Panda Cloud AV

Regarding FPs & quarantine, this product works a little differently that traditional "quarantines". For example if something is detected as suspicious (FP or not) it is "tagged" as quarantine but not physically "moved" to a quarantine, so the file remains in its original place on the drive. Every so often the quarantine checks against the cloud for final classification of the file (malware/goodware) and then either disinfects or unblocks the file.

This has an effect on determining "detection rates" when running an on-demand scan, as files which are detected as suspicious are not "moved" away from the scanned folder and you might think that it went undetected, even though it was detected (I think this is what happened to AV-Test referenced in a post above, but still checking with Andreas to verify). If you are doing this types of tests, then after the on-demand scan is finished, use the shortcut CTRL-SHIFT-D to physically delete all files which have been tagged as suspicious and quarantined.

The quarantine can be accessed from the folded bottom-right corner of the app for manual release of tagged files.

If you're running on-demand scans you'll definately see more CPU/RAM consumption than the normal operation of the resident driver which sits at an average 17MB of RAM.

 

I'll be posting some details soon on how to turn off BackgroundScan for those of you testing with heavy duty on-demand scans.

 

Crap like all Panda software...

 

Unless all panda software is beta that statement is more than slightly uncalled for and adds no value to this thread whatsoever, IMHO.

 

Beta!? And what?

In Beta stage you already know what you can aspect from a program!

And from what I have read on web this is another great piece of work...

 

Very good point..They should have been neutralized but were not

 

There could be three reasons for this:

1- They have not been detected by us yet.

2- They were detected and quarantined. However this quarantine doesn't "move" the objects so the perception could be that they were not detected. Use the shortcut CTRL-SHIFT-D after running the on-demand scan to delete the quarantined files and then look for non-detected files.

3- There were errors during the communication with the cloud. Activate advanced logging and check for "CLOUD ERROR" messages after running the on-demand scan. More info on advanced logging at http://blog.cloudantivirus.com/2009/04/30/testing-panda-cloud-antivirus-advanced-logging/


Btw., we've just posted a list of known issues with the beta so far:
http://blog.cloudantivirus.com/2009/04/30/known-issues/

 

Just one question:

How do you feel that "X is crap" adds to a discussion?

If you want people to value your contributions it is best to refrain from one liners and provocative statements unless you are prepared to back up your statement with some kind of tangiable evidence.
Otherwise it makes no sense to post them...and nobody will take them seriously if you do.

Beta software is beta software, and no indication of what a final product will be like, however that isn't the point I was making. We are all hopefully intelligent people here, so let us project that in our posts by putting forward constructive criticism, especially as there is a panda representative reading and posting in this thread, and he/she will be much more able to process and act upon negative feedback if it has some sort of detail or explanation attached to it rather than a pointless "it sucks" or similar.

 

These types of real-time protection-scans would work great if it wasn't going active when I'm active myself with something else. It could be when I'm playing games or simply browsing webpages while listening to music. In either case it becomes as wrong as Diskeeper's "Invisitasking" - taking precious CPU cycles which actually DOES make the system operation stutter or lagg. It would work much better if it did like for example Symantec's Norton does - begin when I've been idle for atleast 10 min., then suspend once I tap on the keyboard or use my mouse. Same thing when going into screensaver - then it knows I'm not being active personally, and can do its job.

Atleast stuttering and lagg is what I've actually experienced so far as it's and I checked my task manager because of it. Right there is P-CAV, taking CPU cycles while I'm running two other programs at the same time. That results in a lot of activity going on from different processes, simply clogging everything.


If something is not clearly understandable in my post, don't hesitate to just ask, and I'll try to clarify what I mean.

 

Could you please try the following (disabling Background scan) to see if the "clogging" goes away?

Write to notepad, save as bck.reg and execute
==================================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Panda Security\Panda Service Host]
"BackgroundDisabled"="-"
==================================
Reboot or stop/start the service after importing the registry entry and let me know your findings.

TIA

 

Thx for the response. Right now it goes very light, but if I notice the same behavior as before, I'll test this.

 

How is the software itself kept up-to-date? Also automatically?

Sometimes the window(s) with more information (e.g. when hovering over deleted/fixed items in the list) might show up behind, which means you see very little of the window(s) and its information.

On another note, the bug where it will remove EICAR-test-file on next boot seems to be related to COMODO AV doing its job first over here. CAV takes care of it - P-CAV comes soon and has missed the action. Thinks it will only be able to take care of things once the user has rebooted.

 

Yes, no configuration of it either. If it sees it needs to update its cache and it has connectivity, it does it.

Do you have a screenshot of that?

Maybe it is Comodo in that specific scenario, but I think it's us. Its a known bug on 2 scenarios of detections (non file-infectors when downloaded via http & containers with multiple files where at least 1 is infected). We're already working on the fix.

 

That's good to hear - I think many here are looking forward to it.

 

Hi again,
well i just installed cloud AV as a common XP user. What I mean with "common XP user" is that I don't install an AV to scan the last malware samples looking for the limits of the engine, so I don't do it with cloud AV, is Beta, and is free, take it easy guys.

On a quick overview I must say is pretty light, and the Interface is cute, the "flip screen" feature for quarantine rocks!!
IMO fresh air on AV scene.

 

"Cache" is what we're calling a stripped-down version of Collective Intelligence signatures for offline operation. It contains mainly sigs for what CI considers to be truly circulating out there (plus a few other things). This "cache" is constantly evolving and updates as needed.

 

Ah... so those updates work instead of upgrading the software itself, which means it's always managed server-side - is that correct?

 

Correct

Both updates and upgrades are managed server-side. However during the beta only the updates are automatic. For upgrades (new versions during the beta only) we'll push down a notification pointing to a URL where to download the new version.

 

And this will come as a pop-up notification from the P-CAV software?

 

Yes, correct. But only during beta. After beta it will be automatically upgraded.

 

Alright... I've not tested the registry change yet, but I've got a screenshot of when the "clogging" occurs. I didn't make the change since I think it's best to analyze it in the situation where the software is configured at its defaults, that's, no changes through manual registry editing - the configuration which is supposed to work.

No uncommon software running in particular at the same time. The only software which I don't run all the time that's on when this is happening would be µtorrent, but then I've had µtorrent running many times before without this happening at all.

I can say that I was definitely not idle, and it affected my computer's performance A LOT. Slow execution, starting of programs, would also result in what would seem to be slower browsing-speed, but I think that's an illusion thanks to the reduced processing power.

Please see the attached image!


EDIT: It's continuing to "clog" the system right as I'm making this edit...

 

Is there an option to ignore tracking cookies?

 

Tried it - not impressed. It must connect to the internet for every program launch and slows executions because of it. Light but not very practical for me.

SourMilk out

 

I did a full scan with Panda Cloud Antivirus and got a false positive. The Prevx Edge quarantine file qc.csi was detected as a threat and automatically deleted by Panda without being tagged as quarantined.

Although I can understand why, due to its nature, qc.csi might get detected by Panda, to me this illustrates a fatal weakness in the way the program works. If this had happened to a file that was really needed, without an up to date system backup there would have been no way to recover the file.

IMHO no antivirus program should automatically delete files without first quarantining them due to the risk of false positives. Unless this changes in the final version, I will not consider using Panda Cloud Antivirus.