Which feature would you most like to see in the next version Panda Cloud Antivirus?
Take the poll and help us design the next versions of your new favourite antivirus:
http://www.cloudantivirus.com/forum/poll.jspa?pollID=50103
Posts Tagged ‘architecture’
New features of Panda Cloud Antivirus
November 13, 2009Known Issue with Beta2 Synchronous & Background Scan
July 21, 2009We have received some comments and reports from Beta2 users of version 0.08.82 of slowness of their PCs and lots of hard drive I/O activity from PSANHost.exe.
We are tracing this problem back to an interaction of the new synchronous OnAccess cloud-scan with the BackgroundScan. This interaction seems as it could be the source of the slowness of the system even though we continue investigating it. Basically this occurs under certain circumstances when both scans are consuming the same resource. We’re in the process of redesigning these two scan tasks so they are optimized in the use of critical system resources to avoid simultaneous accesses to common resources.
As a workaround you can disable the BackgroundScan altogether. Disabling this task does not compromise the security level of the PC as the OnAccess scan guarantess the protection of the machine. If you apply this workaround simply make sure to run an OnDemand scan periodically to ensure there are no inactive & latent malicious files in the drive.
To disable the BackgroundScan simply create the following registry entry and reboot the PC:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREPanda SecurityPanda Service Host]
"BackgroundDisabled"="-"
If you are not used to playing around with the registry, simply download and execute the .REG file in the following file:
http://blog.cloudantivirus.com/wp-content/uploads/2009/07/background_disabled.zip
As we continue investigating this problem, if you are affected by this problem and are able to send us debug information please get in touch with us. Thanks again to everybody for your help 🙂
Cloud Antivirus Beta2 Released
June 30, 2009
Thanks to the millions who have downloaded and installed Panda Cloud Antivirus Beta1 (0.08.80) and sent feedback to help us improve the product before its final release. Today we’re releasing Panda Cloud Antivirus Beta2 (0.08.81).
INSTALLATION INSTRUCTIONS
1- Uninstall the Beta1 from Control Panel, Add/Remove Programs. Reboot.
2- Download the Beta2 from http://www.cloudantivirus.com.
3- Install the Beta2.
BETA2 IMPROVEMENTS
We focused Beta2 on fixing the most important detection & disinfection aspects per feedback from the community. The following is a list of items that are either new or fixed in Beta2. If you have any doubts about any of them feel free to post your question as a comment.
New – “Undo” Option for Recycle Bin
Some users complained about the effect of the automated deletion of known malware. In some cases where users want these samples to not be deleted and/or in the case of false positives, there was no option to recover these files. A new option has been added with Beta2 to the Recycle Bin so users can recover deleted detections for a period of 3 days (configurable by CI). During this time period file icons will be changed to show that the file is quarantined in the Recycle Bin. NOTE: this does not apply to “disinfected” files, only to “deleted” files.
New – Synchronous Real-Time Cloud-Scan
Under some circumstances files being executed (directly from Internet download, from a read-only network share, etc.) were checked asynchronously against the cloud after the file was loaded into memory. This resulted in detection+disinfection actions to be taken after infection. With Beta2 we changed this behaviour to block the execution until a response has been received by Collective Intelligence. In the event that it is malware, the file will be deleted prior to allowing it to execute.
New – Latency & Response Control of the Cloud-Scanner
We deployed 10 sensors throughout America, Europe and Asia and have detected that 98.41% of the Collective Intelligence queries are responded to within 3 seconds. However, in the remaining cases there is not a control mechanism and if the response is not timely (because of connectivity issues, latency, proxy delays, etc.) then the program would be allowed to execute prior to receiving the response from Collective Intelligence. With the new response control mechanism, programs executing which take longer than 6 seconds to receive an answer from Collective Intelligence are put “on hold” for a second timeout period of 30 seconds after which the program is unblocked and allowed to execute (although it will continue being scanned asynchronously).
Fixed – Slow Scans
Right after installation Panda Cloud Antivirus launches a BackgroundScan of the entire PC to ensure it is clean. Some users reported that launching an On-Demand scan of the entire PC right after install slowed down the PC and/or caused the scan to take a long time. This bug was due to both the BackgroundScan and OnDemandScan running simultaneously. With Beta2 this is fixed by having the BackgroundScan automatically pause in case it detects an OnDemandScan being launched. Once the OnDemandScan is finished, the BackgroundScan will resumen where it left off.
Fixed – Recycle Bin Unblock Functionality
Under some circumstances and with certain types of malware, some users reported that unblocking a suspicious/potentially unwanted malware that was sent to the Recycle Bin, resulted in it being continuously detected over and over again. This has been fixed in Beta2.
Other Fixes
By the way, we’ll still release a Beta3 version prior to final release of Version 1.0. For Beta3 we’re already working on new platforms (Windows7, 64bits), improved features, a new website, a Collective Intelligence real-time encyclopedia and some additional things. Expect the Beta3 to be released around September.
Known Issues
April 30, 2009
The following issues have been detected by our beta testers which should be taken into consideration.
Installation / Uninstallation Issues
- During an incomplete uninstall, after reboot, the uninstall process cannot be finished. SOLUTION: We’re creating an uninstaller, but in the meantime please send us the log that is shown in the warning message.
- Cannot install after an incomplete install. SOLUTION: We’re creating an uninstaller, but in the meantime please send us the log that is shown in the warning message.
- Error while re-installing as a file cache is in use. SOLUTION: click “Retry” and allow the installation process to finish. It will complete successfully in spite of the warning message.
Application Issues
- Report takes a long time to show over 10.000 detections. WORKAROUND: as the Panda Cloud Antivirus Log is saved in the Windows Event Viewer, delete the corresponding Event Viewer Log before launching an on-demand scan over many files to help improve the responsiveness of the report viewer.
- The Recycle Bin (quarantine) takes a long time to show when there are many items in it.
- In the Event Report the name of the detected malware is shown as “Not available”. This means that either Internet connectivity was lost during the synchronization with Collective Intelligence or the malware naming webservice is not responding correctly.
Detection & Disinfection Issues
- Boot scan not performing correctly.
- Infected PE files which are not file-infectors and which are downloaded via HTTP, the product prompts for reboot disinfection even though it’s not really necessary.
- In infected compressed or packed containers which hold multiple elements, where at least one is infected, the product prompts for reboot disinfection even though it’s not really necessary.
- In some cases after disinfecting a file-infector virus the product notifies as “not neutralized” even though it was disinfected correctly and vice versa (in the case where the virus is in memory or the user does not have write-access to the directory respectively).
- Does not intercept nested Office file formats.
- When launching and on-demand scan over a very large number of malware samples the scan may be stuck at 99% of completion. SOLUTION: Disable BackgroundScan (will post details soon on how to do this).
As always we appreciate and welcome testing feedback so please keep them coming at beta@pandasecurity.com or in the form of comments on this blog.
Testing Panda Cloud Antivirus: Advanced Logging
April 30, 2009
If you’ve read the introduction to Panda Cloud Antivirus and have come this far, you’re probably interested in “seeing” how this new approach to protection works, not just reading about it. We have enabled certain functionalities which you, as a tester, can use to “see” what Panda Cloud Antivirus is doing behind the scenes.
Turning Advanced Logging On/Off
One of the most important things to take into consideration while testing Panda Cloud Antivirus, especially against malware samples and its on-access scanner, is that the traditional on-access scanner has been replaced by 3 new types of interception techniques: OnAccess, OnPrefetch and OnBackground. As each of these operates at different priorities and risk situations, their final actions are not always immediately visible as you would expect from a traditional on-access scan. For example if you copy a directory full of malware samples from one drive to another (or from one directory to another) you will not experience an immediate block of the system and detection and disinfection as the copy operation occurs, as in this scenario an OnPrefetch Scan would be scanning these files asynchronously and using idle CPU times.
In order to give visibility of what is happening exactly behind the scenes, we have created 2 registry entries which can be tweaked to turn advanced logging on and off. Simply download and run the registry files below and run them. Make sure the directory C:\Logs_CloudAV exists or replace with your choice of path in the REG file. We suggest you create a specific directory for it as multiple log files will be created, one for every time the service is started. A reboot or service restart will be required for Panda Cloud Antivirus to start logging.
Understanding the Log
The log file is basically a CSV file with the following fields:
TimeStamp: Time stamp of the event
JobID: Internal engine ID of the event
Profile: ID of the configuration profile with which the event has been executed. Different types of events use different profiles in order to apply a specific configuration.
Date: Complete date and seconds of the event.
JobType: Type of job. Can be AnalysisRequest, AnalysisResult or ActionResult
TaskType: Type of scan that generated the event: OnDemand, OnBackground, OnPrefetch, OnAccess
File: Full path to the file in question
Result: Result of the task. In the case of an AnalysisResult event will indicate the malware classification. In the case of ActionResult indicates the action taken.
In the following sections we’ll take a more in-depth look into some sample detections and how they can be interpreted by looking at the log file.
On-Demand Scan of a Folder
In this scenario we’ll launch an on-demand scan of a folder which has a combination of clean files with infected files. This example generates an OnDemand AnalysisRequest over all the elements inside the directory. An enumeration of said directory is performed and all objects found will be scanned with the OnDemand task. Of those found to be malware Cloud Antivirus will act upon (delete or disinfect).
A typical scenario while launching on-demand scans on a file or folder is the loss of Internet connectivity during the scan itself or simply no connectivity whatsoever. As Panda Cloud Antivirus is basing most of its detection technology on the cloud, it can be seen by the log entries how each file scan is throwing an error back, indicating loss of connectivity. Most detections while running an on-demand scan without Internet connectivity will be due to the local cache copy of Collective Intelligence and heuristics included in the agent.
On-Demand Scan of a Suspicious File
In this scenario we’ll launch an on-demand scan on a specific file. We’ll right-click the file suspect.dat which is classified as suspicious. In case of receiving a positive AnalysisResult the engine will throw an Action on the file.
Execution of a Malware PE File
In this test scenario we’ll execute a malicious PE file (files with extension EXE, COM, etc.). In this example we’ll double-click on the file EICAR.EXE which is considered malware and whose detection does not require connectivity to the cloud. As the execution of a file is an action which puts the security of the machine in danger, as soon as it is intercepted it is blocked and an OnAccess AnalysisRequest is launched. Depending on the result of the action access to the file is allowed or denied and a subsequent task is generated to neutralize the file.
In the next example we’ll repeat a similar scenario but whose detection of this particular malware file (MyFormatter.exe) is delivered from-the-cloud. In the following example we can see the reaction of the product against the execution of MyFormatter.exe.
Copy of a PE File
In this scenario we’ll copy a malicious PE file Eicar.exe to EicarCopy.exe. As a copy operation is not a high imminent risk to the PC the copy operation is permitted while an OnPrefetch AnalysisRequest is launched, anticipating its possible execution later on. If it is detected as malware, an Action will be requested on the file.
It is worth noting an error that may show up on the log (shown below) as a JobType “Cloud Error” which means that the communication between the Panda Cloud Antivirus agent and the server has failed, in this particular example during the OnPrefetch scan of the PE file GoogleDesktopResources_es.dll as the network connection was disabled on this machine.
Opening of a Non-PE File
This scenario consists of opening a non-PE file, in our case a Word document (mydoc.doc) which is not malicious. Opening a file, as executing a PE file, is considered a high risk action for the computer. Therefore the action is intercepted and blocked while an OnAccess AnalysisRequest is launched on the file.
Copy of a Non-PE File
In this example we’ll copy a malicious non-PE file Achtung.doc to AchtungCopy.doc. As a copy operation is not a high imminent risk to the PC the copy operation is permitted and the default action is to launch an OnPrefetch AnalysisRequest on the resulting file. However in this case an OnAccess AnalysisRequest is launched on the original file as the Operating System needs to open a non-PE file in order to copy it to a new file. As we’ve seen before, the opening operation is considered a high risk operation and therefore an OnAccess AnalysisRequest is also launched on the file Achtung.doc. As it is detected as malicious, the copy operation is blocked.
New Protection Model Explained
April 29, 2009With Panda Cloud Antivirus we introduce a new protection model based on a thin-client agent & server architecture which services malware protection as opposed to locally installed products. By combining local detection technologies with cloud-scanning capabilities and applying non-intrusive interception techniques on the client architecture, Panda Cloud Antivirus provides some of the best protection with a lightweight antivirus thin-client agent that barely consumes any PC resources.
Panda Cloud Antivirus is the first antivirus based on this innovative protection model which is based on two fundamental principles:
1. Automatic malware detection and remediation from the cloud in real-time.
2. The use of an ultra-lightweight thin-client agent.
Automatic Malware Detection & Remediation from the Cloud
One of the main pillars of Panda Cloud Antivirus is its real-time use of Panda Collective Intelligence, which is an online from-the-cloud system that automates the entire malware protection cycle; collecting new samples, analyzing, categorizing, creating detection and disinfection routines and delivering the protection to each node.
Thanks to this approach users do not need to worry about updating signature files anymore. In fact, detection of millions and millions of different malware variants is no longer limited by the size of a signature database, as Collective Intelligence can hold literally unlimited number of detections without consuming any memory on the users’ PC.
Another benefit of using cloud-based detection is that the time from detection to protection has been shortened a lot. It takes C.I. literally under 6 minutes to analyze and classify a new file that it receives.
An important aspect of Collective Intelligence is the use of correlation in order to further improve detection of new variants. By using information from the different nodes C.I. can protect against new strains of malware by correlating its activity from the first time it’s seen in one of the nodes. Therefore the community becomes the lab. The most users use Panda Cloud Antivirus, the better protected everybody is.
A Lightweight Thin-Client that Off-Loads the Hard Work to the Server
The client portion of Panda Cloud Antivirus has been designed from the ground up to protect PCs in a non-intrusive way. Basically we’ve redesigned the traditional on-access interception techniques to work on a slightly different way, adapting to users real needs of reduced performance impact while concentrating on the truly important aspects of protection when it is needed.
Traditionally AV engines have intercepted files and objects in multiple layers (entry vector, file system and execution). In each layer, each object is scanned by multiple technologies, such as antivirus signatures, rules, heuristics, behavioral analysis, etc. This redundancy of scans results in a degradation of user experience as the AV ends up consuming a lot of valuable PC resources and impacting global performance.
Even as a lightweight agent, Panda Cloud Antivirus provides excellent protection as it applies intelligent interceptions and scans of the files in the local PC based on Collective Intelligence and its local cache copy. It does this by implementing different types of on-access scans which are defined as follows:
- On-Access Scan. This is the maximum priority resident scan that is applied only to objects which are truly a security risk in a specific point in time: files which are being executed or used. The file is intercepted, prevented from running and disinfected if found to be malicious.
- Prefetch Scan. There are other elements such as files downloaded from the Internet which, while not being executed at a specific point in time, have a much higher risk and probability of being executed at any time. These files should be watched more closely than files which have barely any activity, as we can expect them to be executed, unpacked, copied or moved shortly. A Prefetch Scan basically launches an asynchronous local & cloud query on the file to scan it “as soon as possible” without impacting performance. Of course if any of these files is called to be executed, the file will be intercepted and an on-access scan will be applied to it.
- Background Scan. Lastly a normal PC has hundreds of thousands of files in its hard drive. Most of these files are not executing normally and simply just “sit there” until either the use double-clicks on them or they are called upon by another process. These are considered the least dangerous files from a security perspective. Panda Cloud Antivirus will continuously run Background Scans on these in an asynchronous manner while the PC is idle, without impacting performance at all. Of course if any of these files is called to be executed, the file will be intercepted and an on-access scan will be applied to it.
Panda Cloud Antivirus represents for us a new model for protecting PCs in a manner that users have been asking for a long time: without performance impact. We hope that you enjoy this technology beta and can share your experiences and test results with us, both in this blog in the form of feedback at www.cloudantivirus.com or by sending an email directly to beta@pandasecurity.com.
TIA
Panda Cloud Antivirus Blog 