Trivia: Cloud Antivirus Music?

 

Where does the music from the video at http://www.cloudantivirus.com come from?

 

First correct answer gets a free Cloud Antivirus license.

..

..

..

..

Just kidding, Cloud Antivirus will always be FREE 🙂

..

Known Issues

 

The following issues have been detected by our beta testers which should be taken into consideration.

Installation / Uninstallation Issues

• During an incomplete uninstall, after reboot, the uninstall process cannot be finished. SOLUTION: We’re creating an uninstaller, but in the meantime please send us the log that is shown in the warning message.
• Cannot install after an incomplete install. SOLUTION: We’re creating an uninstaller, but in the meantime please send us the log that is shown in the warning message.
• Error while re-installing as a file cache is in use. SOLUTION: click “Retry” and allow the installation process to finish. It will complete successfully in spite of the warning message.

 

Application Issues

• Report takes a long time to show over 10.000 detections. WORKAROUND: as the Panda Cloud Antivirus Log is saved in the Windows Event Viewer, delete the corresponding Event Viewer Log before launching an on-demand scan over many files to help improve the responsiveness of the report viewer.
• The Recycle Bin (quarantine) takes a long time to show when there are many items in it.
• In the Event Report the name of the detected malware is shown as “Not available”. This means that either Internet connectivity was lost during the synchronization with Collective Intelligence or the malware naming webservice is not responding correctly.

 

Detection & Disinfection Issues

• Boot scan not performing correctly.
• Infected PE files which are not file-infectors and which are downloaded via HTTP, the product prompts for reboot disinfection even though it’s not really necessary.
• In infected compressed or packed containers which hold multiple elements, where at least one is infected, the product prompts for reboot disinfection even though it’s not really necessary.
• In some cases after disinfecting a file-infector virus the product notifies as “not neutralized” even though it was disinfected correctly and vice versa (in the case where the virus is in memory or the user does not have write-access to the directory respectively).
• Does not intercept nested Office file formats.
• When launching and on-demand scan over a very large number of malware samples the scan may be stuck at 99% of completion. SOLUTION: Disable BackgroundScan (will post details soon on how to do this).

 

As always we appreciate and welcome testing feedback so please keep them coming at beta@pandasecurity.com or in the form of comments on this blog.

Testing Panda Cloud Antivirus: Advanced Logging

 

If you’ve read the introduction to Panda Cloud Antivirus and have come this far, you’re probably interested in “seeing” how this new approach to protection works, not just reading about it. We have enabled certain functionalities which you, as a tester, can use to “see” what Panda Cloud Antivirus is doing behind the scenes.

 

Turning Advanced Logging On/Off

One of the most important things to take into consideration while testing Panda Cloud Antivirus, especially against malware samples and its on-access scanner, is that the traditional on-access scanner has been replaced by 3 new types of interception techniques: OnAccess, OnPrefetch and OnBackground. As each of these operates at different priorities and risk situations, their final actions are not always immediately visible as you would expect from a traditional on-access scan. For example if you copy a directory full of malware samples from one drive to another (or from one directory to another) you will not experience an immediate block of the system and detection and disinfection as the copy operation occurs, as in this scenario an OnPrefetch Scan would be scanning these files asynchronously and using idle CPU times.

In order to give visibility of what is happening exactly behind the scenes, we have created 2 registry entries which can be tweaked to turn advanced logging on and off. Simply download and run the registry files below and run them. Make sure the directory C:\Logs_CloudAV exists or replace with your choice of path in the REG file. We suggest you create a specific directory for it as multiple log files will be created, one for every time the service is started. A reboot or service restart will be required for Panda Cloud Antivirus to start logging.

 

Understanding the Log

The log file is basically a CSV file with the following fields:

TimeStamp: Time stamp of the event
JobID: Internal engine ID of the event
Profile: ID of the configuration profile with which the event has been executed. Different types of events use different profiles in order to apply a specific configuration.
Date: Complete date and seconds of the event.
JobType: Type of job. Can be AnalysisRequest, AnalysisResult or ActionResult
TaskType: Type of scan that generated the event: OnDemand, OnBackground, OnPrefetch, OnAccess
File: Full path to the file in question
Result: Result of the task. In the case of an AnalysisResult event will indicate the malware classification. In the case of ActionResult indicates the action taken.

In the following sections we’ll take a more in-depth look into some sample detections and how they can be interpreted by looking at the log file.

 

On-Demand Scan of a Folder

In this scenario we’ll launch an on-demand scan of a folder which has a combination of clean files with infected files. This example generates an OnDemand AnalysisRequest over all the elements inside the directory. An enumeration of said directory is performed and all objects found will be scanned with the OnDemand task. Of those found to be malware Cloud Antivirus will act upon (delete or disinfect).

A typical scenario while launching on-demand scans on a file or folder is the loss of Internet connectivity during the scan itself or simply no connectivity whatsoever. As Panda Cloud Antivirus is basing most of its detection technology on the cloud, it can be seen by the log entries how each file scan is throwing an error back, indicating loss of connectivity. Most detections while running an on-demand scan without Internet connectivity will be due to the local cache copy of Collective Intelligence and heuristics included in the agent.

 

On-Demand Scan of a Suspicious File

In this scenario we’ll launch an on-demand scan on a specific file. We’ll right-click the file suspect.dat which is classified as suspicious. In case of receiving a positive AnalysisResult the engine will throw an Action on the file.

 

Execution of a Malware PE File

In this test scenario we’ll execute a malicious PE file (files with extension EXE, COM, etc.). In this example we’ll double-click on the file EICAR.EXE which is considered malware and whose detection does not require connectivity to the cloud. As the execution of a file is an action which puts the security of the machine in danger, as soon as it is intercepted it is blocked and an OnAccess AnalysisRequest is launched. Depending on the result of the action access to the file is allowed or denied and a subsequent task is generated to neutralize the file.

In the next example we’ll repeat a similar scenario but whose detection of this particular malware file (MyFormatter.exe) is delivered from-the-cloud. In the following example we can see the reaction of the product against the execution of MyFormatter.exe.

 

Copy of a PE File

In this scenario we’ll copy a malicious PE file Eicar.exe to EicarCopy.exe. As a copy operation is not a high imminent risk to the PC the copy operation is permitted while an OnPrefetch AnalysisRequest is launched, anticipating its possible execution later on. If it is detected as malware, an Action will be requested on the file.

 

It is worth noting an error that may show up on the log (shown below) as a JobType “Cloud Error” which means that the communication between the Panda Cloud Antivirus agent and the server has failed, in this particular example during the OnPrefetch scan of the PE file GoogleDesktopResources_es.dll as the network connection was disabled on this machine.

 

Opening of a Non-PE File

This scenario consists of opening a non-PE file, in our case a Word document (mydoc.doc) which is not malicious. Opening a file, as executing a PE file, is considered a high risk action for the computer. Therefore the action is intercepted and blocked while an OnAccess AnalysisRequest is launched on the file.

 

 

 Copy of a Non-PE File

In this example we’ll copy a malicious non-PE file Achtung.doc to AchtungCopy.doc. As a copy operation is not a high imminent risk to the PC the copy operation is permitted and the default action is to launch an OnPrefetch AnalysisRequest on the resulting file. However in this case an OnAccess AnalysisRequest is launched on the original file as the Operating System needs to open a non-PE file in order to copy it to a new file. As we’ve seen before, the opening operation is considered a high risk operation and therefore an OnAccess AnalysisRequest is also launched on the file Achtung.doc. As it is detected as malicious, the copy operation is blocked.

 

New Protection Model Explained

With Panda Cloud Antivirus we introduce a new protection model based on a thin-client agent & server architecture which services malware protection as opposed to locally installed products. By combining local detection technologies with cloud-scanning capabilities and applying non-intrusive interception techniques on the client architecture, Panda Cloud Antivirus provides some of the best protection with a lightweight antivirus thin-client agent that barely consumes any PC resources.

Panda Cloud Antivirus is the first antivirus based on this innovative protection model which is based on two fundamental principles:

1. Automatic malware detection and remediation from the cloud in real-time.
2. The use of an ultra-lightweight thin-client agent.

Automatic Malware Detection & Remediation from the Cloud

One of the main pillars of Panda Cloud Antivirus is its real-time use of Panda Collective Intelligence, which is an online from-the-cloud system that automates the entire malware protection cycle; collecting new samples, analyzing, categorizing, creating detection and disinfection routines and delivering the protection to each node.

Thanks to this approach users do not need to worry about updating signature files anymore. In fact, detection of millions and millions of different malware variants is no longer limited by the size of a signature database, as Collective Intelligence can hold literally unlimited number of detections without consuming any memory on the users’ PC.

Another benefit of using cloud-based detection is that the time from detection to protection has been shortened a lot. It takes C.I. literally under 6 minutes to analyze and classify a new file that it receives.

An important aspect of Collective Intelligence is the use of correlation in order to further improve detection of new variants. By using information from the different nodes C.I. can protect against new strains of malware by correlating its activity from the first time it’s seen in one of the nodes. Therefore the community becomes the lab. The most users use Panda Cloud Antivirus, the better protected everybody is.

A Lightweight Thin-Client that Off-Loads the Hard Work to the Server

The client portion of Panda Cloud Antivirus has been designed from the ground up to protect PCs in a non-intrusive way. Basically we’ve redesigned the traditional on-access interception techniques to work on a slightly different way, adapting to users real needs of reduced performance impact while concentrating on the truly important aspects of protection when it is needed.

Traditionally AV engines have intercepted files and objects in multiple layers (entry vector, file system and execution). In each layer, each object is scanned by multiple technologies, such as antivirus signatures, rules, heuristics, behavioral analysis, etc. This redundancy of scans results in a degradation of user experience as the AV ends up consuming a lot of valuable PC resources and impacting global performance.

Even as a lightweight agent, Panda Cloud Antivirus provides excellent protection as it applies intelligent interceptions and scans of the files in the local PC based on Collective Intelligence and its local cache copy. It does this by implementing different types of on-access scans which are defined as follows:

• On-Access Scan. This is the maximum priority resident scan that is applied only to objects which are truly a security risk in a specific point in time: files which are being executed or used. The file is intercepted, prevented from running and disinfected if found to be malicious.
• Prefetch Scan. There are other elements such as files downloaded from the Internet which, while not being executed at a specific point in time, have a much higher risk and probability of being executed at any time. These files should be watched more closely than files which have barely any activity, as we can expect them to be executed, unpacked, copied or moved shortly. A Prefetch Scan basically launches an asynchronous local & cloud query on the file to scan it “as soon as possible” without impacting performance. Of course if any of these files is called to be executed, the file will be intercepted and an on-access scan will be applied to it.
• Background Scan. Lastly a normal PC has hundreds of thousands of files in its hard drive. Most of these files are not executing normally and simply just “sit there” until either the use double-clicks on them or they are called upon by another process. These are considered the least dangerous files from a security perspective. Panda Cloud Antivirus will continuously run Background Scans on these in an asynchronous manner while the PC is idle, without impacting performance at all. Of course if any of these files is called to be executed, the file will be intercepted and an on-access scan will be applied to it.

Panda Cloud Antivirus represents for us a new model for protecting PCs in a manner that users have been asking for a long time: without performance impact. We hope that you enjoy this technology beta and can share your experiences and test results with us, both in this blog in the form of feedback at www.cloudantivirus.com or by sending an email directly to beta@pandasecurity.com.

TIA

Welcome to the Panda Cloud Antivirus Beta

Today we’re releasing the public beta of Panda Cloud Antivirus, which is the first free cloud-based antivirus thin-client. It consists of a lightweight antivirus agent that is connected in real-time to PandaLabs’ Collective Intelligence servers to protect faster against the newest malware variants while barely impacting PC performance.

Thanks to Panda Security’s Collective Intelligence malware and goodware online database, Panda Cloud Antivirus detects more malware than traditional signature-based solutions which take longer to detect the most recent, and therefore most dangerous, variants.

With Panda Cloud Antivirus we introduce a new protection model based on a thin-client agent & server architecture which services malware protection as opposed to locally installed products. By combining local detection technologies with cloud-scanning capabilities and applying non-intrusive interception techniques on the client architecture, Panda Cloud Antivirus provides some of the best protection with a lightweight antivirus thin-client agent that barely consumes any PC resources.

Our objective is to release a solution based on this new protection model which helps solve the malware problem by improving user experience. After almost 20 years fighting viruses and malware we have changed our mentality at Panda. We would like to open ourselves to you and show you how we pretend to do things. In this blog we’ll explain in depth how this new model works in order to help improve it with you, our users.

As for the beta objectives, we’re interested in collecting information from betatesters, evaluators, testers, etc. that can provide feedback on how the new protection model works under different scenarios in order to help us verify it as a valid model and to adapt it to real life.

Of course keep in mind that this is still beta code and as such we continue improving and tuning both the cloud architecture and detection techniques as well as the agent architecture, specially now during the initial phases. We’ll progressively release new versions which you’ll be able to use as we improve the overall protection and user experience.

Feel free to download Panda Cloud Antivirus if you haven’t done so yet. For suggestions please use the form located at www.cloudantivirus.com and for submitting bugs please use beta@pandasecurity.com.

Safe surfing,

Pedro Bustamante
Senior Research Advisor
http://research.pandasecurity.com