Comodo Question: D+ still blocks 'clean' files

[syk69]

Originally Posted by clocks

As I mentioned, this is pretty much a waste of time. As soon as the vendor updates the programs, you will have to resubmit it. So if you are using a program that updates itself often, you will be resubmitting it each time. Major PITA.


Here is the thread from last year: https://forums.comodo.com/news-annou...-t46391.0.html

162 pages, and many of those programs were submitted over, and over, and over.

Yes thats definitely something they need to improve on. Eventually people will get tired of submitting constantly. If it would analyze when submitted automatically by the program and return within a day then automatically added to whitelist then it would be much more convenient.

[clocks]

Originally Posted by syk69

Yes thats definitely something they need to improve on. Eventually people will get tired of submitting constantly. If it would analyze when submitted automatically by the program and return within a day then automatically added to whitelist then it would be much more convenient.

+1 Exactly how it should work! Instead Comodo seems to be relying on a bunch of grunts to manually check programs as they are submitted through their forums.

And mark me down as one of those people that got tired of submitting the same programs constantly. The program would be superb if they figured out the white listing/userability.

[lordraiden]

Originally Posted by clocks

+1 Exactly how it should work! Instead Comodo seems to be relying on a bunch of grunts to manually check programs as they are submitted through their forums.

And mark me down as one of those people that got tired of submitting the same programs constantly. The program would be superb if they figured out the white listing/userability.

Report programs manually is one of the multiples ways that Comodo has to whitelist new files, it's just an accelerated way to do it.

I think they have a database with the most repeated unknown files, so they usually whitelist those files first.

The problem with the no signed files is that each new version has to be whitelisted again, they monitor this apps but usually take 1 day to add the new version to the whitelist after the new version is released. So you can get a popup if you are installing a new version just released of a trusted app not signed.

If anybody has a problem with a trusted app they just need to click on do not sandbox this app again and the app will be manually trusted, no more popups.
I think that even if is a manually trusted app D+ can alert about some very dangerous behaviors, but I'm not very sure about this.

[shadek]

Originally Posted by lordraiden

Report programs manually is one of the multiples ways that Comodo has to whitelist new files, it's just an accelerated way to do it.

I think they have a database with the most repeated unknown files, so they usually whitelist those files first.

The problem with the no signed files is that each new version has to be whitelisted again, they monitor this apps but usually take 1 day to add the new version to the whitelist after the new version is released. So you can get a popup if you are installing a new version just released of a trusted app not signed.

If anybody has a problem with a trusted app they just need to click on do not sandbox this app again and the app will be manually trusted, no more popups.
I think that even if is a manually trusted app D+ can alert about some very dangerous behaviors, but I'm not very sure about this.

Even if they have a whitelisting system where most "common unknown" files are checked first, I think it's just too bad they won't bother whitelisting files I submitted months ago. I don't want to manually trust the files I've submitted as that could potentially compromise my system if the files are indeed malicious.

[Syobon]

...I had this problem, when I was comodo user (never more thanks), actually some months ago, their AV flagged HD sential as malware, I got tired of submitting as false positive to still get flagged as malware.

[PC_Pete]

Thanks to the personal integrity of at least one of the mods, I've been unbanned at COMODO. I'm waiting for any responses to these questions

"Then Comodo's definition of a false positive is a file that contains no viral code, exhibits no bad behavior when analyzed, makes no unverifiable outbound calls but still can't be trusted.
Does Comodo not trust its own diagnosis? "

"Anyone got any examples of programs that are not identifiable as malware but cannot be trusted?."