[Solved] Win32.Bagle not detected by avast

[bob3160]

I sincerely how we don't have to go through this kind of action to achieve a result.

I think exactly the same.

These aren't results to be proud of. We've hassled Microsoft for less severe infractions.
The success and quality of an Anti virus program is measured by how quickly it reacts
to a new infection.
I'd call this reaction totally unacceptable and it has to be greatly improved if avast!
expects to remain a leader in this industry.
Sorry folks but that's my opinion. 
 

[DavidR]

I sincerely how we don't have to go through this kind of action to achieve a result.

I think exactly the same.

<snip>
I'd call this reaction totally unacceptable and it has to be greatly improved if avast!
expects to remain a leader in this industry.
Sorry folks but that's my opinion. 

And I believe that of virtually all of those who have contributed to this topic, it is totally unacceptable and not being able to contact anyone only makes it even worse.

[sasin44]

well something is better than nothing I GUESS...
avast 754-0 still does not detect the root kit,rpcc.dll infecton,torjan obsfuscate,and poison ivy infection

should we satisfied with avast's under achivement?
i guess we are setting the bar very very low guys response time 8 days to u couple of months ??
YEAAAAAAH

[Dwarden]

anyway , this week is bit problem as there are national holidays (Thu and Fri) so i guess whoever could took 'off' in Alwil ...

so any non critical malware gets 'delayed' ...

i agree that completely new system for malware submission is needed
i know it's in work ... but that i was told 1.5 year ago too...

more and more my customers abadon avast! either for free Avira AV PE or AOL AVS etc.
or paid versions of KAV

lot of firms refuses to use Avast! Pro/Server because of 'slow' response to discovered stuff (answer which i got when asked why)

i'm sad cause of this ... but this is something i can't change

[bslorence]

FWIW, I opened a support ticket with Avast and linked to this thread and a few others in my ticket. The ticket was specifically about the problem detecting the "postcard" virus, but I mentioned the frustration that was being expressed on the forum in this and other threads. According to the ticketing system, I posted the ticket at around 1AM Czech time, and got a response at 17:43 the same day. Here is the text of the response:

Hello,

Yes we know about this problem with ecard.exe - the main problem is that there is every hour new mutation of this virus and adding of the string is not much effective. We are now working on some polymorfic detection of these ecards. I hope you will be seeing the result in very near future.

Try to scan sample submitted by you with avast with updated VPS database and if avast cant detect your sample, please attach it in password protected archive with password "virus" without qoutes.

By the time I received the response Avast was detecting the latest copy of ecard.exe that I was able to obtain.

I will use the ticket to follow up on the frustration topic.

[DavidR]

Thanks for the feedback and for your effort in helping to draw attention to this problem.

[Lisandro]

i agree that completely new system for malware submission is needed
i know it's in work ... but that i was told 1.5 year ago too...

We can live of promises...

We are now working on some polymorfic detection of these ecards

Well... isn't it time to think on a generic detection method called 'heuristics'?

[sasin44]

hi guys "windows blinder".
when i clicked on a .exe it warned me that the file wa going to be deleted after excution ? so i cancled it bu the file was deleted anyway??

[mauserme]

Well... isn't it time to think on a generic detection method called 'heuristics'?

http://forum.avast.com/index.php?topic=108.msg426#msg426

In my opinion, in present time heuristics is just a marginal technique whose importance rapidly decreased when most of the AV's made their databases so good that they actually contain virtually all the virus samples. And with avarage response times in the magnitude of hours rather than days/weeks, the need for generic detection without a record in the virus database went down, too...

Vlk

I was not an avast! user when Vlk posted that.  Was the avast! average response time really hours, or did this mean the average for all AV's?  If it meant avast!, what went wrong?

[FreewheelinFrank]

...what went wrong?

http://www.f-secure.com/weblog/archives/archive-052007.html#00001198

[mauserme]

The graph?

Sure, but others face the same increase while maintaining a quick response time.

[Lisandro]

...what went wrong?

http://www.f-secure.com/weblog/archives/archive-052007.html#00001198

How many viruses or malware exist in general? Can you give me some number?
The approximate count is now over 300,000.

So, what will we expect for the future, the curve is just saying signatures won't be able to follow the rush of virus makers... :'(

In my opinion, in present time heuristics is just a marginal technique whose importance rapidly decreased when most of the AV's made their databases so good that they actually contain virtually all the virus samples. And with avarage response times in the magnitude of hours rather than days/weeks, the need for generic detection without a record in the virus database went down, too... Vlk

Well... I can't believe he thinks as the same as when he posted that...

[DavidR]

In my opinion, in present time heuristics is just a marginal technique whose importance rapidly decreased when most of the AV's made their databases so good that they actually contain virtually all the virus samples. And with avarage response times in the magnitude of hours rather than days/weeks, the need for generic detection without a record in the virus database went down, too... Vlk

Well... I can't believe he thinks as the same as when he posted that...

I doubt that too, 4 years is a lifetime in IT and virus development.

Though it isn't that long ago that Heuristics was discussed and the flavour was Generic signatures rather than heuristics.

[FreewheelinFrank]

Sure, but others face the same increase while maintaining a quick response time.

I read recently that Kaspersky virus analysts burn out after a year because of the constant pressure of the job. Perhaps Alwil doesn't want to lose its analysts in this way.

I've also read reports from other AV companies of the problems of the constant flow of new variants which have to be added to detections.

This situation must be more difficult for the smaller players, and my impression is that avast! is a bit overwhelmed at the moment. Certainly the virus submission system could and needs to be more efficient. I suspect more virus analysts are needed.

My own advice (if anybody wants to take it) would be to make the pricing of the home addition more affordable: at the moment it is not attracting home users to buy the product. The other two companies which offer free AV's have a much more attractive pricing policy, which no doubt leads to home users buying the pay product, hence allowing investment in virus analysts.

avast! Approx £30 inc. tax (1 year)
AVG Approx £30 inc tax (2 years) (Further reductions available on Amazon.)
Avira Approx £14 inc tax (1 year)

[Lisandro]

Though it isn't that long ago that Heuristics was discussed and the flavour was Generic signatures rather than heuristics.

But slow generic signatures won't help... we need immediate heuristic analysis with the risk of false positives, imho.