all 'probably' threats submitted?

hi

I just wanted to ask whether all files detected in an On-Demand scan as:

probably unknown NewHeur_PE virus...
probably a variant of...

will be submitted to ESET for analysis automatically if you have the ThreatSense .Net Early Warning System enabled?

I am running a scan on a huge collection of malware and I can see some of them are being picked detected as 'probably...' and just wondered if at some point today all these samples will be sent to ESET?

thanks in advance!

 

basically all heuristic detections will be submitted to ESET depending on your connection: today or in the following days.

 

Unless the same files have already been submitted by someone else. You can disable ThreatSense for the time necessary to scan your malware collection to make sure they are not submitted.

 

thanks both - that's helpful!

the files that arent detected, and i know its highly likely a lot of corrupt, i'd like to submit to eset - but there are too many to submit through email. is there a way to upload via FTP? or should i email with a link to where i found them (but you need a torrent client to download them)?

 

You can upload them to http://www.rapidshare.com/ and send the url to support[at]eset.com with a link to this thread.

 

hi - just another question if i may
if i scan samples using JUST signatures and a sample is detected as 'probably a variant of...', will that also be submitted or is it not necessary to submit such a sample?

thanks again

 

using JUST signatures won't give that detection. 'probably a variant of...' is heuristic detection.

 

it does though - i unticked 'heuristics' and 'advanced heuristics' and scanned using just signatures so i could submit the rest of the samples to eset (already done), quite a few were detected as 'probably a variant of...' using just the signature detection.

I presume variant detection is part of the signatures (too), but i just wanted to know whether those detections would be submitted or whether because they were detected using signatures they were classed as 'final' and complete.

 

maybe you're right then. I don't know exactly.

 

Some (not all) signatures are able to catch slightly modified malware variants.

 

great, good to know, thanks for the info!