Submission via Quarantine

Discussion in 'NOD32 version 2 Forum' started by RejZoR, Jul 16, 2005.

Thread Status:
Not open for further replies.
  1. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    I'm wondering about one thing in NOD32...
    Lets say i check some files with explorer extension and NOD32 asks me if i want to submit files to ESET. I agree with that and i allow submission of files that were detected with heuristics. Now where are these files placed in queue?
    They are not in Quarantine and i also can't seem to find them in NOD32 folder.
    Do i have to leave infected files on disk so NOD32 will someday submit them or how does it work?
    Thx
     
  2. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    deleted
     
    Last edited: Jul 16, 2005
  3. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    They are stored encrypted in the eset/cache folder.
     
  4. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Aha,thanks. I just submitted around 167 samples and i was wondering if they were properly submitted...
     
  5. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Ok,how do i force submission of all files in queue? NOD32 seems to nag about those files every time i start my PC...
    Is the Submit now button in ThreatSense.NET option the right thing or is this to submit statistics. I'm a bit confused o_O

    EDIT:
    Nevermind,i forgot there is actaually a Help button below. Dumb me...
     
  6. jg88swe

    jg88swe Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    181
    I know this has nothing to do with this topic but :eek:

    W32/Lebreat.A@mm - Probably unknown NewHeur_PE virus

    Time Module Object Name Threat Action User Information
    2005-07-16 15:15:46 IMON file http://something/update3.exe probably unknown NewHeur_PE virus Computer
     
  7. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,721
    Location:
    Texas
  8. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Ok,this submission stuff is terribly designed. No progress bar,no notification and finally no submission at all. It just says Submission Activated and then nothing.
    In general Quarantine is also way too basic and useless.
    You can't check if files are still not recognized by signature,very basic control over them,no personal notes etc...
    You need to umprove this asap if you want this submission process to work without problems...
     
  9. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    I clicked Submit now and i still have cache full of files. When are they gonna be submitted?
     
  10. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    Click the event log and see if they have been submitted or not.
     
  11. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Nothing,just one file sent out of 160+ Ugh :rolleyes:
     
  12. rumpstah

    rumpstah Registered Member

    Joined:
    Mar 19, 2003
    Posts:
    486
    Hi RejZoR:

    You may want to check out this thread. ;)

     
  13. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Nah,that doesn't help me much. Problem is that i just sweeped my entire viral storage with NOD32 explorer extension. Then it asked me if i want to submit stuff through ThreatSense.NET and i agreed. Now that stuff isn't submitting anywhere :doubt:
    I liked avast! Chest design more. Much more flexible with more control over stored files.
    Also everything was submitted by user itself (and when you send something it was actually sent that very moment).
    Around 50-80 samples are low priority because they are mainly older viruses,but other stuff is mostly recent or very new stuff and i'd like to send that stuff to ESET asap. Hitting Submit button doesn't do the trick :doubt:
     
  14. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    Not really sure if NOD will send all files from quarantine when you do this:

    Click the first item, scroll down to the last item, hold shift and click on the last item. Now everything should be selected, rightclick and select 'submit'.
     
  15. rumpstah

    rumpstah Registered Member

    Joined:
    Mar 19, 2003
    Posts:
    486
    Hi RejZoR:

    It should help. Just because you are submitting does not mean the system has to accept it. If the sample has already been submitted, then the system will not take another instance of it.

    Imagine an outbreak and millions of systems attempt to submit the file (only 1 is needed).

    I have sent thousands of samples. When the submit button is pressed and NOD32 is setup as per the screenshot, they go immediately (depending on the size of the file and the connection speed). ;)



     

    Attached Files:

  16. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    But if they laready have the samples they should notify me about it.
    I have Submit asap checked,but nothing happens,no notification or anything. Even event log is empty (regarding submission entries).
    My connection has 32KB/s upstream so it should sent all the stuff in minute or two.
     
  17. fosius

    fosius Registered Member

    Joined:
    Oct 14, 2004
    Posts:
    479
    Location:
    Partizanske, Slovakia
    Samples which have been submitted by another user will be NOT submitted again...
     
  18. CyberMew

    CyberMew Registered Member

    Joined:
    Apr 17, 2005
    Posts:
    128
    Yes we know, but so what? It doesn't tell the user so the new user don't know how it works. Maybe there is a solution to it otherwise they should add that feature.
     
  19. fosius

    fosius Registered Member

    Joined:
    Oct 14, 2004
    Posts:
    479
    Location:
    Partizanske, Slovakia
    I think it should have a progress bar when sending samples. Show message if the sample have been already sent by another user and of course show message when finished.
     
  20. rumpstah

    rumpstah Registered Member

    Joined:
    Mar 19, 2003
    Posts:
    486
    I added the following to the Future Changes thread.

    *Submission System*

    Currently if a sample does not exist and is submitted, an entry is made in the Event Log.

    An Event Log entry showing the name of the file and whether the submission system was contacted and the results (i.e. a sample exists and will not be submitted).
     
  21. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Ok,stuff was sent now (cache folder is almost empty). Event log doesn't mention any data submission except few update server errors (which are typical for NOD32 anyway when you're not conmnected to net when it wants to check for updates).

    Some sort of counter on how many files is still waiting in queue and a progress bar would be a good idea. Also move Submit now button in some more friendly location than that one digged deep under options...

    Quarantine should also be fixed soy ou can check inside it if the files are now detected by signatures or not and to manage them more easily.
    Just a recommendation so it won't be such pain in the ass for those who submit alot of stuff to ESET. Thx
     
Thread Status:
Not open for further replies.