More and more disappointed

[wetabax]

  - I thought always trust in avast!. Well, I sent allready more as 5 new infected files avast didn't recognize as virus. A week after, ok, avast alerts about these files.
Now, I found two files more, update everything in avast and only kasperksy labs recognize the files as virus.
Kaspersky labs log is:
msnmsgr[1].exe - infected by Trojan-Spy.Win32.Banker.abg
albumdefotos.scr - infected by Trojan-Downloader.Win32.Delf.un

Now I know the computer is infected, but I don't know how to clean it... no tool, no on-line scan, nothing that can normalize the situation.

and... of course, virus@avast.com didn't reply anything to me, regardless I ask for it.

[Lisandro]

Alwil team should listen the users crying here and everywhere to a better detection, submition samples, etc.  :'(
Vlk, where are the great news you've promissed us? 

[DavidR]

Check what is running on your system using HiJackThis also useful as a diagnostic tool - Download HiJackThis.zip - HJT Information HiJackThis Tutorial 1 or HiJackThis Tutorial 2
For an on-line analysis - HiJackThis Log file - On-line Analysis
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.
OR HiJackThis Log file - On-line Analysis 2

Also see - Advice & Tools for virus/trojan/malware Removal & Prevention and Eddy's Website click the "HiJackThis Section" and also the "Malware removal instructions and applications" section, and follow the directions there and get back to us if you need more help....

[Spiritsongs]

  In addition to Avast, I also use the good & FREE "Ewido"
     available from www.ewido.net/en ; it "specializes" in
     detecting and removing trojans,worms,dialers, etc .

[wetabax]

ok. now I'm using 4.6.691 / 0534-3 and this VPS checked both (mentioned in my first post) files correctly as virus.
But, and what about the svchosts files created by the virus? I'm away from the infected computer, but one of this virus creates a run line to svchosts.exe file...
I hope avast! will alert about these files too.

thanks for prompt updating...

[DavidR]

You should be able to se that in HJT and by ticking the fix box it should remove the run command.

[wetabax]

sorry to open this thread again, but only for your concern:

I sent to virus@avast, email below 25/august, and resent 28/august:
[...]
text sent in last message:
25/8/2005 20:38:58
I really don't know what happens with avast, but with avast completely updated, it can't recognize this file as virus, but norton does.
 
Origem: C:\Documents and Settings\Proprietário\Desktop\iexplore.exe
Clique para obter mais informações sobre essa ameaça: W32.IRCBot
[...]

Well, I gave name of the virus, file, password etc.

Only now, in VPS version 535-2, Avast noted that the file is a virus...

And how many posts did I receive from virus lab about all this issue?
none.
 

[Vlk]

So, that means it was added 5 days after you submitted it. What do you dislike about this?

[Omar]

Vlk, didn`t you say that "Lots of things will change soon"?

could you give us some clues as to what this means

[Vlk]

To start, it means the following:

1. we're hiring new people to the virus lab. That should result in (at least) faster response times

2. we're working on a new virus submission system

3. we're making some changes to the structure of the VPS file as well as the processes that generate it.


I can't say much about the exact schedule because I don't directly manage this but it should be a matter of weeks (hopefully).

[polonus]

Hi Vlk,

This is good news, well I think false positives is an important thing here too. Everything has to be checked. That is why it is a time consuming thing.
Isn't it?

greets,

polonus

[Omar]

That is very good news Vlk. This new file submission system-I hope it will mean that samples can be sent online

I hope the new system will mean that samples are added much quicker than before. This will please many people. In addition I hope that all samples are added regardless of whether some are more dangerous than others.

[XMAS]

Well from your word Vlk I understand that there will be a lot of  new thing this autumn 
I am very curious what will be the new virus submission system 

[wetabax]

So, that means it was added 5 days after you submitted it. What do you dislike about this?

Well, Mr Vlk, if it were a new virus and avast! would be the first company to discover it, nothing. But, a virus still added in other softwares, and considered critical, sent to you with virus name, all information needed... I found 5 days a little too much. But maybe I'm wrong.

And sent twice - don't forget!

And no answer from viruslab (e.g.: email received, false positive, critical, danger, hi, goodbye - any word would be a nice word)

[Lisandro]

Well, Mr Vlk, if it were a new virus and avast! would be the first company to discover it, nothing. But, a virus still added in other softwares, and considered critical, sent to you with virus name, all information needed... I found 5 days a little too much. But maybe I'm wrong.

I think you're right... five days is too much for a known virus. Hope others could help on this hard work of making avast! better.

And no answer from viruslab (e.g.: email received, false positive, critical, danger, hi, goodbye - any word would be a nice word)

Ok, you won't... The policy is no automated answers. So, only if you really need an answer it will be sent to you.
Otherwise, the answer is on the VPS update