • Long Time Avast User(10years.....) Security Enthusiast.
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1908
Re: CyberCapture
« Reply #199 on: July 29, 2016, 03:11:56 PM »
So Clarify this one "Allow me to run Susp files" the paid users are using it in Sandbox but what about free users?
you say that "we are still working with this idea."Pls keep free users also in mind.They don't have Sandbox.Have a great day.

Sorry, thats not correct. "Allow me to run Suspicious files" brings you back the "run anyway" option and the file is run without sandbox when you enable that in settings and click on that in the CyberCapture dialog. We might change it to "run anyway inside Sandbox" in the future - but this is not yet decided and ready.
Why isn't there an option like "Allow me to decide" which would happen after a warning comes up ???
+1 :)
PC- Windows10 EDU 64Bit,avast! free 21.1.2449,uBlock Origin,NVT_OSA,GoogleChrome(64bit),CCleaner,Unchecky,ZAM Free,Shadow Defender.
Security Enthusiast

Offline lukor

  • Administrator
  • Super Poster
  • ***
  • Posts: 1884
    • AVAST Software
Re: CyberCapture
« Reply #200 on: July 29, 2016, 03:17:14 PM »
Why isn't there an option like "Allow me to decide" which would happen after a warning comes up ???
Right now it looks like either "block and scan" or "bypass altogether" are the only two options.

Hmm, I like that - this seems like a better text into the settings dialog.

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48700
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: CyberCapture
« Reply #201 on: July 29, 2016, 03:20:02 PM »
Why isn't there an option like "Allow me to decide" which would happen after a warning comes up ???
Right now it looks like either "block and scan" or "bypass altogether" are the only two options.

Hmm, I like that - this seems like a better text into the settings dialog.
Me too. :)
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v24H2 64bit, 32 Gig Ram, 1TB SSD, Avast Free 24.4.6112, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: CyberCapture
« Reply #202 on: July 29, 2016, 07:59:54 PM »
It would be nice if Help(i) is include in next version for both.It makes more clear.
I fully agree with this.
The best things in life are free.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9408
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: CyberCapture
« Reply #203 on: July 30, 2016, 09:19:06 PM »
Hello guys,
We have made a small change in the Cyber Capture flow. On the first Cyber Capture dialog, that informs the user about the fact, that the file is rare and need to be analyzed on the backend, we have removed the "Run anyway" button. We've received some complains from users and testers, that this is too dangerous, and in case it really is a virus may be a security risk for the user.

In the current version, the original "Run anyway" button is replaced with the "I trust this file" link, which still keeps the file inside Cyber Capture analysis, and also sends this users opinion back to our servers. It may be then taken into the account and make the analysis faster.

While be believe, this new workflow is more secure, we do understand that many of you are power users and want to be in charge. For this purpose we have added the new option into settings - it controls whether the "Run anyway" option is available or not.

Some of you have also suggested the file to be executed in Sandbox only - we are still working with this idea. I quite like it, but it has some technical issues as well - what should we do when the downloaded file is an installer, the installation may fail, or appear to succeed but things will not work as expected -- e.g. no integration with the system will ever be visible. This seems to be somewhat challenging when presented to less advanced users, but we are still working with this idea.

Hope this helps. Lukas.

So, if I understand this right, you now strictly have to wait for the CyberCapture verdict? You can only give sort of an opinion on it if you click the "I trust this file".

Oh, now I get it. Default CC setup is now block until verdict is received without "Run anyway" option. But you can switch it back to original design if you enable that under CC settings. Got it.

What is the average time for CC file analysis? Would be nice if user could see an average analysis time in CC dialog, so you know when to roughly expect the verdict. It's a bit annoying not knowing whether it'll take 5 minutes, half an hour, 1 hour or 3 hours.
Visit my webpage Angry Sheep Blog

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: CyberCapture
« Reply #204 on: July 30, 2016, 11:24:01 PM »
What is the average time for CC file analysis? Would be nice if user could see an average analysis time in CC dialog, so you know when to roughly expect the verdict. It's a bit annoying not knowing whether it'll take 5 minutes, half an hour, 1 hour or 3 hours.
I agree. The most info (regarding it is approximate) will be useful.
Also, maybe, an info when the verdict come back, not only "releasing" the file in silent.
The best things in life are free.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9408
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: CyberCapture
« Reply #205 on: July 30, 2016, 11:36:50 PM »
Actually, you do get a popup that file scanned by CyberCapture was clean (or bad). It's no silent, user gets notified about it.
Visit my webpage Angry Sheep Blog

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: CyberCapture
« Reply #206 on: July 31, 2016, 12:59:28 AM »
Actually, you do get a popup that file scanned by CyberCapture was clean (or bad). It's no silent, user gets notified about it.
Thanks. Didn't know that.
The best things in life are free.

Offline jefferson sant

  • Starting Graphoman
  • *
  • Posts: 6674
  • volunteer
Re: CyberCapture
« Reply #207 on: August 02, 2016, 01:51:56 AM »
I receive emails with attachments jar files, avast has not detected but submitted to virus lab through the vírus chest and detections were created the other day.Maybe this could be included in a future release.
another question I performed executed directly from USB, of course now Cyber Capture reports that this file is clean.Does avast wrong or seem to be a too many false positive.
The sample is old

https://www.virustotal.com/en/file/e30b0337bdc36bdebe568c948ef65815c9489a0db4811cf2670fe080efbc746e/analysis/1470093915/

Offline Milos

  • Avast team
  • Super Poster
  • *
  • Posts: 2297
Re: CyberCapture
« Reply #208 on: August 02, 2016, 09:54:04 AM »
Hello jefferson sant,
the file looks to be clean -- some intro to a game.

Milos

Offline Skakara

  • Full Member
  • ***
  • Posts: 198
Re: CyberCapture
« Reply #209 on: August 02, 2016, 11:23:10 AM »
Actually, you do get a popup that file scanned by CyberCapture was clean (or bad). It's no silent, user gets notified about it.

But let me guess, the popup is the kind of that hides itself after short time? Like most of Avast popups do.

IMO this is a bad design flaw, people are not always in front of their computers although the computers are running. Important popups should not automatically hide after a short time. I would mimic a "windows 10 notification center" on this matter. That way important messages from avast would not be lost if a person is away from the computer for some time. Also giving users the choice (setting) to select which messages would be shown in the "avast notification center" (would slide open when clicking the avast systray icon (and the avast icon would notify/indicate when new messages are available)).
« Last Edit: August 02, 2016, 11:25:48 AM by Skakara »