CyberCapture

[Rednose]

Yes David,

But what if you don't want to wait for the verdict from CyberCapture, and just want run the executable immediately ?

@Vlk I have one more idea. Currently, when CyberCapture locks the file into custody, you can opt to run it without waiting for verdict. You could add "Run in Sandbox" as an option for Pro, Internet Security and Premier editions since they already employ sandbox tech. This way users can run the suspicious stuff risk free in an isolated environment (if the app will work in it of course since not all do) even before they get definitive answer from CyberCapture servers. This way you add additional layer of security when users decide to run it anyway.

Thanks, that sounds like something that could be implemented very easily.

Vlk

My suggestion only goes a little further than RejZoR's.

Greetz, Red.

[Be Secure]

It is bad very bad.avast CyberCapture is failed once again.
Did not block any thing.New EXE files are not blocked as well as the .scr file.

[Be Secure]

More failed results.

[NON]

@Be Secure
These are DeepScreen, not CyberCapture.
If these exe files meet the criteria of CC and failed to start it, then it may be a bug. But IMHO it is another thing than CC's capability.

ALso, you may know this message from Vlk:

(snip)
The combined engine is not yet present in the beta you're testing, but it WILL be till the end of the year (i.e. in the next ~6 weeks). After that happens, I would like to ask everyone to do a retest and see how we're coping... Until then, please let's discuss the non-detection features of the new Avast.
(snip)

[RejZoR]

To me it seems like CyberCapture doesn't even work consistently and invokes DeepScreen instead...

[Be Secure]

The combined engine is not yet present in the beta you're testing, but it WILL be till the end of the year (i.e. in the next ~6 weeks). After that happens, I would like to ask everyone to do a retest and see how we're coping... Until then, please let's discuss the non-detection features of the new Avast.

But i am not runing new beta avast at all.Yes they meet all the criteria of CC and failed to start it.
I don't think there is a bug.It is not working as it should.Whole CC is break.Files(Samples) are downloaded from Internet.

[Alikhan]

This isn't looking positive anymore.

Most of the time CyberCapture isn't even triggered and DeepScreen doesn't really detect anything.

[RejZoR]

@Be Secure
These are DeepScreen, not CyberCapture.
If these exe files meet the criteria of CC and failed to start it, then it may be a bug. But IMHO it is another thing than CC's capability.

ALso, you may know this message from Vlk:

(snip)
The combined engine is not yet present in the beta you're testing, but it WILL be till the end of the year (i.e. in the next ~6 weeks). After that happens, I would like to ask everyone to do a retest and see how we're coping... Until then, please let's discuss the non-detection features of the new Avast.
(snip)

Does this mean current stable avast! version will receive combined engine as well? Or only the new 2017 version?

[Milos]

Hello Be Secure,
please post sha256s or VT links of non-detected samples with date and time of test and we can investigate why they did not went to CyberCapture or why they were not detected.

Thanks,
Milos

[Be Secure]

Thanks and sorry but it is now blocked by avast  and i have no sha256s or VT links(Test time report).Date and time of test-Yesterday at 03:20:50 AM.
via static scan it is now blocked all.

[Milos]

Hello,
do you still have the samples?

Milos

[Be Secure]

Hello,
do you still have the samples?

Milos

Yes.But why?

[Milos]

Hello,
do you still have the samples?

Milos

Yes.But why?

To compute sha256s from the samples.

Milos

[Be Secure]

Hello,
do you still have the samples?

Milos

Yes.But why?

To compute sha256s from the samples.

Milos

OK.
https://www.virustotal.com/en/file/ba264b6fd7795fdea336364082491c7aba457cbf2edabf6c44df0562e34810ba/analysis/1479176757/
https://www.virustotal.com/en/file/76d207956c86f6680ec0e5378c865b971bfca9bd5a5bcb975acd6952d8d6985d/analysis/1479176766/
https://www.virustotal.com/en/file/4416a098f5f9398dc8eae5080dec6b9d6883ba949a584527123b28b85fbf80da/analysis/1479176775/
https://www.virustotal.com/en/file/cec8a554a7fc7d9855aad99fc8940077bd11321d0a1e60a053f7b87cd6f91b44/analysis/1479176783/
https://www.virustotal.com/en/file/eaf050f18370866cc7e33a56076d709814059022c366e5ef754dabade1c7de14/analysis/1479176793/
https://www.virustotal.com/en/file/31c4a69a4e151ef5a94c43a86ce0d9819d72cbbc749346a632028ddd580c26a1/analysis/1479176801/
https://www.virustotal.com/en/file/b51db3ebee257083b1a2082bebdc535712005cf9b64be86d5ce280d35ea8cec4/analysis/1479176809/

[Milos]

Thanks for the VT links.

Milos