Author Topic: No reply from Avast re undetected virus  (Read 5393 times)

0 Members and 1 Guest are viewing this topic.

robfo

  • Guest
No reply from Avast re undetected virus
« on: December 27, 2007, 05:13:04 PM »
emails to virus@ Avast .com 12/17 and 12/21 re: ddosattacker and expedit - no reply. I need to know if there are remaining traces of the virus and if Avast can supply a cleaner. I scanned the .zip file containing the 2 viruses before unzipping. No virus reported. I found entries in c:\windows\system 32 for the two. Removed them and there was no further problem. A simple nuisance type infection. An on-line scanner found infections in System Volume Information.
Please advise how to contact tech support.

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 86950
  • No support PMs thanks
Re: No reply from Avast re undetected virus
« Reply #1 on: December 27, 2007, 05:25:01 PM »
avast normally only reply if they require more information.

Did you zip and password protect the sample ?

Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.

The detection in the System Volume Information, is less of an issue as this is usually a file which has previously been deleted from one of your system folders (possibly malware) and system restore has save it in a restore point. If however, you used system restore in the future it could establish it again.

I would normally suggest you confirm the detections using multi engine scanners.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here. I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently over 30 different scanners.
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. Whichever scanner you use, you can't do this with the file in the chest, you will need to move it out.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.9.6034 (build 22.9.7554.734) UI 1.0.728/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

robfo

  • Guest
Re: No reply from Avast re undetected virus
« Reply #2 on: December 28, 2007, 06:08:30 PM »
avast normally only reply if they require more information.

Did you zip and password protect the sample ?

Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.

The detection in the System Volume Information, is less of an issue as this is usually a file which has previously been deleted from one of your system folders (possibly malware) and system restore has save it in a restore point. If however, you used system restore in the future it could establish it again.

I would normally suggest you confirm the detections using multi engine scanners.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here. I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently over 30 different scanners.
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. Whichever scanner you use, you can't do this with the file in the chest, you will need to move it out.


Sorry for the delay in posting back. I couldn't send virus file, zipped and encoded, because ISP - Cox Cable - returns it as undeliverable. Something in its filters is overly vigilant. My previous, an only, communication to virus@avast.com was answered even though that first email did not contain the suspect file, so I wonder why I have received no reply from avast in the present instance.
Relying on advice from newsgroups, I've concluded that the virus was not a malignant one but only the nuisance type, and deleted the files deposited in win\sys32 when I unzipped the downloaded file. I have given Avast the URL of the website from which someone there can obtain the file expedit.jpg.zip and examine contents.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: No reply from Avast re undetected virus
« Reply #3 on: December 28, 2007, 06:31:03 PM »
I wonder why I have received no reply from avast in the present instance.
They don't answer (automatically). They should answering correcting the database.

I have given Avast the URL of the website from which someone there can obtain the file expedit.jpg.zip and examine contents.
You can post it edited (not a live link) here.
The best things in life are free.

robfo

  • Guest
Re: No reply from Avast re undetected virus
« Reply #4 on: December 29, 2007, 06:10:03 PM »
I wonder why I have received no reply from avast in the present instance.
They don't answer (automatically). They should answering correcting the database.

I have given Avast the URL of the website from which someone there can obtain the file expedit.jpg.zip and examine contents.
You can post it edited (not a live link) here.

12/29/07 Virus Download at:
h--p://w-w.webklik.nl/users/h4cksoldiers/expedit.jpg.zip

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: No reply from Avast re undetected virus
« Reply #5 on: December 29, 2007, 08:42:07 PM »
Thanks for posting.
Indeed, infected.
The best things in life are free.

robfo

  • Guest
Re: No reply from Avast re undetected virus
« Reply #6 on: December 30, 2007, 05:23:35 PM »
Thanks for posting.
Indeed, infected.


Thanks much for examining the virus. Can you please forward that to virus@avast.com for me? As I explained in an earlier post in this forum, my cable ISP (cox.net) returns the email I tried to send with the .zip file attached. Overly vigilant filters. The local Cox office unable to facilitate the send.

As I commented earlier in this thread, my first and only communication to Avast, regarding an apparently false positive, was replied to by Avast with instructions for preparing and sending the suspect file. Since it was not infected, the email went through the system successfully.
« Last Edit: December 31, 2007, 06:04:13 PM by robfo »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: No reply from Avast re undetected virus
« Reply #7 on: December 30, 2007, 06:29:34 PM »
Can you please forward that to virus@avast.com for me?
I won't do it... they should download it and add the signature. I'm an user like you...
Hope they do it soon :)
The best things in life are free.

robfo

  • Guest
Re: No reply from Avast re undetected virus
« Reply #8 on: December 30, 2007, 09:03:16 PM »

I won't do it... they should download it and add the signature. I'm an user like you...
Hope they do it soon :)
[/quote]

Thanks again. I should have known it was a favor not to be asked. Thought you might be an Avast tech person. Don't know if Avast ever looks in on the fora. I'm a stranger here-  this sequence of posts is a first. I asked Avast some time ago to do the downloading - no response. Will try again.

tls

  • Guest
Re: No reply from Avast re undetected virus
« Reply #9 on: December 30, 2007, 09:38:15 PM »
Robfo, since this is a public forum, it would be a good idea to edit or remove your email address from your post (reply #6) to keep it from being harvested by a spambot.   :)