ALWIL we hope you can get Responsible&Seriously

[bob3160]

about virus detections ... i guess it's all about priorities nows ... there is 1000 times more files to check then 3y ago
and seriously u can't await Alwil to hire 100-100 times more staff 

To keep us safe, I certainly do....

[Maxx_original]

guys, i wrote it to other threads and Dwarden mentioned it also here - the count of virus samples grows and we are working on new submission system, which will make all related things faster... it's nice to catch samples from users in 5 minutes, but that's possible only without internal testing (the scan of cleanset takes a bit more than 5 minutes ) and we must test the detections, simply because we can't release any serious false positive... btw: a new detection of Virut/Cheburgen will be included in next VPS (this is one of the most important detections in last three weeks)

[mouniernetwork]

guys, i wrote it to other threads and Dwarden mentioned it also here - the count of virus samples grows and we are working on new submission system, which will make all related things faster... it's nice to catch samples from users in 5 minutes, but that's possible only without internal testing (the scan of cleanset takes a bit more than 5 minutes ) and we must test the detections, simply because we can't release any serious false positive... btw: a new detection of Virut/Cheburgen will be included in next VPS (this is one of the most important detections in last three weeks)

Good; why is it so important ?
Just curious 
Al968

[Maxx_original]

al968: because of http://forum.avast.com/index.php?topic=30335.0 and ~43000 files from VirusTotal...

[mouniernetwork]

Sorry I meant this
"this is one of the most important detections in last three weeks"

Al968

[Maxx_original]

hah.. the answer was targetted to this question actually... the detection is important because we don't want to let it destroy avast executables (described in the mentioned link) and because it flooded virtotal with ~43000 samples..

[Lisandro]

we don't want to let it destroy avast executables (described in the mentioned link)

Maxx, was this virus written specifically to destroy avast files (or other antivirus too)?
Isn't there another method to protect avast executables? I mean, file protection.

[DavidR]

What would be nice it to see another beta release of the avast self-protection code which was previously beta tested but quietly allowed to die without any update to the code and further trial.

[Maxx_original]

Virut is a generic file infector and avast executables was only a few of its victims... there is some integrity check (avast is able to detect unauthorised modifications of itself), but it is a post-operation..

[Lisandro]

There is some integrity check (avast is able to detect unauthorised modifications of itself), but it is a post-operation.

And why can't avast restore the 'original' files (repair the installation)?
Can't be the file be protected (like system ones into Chest) for restoration?

[mouniernetwork]

What would be nice it to see another beta release of the avast self-protection code which was previously beta tested but quietly allowed to die without any update to the code and further trial.

I definitly second that 

Al968

[DavidR]

There is some integrity check (avast is able to detect unauthorised modifications of itself), but it is a post-operation.

And why can't avast restore the 'original' files (repair the installation)?
Can't be the file be protected (like system ones into Chest) for restoration?

That is certainly something which I feel could be done easily (store in the chest that is) and the integrity checker could call a routine to replace the modified file with the back-up copy.

However, if avast hasn't dealt with the file infecter they will just be modified again.

[igor]

It is already done. avast! setup would detect the unauthorized modification sooner or later (or you can invoke the "Repair" function) and the files get replaced by the original versions.

On the other hand, if the virus is active in the system at the moment, it might hook the file access functions (opening, writing) and infect the files again, right at the moment of the replacement (or, a bit later, of course).

[Lisandro]

It is already done. avast! setup would detect the unauthorized modification sooner or later (or you can invoke the "Repair" function) and the files get replaced by the original versions.

But the user must be able to boot, logon and connect to Internet. Otherwise, the repair won't work. It's not as self-protected as we want or need.

On the other hand, if the virus is active in the system at the moment, it might hook the file access functions (opening, writing) and infect the files again, right at the moment of the replacement (or, a bit later, of course).

And so? How to solve this?

[igor]

My post was a reaction to the previous David's post, nothing more.