How does Avast handle "airpush" coming from some apps?

[cooby]

Will Avast block ads or prevent or alert about installing an application that pushes ads ... somthing called "airpush". Just curious.

[Filip Havlicek]

Hi,

no, I'm afraid not. We didn't have it, users complained, so we added it, users complained even more, so we removed it again. We might add it again in the future

Filip

[cooby]

OK, so take a look at the 2 posts here. I wish avast would catch and I keep wishing for logs like these.
http://www.thriveforums.org/forum/toshiba-thrive-apps/14082-how-dr-web-av-handled-app-serving-airpush-junkware.html
and in case you can't see pictures (if you haven't yet joined our friendly group), here you go
http://img543.imageshack.us/img543/456/1219a.png
http://img526.imageshack.us/img526/1374/1219b.png
http://img809.imageshack.us/img809/238/1220b.png
http://img155.imageshack.us/img155/7401/1221i.png

So is it a security problem or not?

[Filip Havlicek]

As far as I know it's annoying, but not exactly a security issue, it won't do you any harm. What I said still applies.

Filip

[Lisandro]

I don't think avast should prevent the installation.
Reporting, maybe.
The better would be find a way to block them using the firewall.

[cooby]

Tech, I agree.
I don't ever want automatic deleting or automatic prevent installation. Silence isn't too good. Delete/Ignore/Allow - that sort of choices would be nice.
Not sure how it would work using a firewall - you'd have to enter a new app first into the rules? Or are you suggesting that pushed ads should be blocked in the firewall - hmmm, not a bad idea.

[Lisandro]

Firewall should have (if possible) a way to rule the accessed IP and not an application rule, i.e., if the IP is related to ad it is blocked, not the application itself.

[reinhardholzner]

in beta FW you can create IP based rule!

[cooby]

Gentlemen, I hear you loud and clear. I know you can exclude by Custom rules.
But think about it. I'm downloading something unknown. Avast doesn't make a peep, according to post#2 in the thread I showed a link to. So:
1. How am I to know that junkware will come over soon as I run an application?
2. How will I know what IPs they use. Even if it's one IP, which is unlikely with that type of people.
Having seen post#2, I can, if I want to, look up through Windows what the IP is for those domains, then add the IPs to the hosts file on the Thrive. Well, that's a bit of work especially with multiple IPs, isn't it, and unlikely to do the job anyway.

I must be missing something big time, so please, clarify.

[MWassef]

Hi,

no, I'm afraid not. We didn't have it, users complained, so we added it, users complained even more, so we removed it again. We might add it again in the future

Filip

you add or remove things according to users?!!
So if someone likes a malware and writes to you complaining from adding it to your db so you simply remove it!!

[Lisandro]

About handling anti-ads tools see: https://forum.avast.com/index.php?topic=105616.msg850978#msg850978

[Filip Havlicek]

you add or remove things according to users?!!
So if someone likes a malware and writes to you complaining from adding it to your db so you simply remove it!!

The problem is those were not really malware. (Actually that's the whole problem with "airpush" and other ad networks.)

Filip

[Lisandro]

The problem is those were not really malware. (Actually that's the whole problem with "airpush" and other ad networks.)

Sure. We're asking for an extra feature: scan/manage or even block ads...

[Filip Havlicek]

I know, just saying we don't have time to do it now = surely won't happen this year unfortunately.

Filip

[polonus]

One could install: https://play.google.com/store/apps/details?id=com.brosmike.airpushdetector&hl=en

polonus