CyberCapture

[Gopher John]

Peace at home makes it easier to concentrate on what's necessary at work.

[lukor]

So Clarify this one "Allow me to run Susp files" the paid users are using it in Sandbox but what about free users?
you say that "we are still working with this idea."Pls keep free users also in mind.They don't have Sandbox.Have a great day.

Sorry, thats not correct. "Allow me to run Suspicious files" brings you back the "run anyway" option and the file is run without sandbox when you enable that in settings and click on that in the CyberCapture dialog. We might change it to "run anyway inside Sandbox" in the future - but this is not yet decided and ready.

[Be Secure]

So Clarify this one "Allow me to run Susp files" the paid users are using it in Sandbox but what about free users?
you say that "we are still working with this idea."Pls keep free users also in mind.They don't have Sandbox.Have a great day.

Sorry, thats not correct. "Allow me to run Suspicious files" brings you back the "run anyway" option and the file is run without sandbox when you enable that in settings and click on that in the CyberCapture dialog. We might change it to "run anyway inside Sandbox" in the future - but this is not yet decided and ready.

Thanks.It would be nice if Help(i) is include in next version for both.It makes more clear.

[bob3160]

So Clarify this one "Allow me to run Susp files" the paid users are using it in Sandbox but what about free users?
you say that "we are still working with this idea."Pls keep free users also in mind.They don't have Sandbox.Have a great day.

Sorry, thats not correct. "Allow me to run Suspicious files" brings you back the "run anyway" option and the file is run without sandbox when you enable that in settings and click on that in the CyberCapture dialog. We might change it to "run anyway inside Sandbox" in the future - but this is not yet decided and ready.

Why isn't there an option like "Allow me to decide" which would happen after a warning comes up
Right now it looks like either "block and scan" or "bypass altogether" are the only two options.

[Be Secure]

So Clarify this one "Allow me to run Susp files" the paid users are using it in Sandbox but what about free users?
you say that "we are still working with this idea."Pls keep free users also in mind.They don't have Sandbox.Have a great day.

Sorry, thats not correct. "Allow me to run Suspicious files" brings you back the "run anyway" option and the file is run without sandbox when you enable that in settings and click on that in the CyberCapture dialog. We might change it to "run anyway inside Sandbox" in the future - but this is not yet decided and ready.

Why isn't there an option like "Allow me to decide" which would happen after a warning comes up

+1

[lukor]

Why isn't there an option like "Allow me to decide" which would happen after a warning comes up
Right now it looks like either "block and scan" or "bypass altogether" are the only two options.

Hmm, I like that - this seems like a better text into the settings dialog.

[bob3160]

Why isn't there an option like "Allow me to decide" which would happen after a warning comes up
Right now it looks like either "block and scan" or "bypass altogether" are the only two options.

Hmm, I like that - this seems like a better text into the settings dialog.

Me too.

[Lisandro]

It would be nice if Help(i) is include in next version for both.It makes more clear.

I fully agree with this.

[RejZoR]

Hello guys,
We have made a small change in the Cyber Capture flow. On the first Cyber Capture dialog, that informs the user about the fact, that the file is rare and need to be analyzed on the backend, we have removed the "Run anyway" button. We've received some complains from users and testers, that this is too dangerous, and in case it really is a virus may be a security risk for the user.

In the current version, the original "Run anyway" button is replaced with the "I trust this file" link, which still keeps the file inside Cyber Capture analysis, and also sends this users opinion back to our servers. It may be then taken into the account and make the analysis faster.

While be believe, this new workflow is more secure, we do understand that many of you are power users and want to be in charge. For this purpose we have added the new option into settings - it controls whether the "Run anyway" option is available or not.

Some of you have also suggested the file to be executed in Sandbox only - we are still working with this idea. I quite like it, but it has some technical issues as well - what should we do when the downloaded file is an installer, the installation may fail, or appear to succeed but things will not work as expected -- e.g. no integration with the system will ever be visible. This seems to be somewhat challenging when presented to less advanced users, but we are still working with this idea.

Hope this helps. Lukas.

So, if I understand this right, you now strictly have to wait for the CyberCapture verdict? You can only give sort of an opinion on it if you click the "I trust this file".

Oh, now I get it. Default CC setup is now block until verdict is received without "Run anyway" option. But you can switch it back to original design if you enable that under CC settings. Got it.

What is the average time for CC file analysis? Would be nice if user could see an average analysis time in CC dialog, so you know when to roughly expect the verdict. It's a bit annoying not knowing whether it'll take 5 minutes, half an hour, 1 hour or 3 hours.

[Lisandro]

What is the average time for CC file analysis? Would be nice if user could see an average analysis time in CC dialog, so you know when to roughly expect the verdict. It's a bit annoying not knowing whether it'll take 5 minutes, half an hour, 1 hour or 3 hours.

I agree. The most info (regarding it is approximate) will be useful.
Also, maybe, an info when the verdict come back, not only "releasing" the file in silent.

[RejZoR]

Actually, you do get a popup that file scanned by CyberCapture was clean (or bad). It's no silent, user gets notified about it.

[Lisandro]

Actually, you do get a popup that file scanned by CyberCapture was clean (or bad). It's no silent, user gets notified about it.

Thanks. Didn't know that.

[jefferson sant]

I receive emails with attachments jar files, avast has not detected but submitted to virus lab through the vírus chest and detections were created the other day.Maybe this could be included in a future release.
another question I performed executed directly from USB, of course now Cyber Capture reports that this file is clean.Does avast wrong or seem to be a too many false positive.
The sample is old

https://www.virustotal.com/en/file/e30b0337bdc36bdebe568c948ef65815c9489a0db4811cf2670fe080efbc746e/analysis/1470093915/

[Milos]

Hello jefferson sant,
the file looks to be clean -- some intro to a game.

Milos

[Skakara]

Actually, you do get a popup that file scanned by CyberCapture was clean (or bad). It's no silent, user gets notified about it.

But let me guess, the popup is the kind of that hides itself after short time? Like most of Avast popups do.

IMO this is a bad design flaw, people are not always in front of their computers although the computers are running. Important popups should not automatically hide after a short time. I would mimic a "windows 10 notification center" on this matter. That way important messages from avast would not be lost if a person is away from the computer for some time. Also giving users the choice (setting) to select which messages would be shown in the "avast notification center" (would slide open when clicking the avast systray icon (and the avast icon would notify/indicate when new messages are available)).