File Sharing Trojan ?

[lee16]

This is very strange, as i (and many others) cannot download a virus/malware because avast warns up, and in the latest version completely stops you.

What browser are you using (is it up to date)
What OS are you using (windows ...)

--lee

[DavidR]

More importantly what are your web shield, Internet Mail and standard shield settings?

[Andyslogos]

Hi
Win 98 & Explorer 6, both up to date.Eveything is set on 'Normal' and the default settings.

I just tried on 'High' setting and Avast now 'alerts' me on the first eicar file (not zipped)  it doesn't on EITHER of the zipped ones.

Also when it alerts on the first it says 'remove to chest' and yet how can it when I havn't even saved it yet ! Anyway which EVER button I click my PC just frezzes on 'file download' and I have to cntrl/alt/delete.

Lastly if I still wanted to download the file, say it was a specific item I wanted and I wished to 'take the chance' and remove the virus later how do you do that ? The only choices it seems to give are move or delete !

At least I know for sure now that it DOESN'T  work when I'm surfing the net !!!!

Andy

'Shutting down' now speak to you later 

[lee16]

Andyslogos,

If i try to download the any of the eicar viruses i get this warning:



If i disable webshield i get this warning with eicar.com (i was to press ok it would let me download it)



However i won't get this second warning with the eicar.zip or eicar2.zip files because they are archived, however if you was to scan them or try to unzip avast it would warn you with the second message strait away 
This is the same for the eicar.txt

Anyway which EVER button I click my PC just frezzes on 'file download' and I have to cntrl/alt/delete.

Are you sure your system is clean?


EDIT: BTW, i have just installed 7-Zip (7z) and archived a malware sample, i can comfirm my original thought that avast can scan 7-Zip archives (unless there passworded of course  )

--lee

[Andyslogos]

Hi Lee
Solved the problem, well to some extent !

In the help files it clearly states that Win 95 AND 98 have to be set up MANUALLY to get the Web Shield to work.
It tells you to use Proxy server and gives you the settings.

After doing that is it scanning now and I get the dialogue box of your first image that you showed on ALL the tests.

MY issue now is DO I WANT to use proxy server ? I'm not really to sure about it but have never used 'them' as there is no point to them and also they keep more info about your 'tracks' Am I 'barking' up the wrong tree and Avast settings have nothing to do with this ? I DIDNT need proxy with AVG.

As for it now scanning thats good but Avast ONLY giving you the choice of 'Abort Connection' in my opinion is ridiculous and not very good programing, as you say you can turn off the shield and close the dialogue box but ,god what a 'drag' Also doing this course of action is sometimes 'upsetting' Avast locking it up and giving me a 'please report bug' box !!

On a final note ,I said 'to some extent' well the new problem is now it's all working I've set it all back to 'NORMAL' settings but when I re boot they've all gone back to HIGH !!!! I cant win!
Hopefully this will sort its self out.

Anyway looks like I'm all 'safe' again 

Cheers
Andy 

[lee16]

Andyslogos,

MY issue now is DO I WANT to use proxy server ? I'm not really to sure about it but have never used 'them' as there is no point to them and also they keep more info about your 'tracks' Am I 'barking' up the wrong tree and Avast settings have nothing to do with this ? I DIDNT need proxy with AVG.

Avast keeps no tracks about you whatsoever, its merely a way to provide even greater protection against malware 

As for it now scanning thats good but Avast ONLY giving you the choice of 'Abort Connection' in my opinion is ridiculous and not very good programing,

IMHO this not true, its in fact very smart, the only time it could become a problem is if you where trying to download a virus/malware on purpose (not to smart), i cant think of a reason other then the eicar test samples that someone who would intentionally infect there system 


--lee

[Andyslogos]

Hi
I didn't mean Avast keeping info on us I meant the 'proxy servers' are they not another route (like a so called short cut) that your internet connection goes through ?

On the Abort 'thing' if it close's a link that youve spent hours trying to find and it happens to have the odd virus but otherwise be fine and you didn't note the address that could be somewhat annoying !(also a site that happens to have a virus one day may not ever have one again !)

As for 'letting' in a virus on purpose once I was looking for a VERY rare piece of freeware, when I found it (eventually) some 'a hole' had put a virus with it.This is such an occasion when you may want to risk letting one in to see if you can safely remove it and keep the file !

THE POINT IS you SHOULD be given the choice and not TOLD what to do, EVERYONE is different and likes things done or works in different ways.A programmer should bare this in mind and try and give ALL possible options for EVERYONE, even nutters like me 

Cheers
Andy

[lee16]

I didn't mean Avast keeping info on us I meant the 'proxy servers' are they not another route (like a so called short cut) that your internet connection goes through ?

Ahh, i see, yes it is 'routed' though it, otherwise how would you scan it 

On the Abort 'thing' if it close's a link that youve spent hours trying to find and it happens to have the odd virus but otherwise be fine and you didn't note the address that could be somewhat annoying

Well it shouldn't close the link, just abort the connection between the malware and the browser.

THE POINT IS you SHOULD be given the choice and not TOLD what to do, EVERYONE is different and likes things done or works in different ways.A programmer should bare this in mind and try and give ALL possible options for EVERYONE, even nutters like me

Well this is something the avast team should answer really, you could ask about this on the 'Avast Home/Pro' board if you wanted: http://forum.avast.com/index.php?board=2.0

They could give you a more clearer answer then me 

--lee

[Andyslogos]

Cheers Lee,Time you went to bed 
Till the next problem,bye 

[DavidR]

MY issue now is DO I WANT to use proxy server ? I'm not really to sure about it but have never used 'them' as there is no point to them and also they keep more info about your 'tracks' Am I 'barking' up the wrong tree and Avast settings have nothing to do with this ? I DIDNT need proxy with AVG.

The proxy is a local proxy so that web pages can be scanned for infection before they reach your browser cache, this works in the same way your email is intercepted by avast, checked and passed on to your inbox. This processing has to take place somewhere.

You didn't need a Proxy with AVG because it didn't provide this level of protection. Checking and email or web page when it has arrived in your inbox or browser cache, may be too late. It is best to catch things early before they get established.

To all intents and purposes Normal and High are one and the same, the real differences are in the customize section.

THE POINT IS you SHOULD be given the choice and not TOLD what to do, EVERYONE is different and likes things done or works in different ways.A programmer should bare this in mind and try and give ALL possible options for EVERYONE, even nutters like me

As far as this goes, avast is probably the most user customisable AV there is, certainly that I have ever used and I've used a few. There is also a thread for suggestions for future releases of avast and the Alwil team are very responsive and proactive about this.

Ultimately you do have a choice, no one told you to use avast, it is about the pros and cons, everything in life is a compromise.