Author Topic: Is Avast Immune to attack (Read 4822 times)

kanga2cool · « **on:** February 15, 2004, 02:43:51 AM »

Hi could the Programmers tell me, is Avast AV Immune to attack by some Viruses. I no some Virus can shut down AVs, I read that Panda AV has a built in system to stop this from happening. Dose Avast, if not will it be added in the future.
Thanks for your reply have a nice day.

Eddy · « **Reply #1 on:** February 15, 2004, 06:14:45 AM »

In a way you can say all av software progs can protect theirselfs, but you must at least have the on-access scan enabled so it will intercept a virus when is enters your comp. Also scan everything you download before opening/using it. In this way you could say avast is 'inmune' to virusses. Ofcourse you have to make sure you update the avs on a reguarly base. If av software get's infected/disabled this is mostly a error from the user who did not setup his protection correctly.

kanga2cool · « **Reply #2 on:** February 15, 2004, 06:44:52 AM »

First thanks for your, But even the best AVs with all setting on and up to date can let a new Virus in so I think it would be good if the Avast AV could do a self test on its self first I am not sure how Panda is set up but the AV files may be encripted.
Thank again have a nice day.

Waldo · « **Reply #3 on:** February 15, 2004, 12:01:01 PM »

NO Avast is not umine to a remote shutdown.

If a AV killing trojan like Beast 2.05 (modified versions) gets past your resident shield > Avast services will be shutdown when it succesfully injects in your system.

To protect against remote shutdown you need a kernel driven module implented and desgned especialy to prevent these shutdowns. This is NO easy task to program.

You can use in the meanwile the freeware "process guard" to protect your Avast servives against ALL known attacks.

http://www.diamondcs.com.au/processguard/index.php?page=download

more information on this thread :

http://forum.avast.com/index.php?board=1;action=display;threadid=2376;start=msg17407#msg17407

Waldo

Vlk · « **Reply #4 on:** February 15, 2004, 02:56:02 PM »

BTW, there is not such thing as 100% protection against shutdowns, if the potential Trojan can run under administrative account (e.g. in the context of your account, and you're an 'admin').

I'm aware of many attacks that even ProcessGuard cannot prevent, and is actually quite likely that it will never be able to. My oppinion is that ProcessGuard is a nice try - but its usability is a bit overestimated.

Just my €0.02

Vlk

Waldo · « **Reply #5 on:** February 15, 2004, 06:13:33 PM »

Quote from: Vlk on February 15, 2004, 02:56:02 PM

BTW, there is not such thing as 100% protection against shutdowns, if the potential Trojan can run under administrative account (e.g. in the context of your account, and you're an 'admin').

I'm aware of many attacks that even ProcessGuard cannot prevent, and is actually quite likely that it will never be able to. My oppinion is that ProcessGuard is a nice try - but its usability is a bit overestimated.

Just my €0.02

Vlk

Like i said before > Process Guards offers good protection against ALL known attacks used by malware.

Offcourse there are ways to shutdown services & processes that PG can't cope with...but there not used yet by malware...maybe at this moment of writing there all already people working at ways to bypass PG and its .dll injection protection. maybe not...who will tell

Waldo