Security and Anti-Virus

[adamjodonnell]

Hey guys
My name is Adam J. O'Donnell, and I like you am a Comcast subscriber.  I also happen to be a cofounder in an anti-virus company called Immunet.  We make a free, cloud-based AV product that can either be used stand-alone or sit along side of another AV product to increase your protection against new malware.  You can grab it at www.immunet.com if you want to give it a shot.
While I do want you to download and use our stuff, I want to let you know that this isn't a sales pitch.  I want you to know that another domain expert in AV will be visiting the forums on a regular basis.  Also, I am not a business guy - I designed and wrote Immunet's backend.
I am also willing to answer any questions you may have about anti-virus in general.  For example, I know many of you want to know why a virus can get past an anti-virus product.  Virus writers actively test their products against AV products and will mutate their work until it gets past the AV engine.  The bad guys don't bother releasing something until they feel it can get past a bunch of the AV engines that are out there.  The AV guys respond by updating their software as fast as possible.  
Traditional AV takes hours to days to update their virus definitions.  We observed that the previous approach to antivirus has become bloated and intrusive with failing to keep pace with the new threat landscape, where the bad guys do continual testing of their viruses against preexisting products.  Instead, we built a system that is continually updated by pushing all our definitions into the cloud in a real-time fashion rather than having to wait for the next update to take place on the client system.  The goal is to deliver antivirus that is agile enough to meet the challenge of the new threats and at the same time doesn't slow down a user's PC while doing it. 
Anyways, I will be popping in here from time to time to see what you have to say, and maybe post responses to any AV questions that come up.
Take care
Adam

[USAF_E-8_RET]

Welcome Adam and TYVM for offering to explain the workings of Immunet.  I am sure you'll be able an asset to this forum and Comcast's customers.

I do have a few questions for you to start with:

Can you comment on "Immunet allegedly calling home" as posted by suelynn2 (Post #92) in this thread?

http://forums.comcast.net/t5/Security-and-Anti-Virus/Comcast-Announces-Constant-Guard-security-progr...

Also do you have any comments on this PC Mag article, since the tester was using "older known infections" in his test systems that using cloud should have been update in Immunet long ago..

http://www.pcmag.com/article2/0,2817,2365093,00.asp 

Thanks in advance for your answers!

[suelynn2z]

Hi Adam,
I don't know if this is good or bad policy, but I turn off my Internet connectivity when I am not using my PC sometimes because it is faster than turning off the computer. My pc was then trying to contact Immunet Protect every minute or so. Should I exit Immunet Protect when I turn off my Internet connection? I didn't want to forget to turn it back on. I thought it was attempted bot traffic when I first saw it in my firewall logs.

[Queen-Evie]

Hello Adam.

I did look on the Immunet website and found this page, and your name and picture are  there.

http://www.immunet.com/about/bios/index.html

Expertise such as yours would be welcome here. However, just like anyone else, you have to do one thing.

That is PROVE yourself to us. It doesn't matter is someone is an expert in an area, or just a regular customer doing what he/she can to help others. The proof is in in answers and comments and how you interact with people.

[adamjodonnell]

I am glad you brought up the PC Mag review, since I expected it would come up at some point.  First of all, I want to highlight our detection rates as compared to other major AV products.  We beat MalwareBytes in Neil's own data, but he chose to not highlight this:

http://common.ziffdavisinternet.com/util_get_image/22/0,,i=229872&sz=1,00.jpg

Second of all, at the time we were reviewed by Neil, we designed a companion AV product.  Protect was built to not be a full protection suite but to be a booster shot to the current AV technology that a user already had in place.  Neil ignored this during his review.  We have since built in new detection engines and have improved the performance of our existing detection engines to improve efficacy.

Finally, if you look at our most recent tests by the independent group AV Comparatives, we smoke pretty much every product on the market:

http://wwww.av-comparatives.org/images/stories/test/single/immunet_aug2010.pdf

I hope this addresses some of your concerns regarding the efficacy of our product.

Take care

Adam

[adamjodonnell]

Tough crowd.  :-)

Yes, that is me.  I rarely wear a suit though.

[adamjodonnell]

I won't be able to check in here every day, but I do want to point out that Immunet maintains a set of user forums that are actively read by Immunet people:

http://forum.immunet.com/

Our VP of Engineering, Alfred Huger, and support people hang out on there.  Al and others can't pop on here only because they are Canadian and, therefore, can't be Comcast customers.

Take care

Adam

[USAF_E-8_RET]

@ Adam,

Thanks for the feedback on the PC Mag article, I certainly appreciate you taking the time to answer my concerns in that area.  I am still a bit leery of running two real -time scanning engines on the same system as I may be from the "old school" but I was taught never 2 AV's and never 2 security progams running real-time to avoid conflicts.

Now, can you comment on "Immunet allegedly calling home" as posted by suelynn2 (Post #92) in this thread?

http://forums.comcast.net/t5/Security-and-Anti-Virus/Comcast-Announces-Constant-Guard-security-progr...

[adamjodonnell]

Yes, I already have, as of this morning at 9:15 AM eastern.

[USAF_E-8_RET]

Sorry Adam, you did answer that, I guess I just missed it since there are so many threads on the Constant Guard, Immunet and our normal Security traffic on this forum. 

Let me try another question so I may try to understand what is going on.  If the Immunet "free" is installed on your system, then it is merely an "on demand" scanner?  It goes out to the cloud, gets the latest updates and then scans your system.  If you purchase Immunet, then it is a full blown real-time AV/malware program  which checks constantly for cloud defs.  The free version also does this during the 14 day trial.  So the "calling home" that suselynn2 was seeing was actually what would happen if you purchased the full blown version, while the free version (after the trial) will only check for updates when it is engaged to scan?

I am not trying to be a pain, just trying to get the big picture - as I am sure other users are.

[BlueJay]

USAF, as far as I'm concerned, you're not being a pain..   You're asking questions that I'd like answered also..  .

.

Right now, I'm up in the clouds, and trying not to stall out.. 

.

I'm still not sure what Immunet is, an AntiVirus { like my KIS} or an AntiMalware {like Malwarebytes}.   And how it differs, and what's its advantages..

.

So keep on asking USAF, thanks.. 

.

ciao, bj

[adamjodonnell]

So our AV package, both Immunet Free and Immunet Pro, operate a little differently than conventional anti-virus.  They call home for all new files that come onto your system.  The core cloud AV engine doesn't have updates that it pulls down once a day.  All we know about computer viruses is stored in our cloud system - that is how we stay so up to date.  The gap in time between updates - a standard problem with conventional AV - is how many viruses get past the AV product.  We avoid this problem by design.

As I said, the cloud lookup feature is in both the free and the pro product.  Two key features you get with the pro product are an anti-rootkit package and an offline scanning engine.  Those are two features that people want, and honestly, that's how we make our money.  We need to make payroll somehow.  :-)

I hope that clears things up a bit more.

Take care

Adam

[jlivingood]

---

adamjodonnell wrote:

Our VP of Engineering, Alfred Huger, and support people hang out on there.  Al and others can't pop on here only because they are Canadian and, therefore, can't be Comcast customers.

---

To clarify, Canadians are quite welcome to be Comcast customers. They just need a residence in our service area in the United States. ;-)   

[4CrawlR]

From the "Comcast Announces Constant Guard security program" thread:

So I am now finding on my WinXP/SP3 desktop that if left on for maybe 8-10 hours (like overnight) that the agent.exe process is taking up 99% of my CPU time and the system is totally unresponsive and I have to power it down and restart in order to get access again.  Per ProcessExplorer, agent.exe is the "Immunet Protect Agent".  This started happening about a week after installing Immunet s/w (free version). 

What is going on?

[suelynn2z]

My XPsp3 is probably having similar issues. It was very slow (worse than usual) and failed the majority of the windows updates when I tried to update yesterday. I didn't realize agent.exe was Immunet protect. I closed that and secundia but the update of windows still failed and I can't determine from the error code if it is because my system is too slow due to antivirus sw getting in the way, or the opposite that malware is preventing the windows security updates.

Sometimes I can't decide which is worse, the cure or the disease!

[ComcastJordan]

I'm sure Adam will have a more detailed response when he has a chance.

I have Immunet loaded on 4 of my computers and have not seen this behavior.  Does this occur after the machine has been on for several days or after a fresh boot? 

[4CrawlR]

---

Jordan_RO wrote:

I'm sure Adam will have a more detailed response when he has a chance.

I have Immunet loaded on 4 of my computers and have not seen this behavior.  Does this occur after the machine has been on for several days or after a fresh boot? 

---

Well, have only seen it after a reboot, as I have to reboot it about every 8-12 hours because of the agent.exe process sucking up all processor time.  Yesterday, came home at 9PM after leaving the PC on for about 4 hours w/o using it, system was unresponsive.  Powered down and rebooted a bit before 10PM.  Then w/ system up overnight, with Task Manager left running, found system unrespnsive at about 7AM, agent.exe using 99% of CPU time and unable to move mouse or do anything to kill it or restqart the machine (in 20-30 minutes of trying) aside from holding the power button down.

[ComcastJordan]

Quick search of agent.exe on the internet shows that this is a file used by literally dozens of different software packages dating as far back as 2007 (or earlier).  Since it's possible to have Are you certain it's associated with Immunet?  

I just checked 2 of my 4 machines and none of them have an agent.exe running in the processes and all are running Immunet.

[4CrawlR]

---

Jordan_RO wrote:

Quick search of agent.exe on the internet shows that this is a file used by literally dozens of different software packages dating as far back as 2007 (or earlier).  Since it's possible to have Are you certain it's associated with Immunet?  

I just checked 2 of my 4 machines and none of them have an agent.exe running in the processes and all are running Immunet.

---

From Process Explorer v11.33:

Image file: Immunet Protect Agent (Not verified) Immunet Corporation

Version: 2.0.17.31

Path: I:\Program Files\Immunet Protect\2.0.17\agent.exe

Command Line: "I:\Program Files\Immunet Protect\2.0.17\agent.exe"

Current Directory: I:\Program Files\Immunet Protect\2.0.17\

Seems to be from the Immunet Protect package.

Also, seems like this is a poor choice of executable name, might try something a little less generic.

As as an update, it does seem that agent.exe has some sort of memory leak, or at least a slow increase in memory use as it runs.  After about 4 hours running, I noted it was at approx. 63MB and now after about 9 hrs. running is is 111MB. 

[ComcastJordan]

Ah, now I see it.  Not sure why I didn't see it the list the first time. 

It looks like Agent.exe is a bit of common code used by various programs to keep updated.  Immunet seems to be using it, in much the way one would expect.  Have you tried uninstalling and reinstalling?  

[4CrawlR]

---

Jordan_RO wrote:

Ah, now I see it.  Not sure why I didn't see it the list the first time. 

It looks like Agent.exe is a bit of common code used by various programs to keep updated.  Immunet seems to be using it, in much the way one would expect.  Have you tried uninstalling and reinstalling?  

---

Unistalling and installing what?  agent.exe? 

Where do you get just that from? 

Or do you mean the whole immunet package? 

Did not know I was signing up to help beta test a new A/V package. 

[ComcastJordan]

---

4CrawlR wrote:

Unistalling and installing what?  agent.exe? 

Where do you get just that from? 

Or do you mean the whole immunet package? 

Did not know I was signing up to help beta test a new A/V package. 

---

No, not agent.exe, I meant the Immunet package.  

In no way is this a beta test.  Sometimes software/processes hang.  Sometimes packages don't install properly.  As our Mac friends will be happy to point out, that's just life in the land of Windows.  Sometimes uninstalling and reinstalling fixes that.

[4CrawlR]

OK, so in uninstalling Immunet, it asks if I want to remove all logs/quarantine data/etc.  Do I remove this local data or not?  It mentions leaving the data if I plan to re-install (which I plan to do) but might the local data be messed up and somehow interfere with the re-install?  I am not familiar with what is in this local data and whether it is a concern either way.

Delete, don't delete, flip a coin?  Any tips from the author or anyone that has any experience with this program?

Well, went with the removal tip, left old data/logs in place since a re-install was planned.  Only observed glitch was that the removal script asked to reboot system, clicked OK and about half the open windows closed but then the reboot process seemed to stop.  Had to issue a manual restart from the Start menu.  After that, system came up, re-installed Immunet and rescanned system and found nothing (just like before). 

Will set up TasMgr to watch the agent.exe process overnight and see if it behaves. 

Update:

After one overnight run, it seems that reinstalling immunet s/w resolved the problem with the agent.exe process taking over the processor.  Either that or the Norton cleanup that the on-line tech did yesterday morning.  But in any event, it seems as if that process is behaving itself now.

[ComcastJordan]

Glad to hear it!  I hate hung processes.  Someday Windows will get better at managing them.... Someday.

[adamjodonnell]

If the problem persists, I can put you in contact with our support guy, who is also on our QA team.  We can take a closer look at the logs to see if there are any issues with our software package, and we can attempt to reproduce the issue in house.

Take care

Adam

[adamjodonnell]

We can safely recover, under every situation I know about at this time, if the local data is corrupted, so yes, if you plan on reinstalling you should leave the local data there.

Adam