Author Topic: win32: trojan.gen?  (Read 5911 times)

0 Members and 1 Guest are viewing this topic.

Offline Tonanet

  • Sr. Member
  • ****
  • Posts: 349
  • I'm a llama!
win32: trojan.gen?
« on: March 31, 2005, 09:35:17 PM »
Hello guys,

I was looking to the detection list of Avast, and realized that sometimes they detect some malware as win32:trojan.gen, or win32:trojan.gen {delphi or vb}, something like that....

What it means? Its happen when avast found a malware with heuristics? Or its the name that avast gave to it?

Looking in vgrep, you verify that this name win32:trojan.gen is used for a lot of virus that other companies detect too... For example win32:trojan.gen for avast, can be 10,20 or more virus for Avg, or for Virusscan,etc...

Please, can someone clarify to me?

Thanks for you time,

Elminster

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: win32: trojan.gen?
« Reply #1 on: April 01, 2005, 04:35:23 AM »
What it means? Its happen when avast found a malware with heuristics? Or its the name that avast gave to it?
It's the name given by avast.
There isn't an international convention for virus names.
As you posted, some 'translation' list of virus names you can find here: http://www.virusbtn.com/resources/vgrep/
The best things in life are free.

Offline TAP

  • Sr. Member
  • ****
  • Posts: 201
  • I'm a llama!
Re: win32: trojan.gen?
« Reply #2 on: April 01, 2005, 06:38:29 AM »
It's a generic name given by avast! for malware such as trojan-like.

But I still don't understand and have no idea why using too much generic name, why don't give them a specific name. In my malware collection avast! detects so many trojan-like malware as Win32:Trojan-gen [xxx] and I think some of them should get a specific name.

For example, if some Win32:Trojan-gen [xxx] is very hard to remove and cannot be removed by avast!'s general method (delete, boot-time scan, ect.) so what an average users can do? if they don't know the exact name of that trojan.  :(
« Last Edit: April 01, 2005, 06:55:14 AM by TAP »

Offline Tonanet

  • Sr. Member
  • ****
  • Posts: 349
  • I'm a llama!
Re: win32: trojan.gen?
« Reply #3 on: April 01, 2005, 01:02:29 PM »
Yeah, I totally agree.

If the detection is not by heuristics ( So Avast will not have a definition to it) , I see no point in give the same name for different viruses... Different viruses should have different names, so the user can take an specific action to remove a malware that do not leave your machine using just an antivirus as you said...  :-\

By the way, Avast have any kind of heuristics?  ???

Thanks for your time, :D

Elminster

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: win32: trojan.gen?
« Reply #4 on: April 01, 2005, 02:42:10 PM »
By the way, Avast have any kind of heuristics?
Only for email detection (Internet Mail provider and Outlook plugin).
There is not Heuristics for the Standard Shield (and other modules).
The best things in life are free.

Offline TAP

  • Sr. Member
  • ****
  • Posts: 201
  • I'm a llama!
Re: win32: trojan.gen?
« Reply #5 on: April 01, 2005, 06:07:54 PM »

By the way, Avast have any kind of heuristics?  ???


As Technical said and from the statement of the developer, avast! has no so-called heuristics in on-access/on-demand scanner but avast! has some kind of special method to detect unknown malware (especially trojan) and I believe that some of Win32:Trojan-gen [xxx] has been automatically generated by that special method (so-called generic detection) of avast! from time to time.

This is some interesting threat about this topic

http://forum.avast.com/index.php?board=2;action=display;threadid=4979

Hope this helps  :)
« Last Edit: April 01, 2005, 06:10:22 PM by TAP »

Offline Kerim

  • Full Member
  • ***
  • Posts: 105
  • I can resist anything but thinking outside the box
Re: win32: trojan.gen?
« Reply #6 on: April 01, 2005, 06:21:49 PM »
Since 2 days, I am trying hard on the internet to find out what could be the name (or reference) of the win32:trojan.gen {delphi} detected by Avast (0513.1) in the file C:\Windows\spoolsv.exe ! My problem is that the symptoms I have differ from all what I learnt till now about the possible infections that might reside in a spoolsv.exe  ???

http://forum.avast.com/index.php?topic=12420.0

By the way, is there a trusted on-line site to analyze a malware in a file?

Thanks, Kerim

Windows 7, Avast! Pro Antivirus 4.8.1368, SpyBot-S&D, SpywareBlaster.

Offline lee20

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2326
  • The only true failure is when you give up
Re: win32: trojan.gen?
« Reply #7 on: April 01, 2005, 06:31:09 PM »
Quote
By the way, is there a trusted on-line site to analyze a malware in a file?

http://virusscan.jotti.org/

--lee

"Anyone who has never made a mistake has never tried anything new."-Albert Einstein

Comodo Firewall, Avast 4.8, SpywareBlaster, Spybot + superantispyware, PeerGuardian and ALL software patched!

Offline Kerim

  • Full Member
  • ***
  • Posts: 105
  • I can resist anything but thinking outside the box
Re: win32: trojan.gen?
« Reply #8 on: April 01, 2005, 06:38:01 PM »
Thank you... lee16  :)

I can't try it right now because the infected PC is not the one I am working on.


« Last Edit: April 01, 2005, 06:47:17 PM by Kerim »
Windows 7, Avast! Pro Antivirus 4.8.1368, SpyBot-S&D, SpywareBlaster.

Offline Tonanet

  • Sr. Member
  • ****
  • Posts: 349
  • I'm a llama!
Re: win32: trojan.gen?
« Reply #9 on: April 01, 2005, 07:42:36 PM »
Hello all,

Really thanks for the info about heuristics. I didnt know that avast! didnt heuristics, and to be honest, its not a problem for me... :) I think that a guy, called Pavel, said that it doesnt work, and I totally agree with him... Heuristics usually help a lot less than it should... And usually  make the software more heavy resource user... Maybe the fact that Avast doesnt have heuristics is one of the responsibles to make it light in system resources...

Just one more thing, if one day, I found a malware called win32: trojan.gen, should I send it to Avast, so they can analize it and give an specific name, or the trojan.gen is a malware already know by Avast and it is your final name?

Thanks for your time,

Elminster

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: win32: trojan.gen?
« Reply #10 on: April 01, 2005, 08:04:02 PM »
I think that a guy, called Pavel
He'll be honored with the word guy  ;D
In fact, the Webmaster here...  ;)

Just one more thing, if one day, I found a malware called win32: trojan.gen, should I send it to Avast, so they can analize it and give an specific name, or the trojan.gen is a malware already know by Avast and it is your final name?
If you have any doubt, send the file.
Just don't expect an answer for each sample sent... Alwil does not answer to them all... just a few of them can receive this treatment.
Thanks to Karel (the virus analyst)  8)
The best things in life are free.

Offline Tonanet

  • Sr. Member
  • ****
  • Posts: 349
  • I'm a llama!
Re: win32: trojan.gen?
« Reply #11 on: April 01, 2005, 08:46:23 PM »
Hey Technical,

Thanks for your answer.
I didnt realized that Pavel worked here. I hope he dont mind about the "guy" word. Hehehe... It was used in a good meaning.. ;)

Thanks for your time,

Elminster