Few questions regarding AV part in RSS

[sg09]

1. AFAIK RSS uses F Prot engine. But upto which part? I mean is the F Prot engine is for only the "Do not use advanced rules analysis"? and the higher two levels are from Returnil's own heuristic engine?
2. Where can I submit FP and possible threats to Returnil?
3. RSS only registers as an AV in Win7 Action Center. Does that means it includes only AV signatures of F Prot? Because F Prot also registers as an AS in Win7.

[Coldmoon]

Originally Posted by sg09

1. AFAIK RSS uses F Prot engine. But upto which part? I mean is the F Prot engine is for only the "Do not use advanced rules analysis"? and the higher two levels are from Returnil's own heuristic engine?

The advanced rules are from Returnil's research team and our server side AI analysis.

2. Where can I submit FP and possible threats to Returnil?

Send your reports and samples (place the sample(s) inside a password protected RAR or ZIP archive) to support (dash) tech (at) returnil (dot) com. Please be sure to format the subject of your e-mail so it is obvious that the report includes potential malware so the support team can update research quickly.

3. RSS only registers as an AV in Win7 Action Center. Does that means it includes only AV signatures of F Prot? Because F Prot also registers as an AS in Win7.

What is or is not included in an AV update is irrelevant to its registering with the Windows Security Center/Action Center. Integration is dependent upon an application/approval process with Microsoft to ensure that the security program meets specific criteria before being allowed to register itself in this way with Windows.

Mike

[sg09]

Thanks for the answers Mike..