When will Avast! support immediate USB drive virus scan?

[soneil]

This morning a colleague handed me a USB memory stick. Without thinking, I inserted it into a USB port on my computer (Windows Vista SP1). When the AutoPlay options came up and offered running "deskinf.pif," there was a split second where I thought it was odd but then shrugged it off because my colleague is a Mac OS X user and they always have funnily named files (like "DS_STORE"). I selected the option to browse the drive instead.

Within 20 seconds, I lost my external hard drive, a LaCie 1 TB Big Disk that had just about 500 GBs of data representing many, many months of work and years worth of accumulated data. Turns out, "deskinf.pif" whether you click on it or not, is a variant of W32.Xema.A, a worm that attacks removable drives. Not only did the functionality of your programme - the latest "professional" release, I might add - NOT protect me as a user from known security risks but your virus definitions - again, the latest - didn't even trigger an alert.

Your virus information feature doesn't even list this worm or variant (it does list a AA). Symantec offers this information:

http://www.symantec.com/security_response/writeup.jsp?docid=2007-061111-4435-99&tabid=2

The damage is pretty bad - painful, in fact. To say it could've been worse is to think the unimaginable but because I'm running Windows Vista instead of an earlier version of Windows, the worm was unable to completely intrude my system drive and registry. But all of my virtual machines, music libraries, video editing projects and things I can't even remember at the moment are GONE. I am currently in the process of running TestDisk and if that fails to restore any data I'm going to run R-Studio but my experience with these types of "data recovery" programmes is mostly that they give you some time to accept the loss. I've never actually had any data restored by them.

I noticed when searching the forums on this topic that less than a month ago when asked the same question by a user who'd recently recommended to their boss that they deploy Avast! on their network - as I did over a year ago - that the collective reply from Avast! was "No, we don't support that functionality. We blame Windows. Disable AutoPlay." Well, I'm not sure that would've prevented infection on my computer this morning since your scanner didn't even recognise the signature of a virus that has been in the wild for close to a year. Also, I opened the drive not the file - which wasn't even visible on the drive, save for its entry in the AutoPlay options. I really would've expected a more pro-active response from Avast! especially since this functionality exists in the latest versions of McAfee and Norton. I should think any developer of a virus scanning application would be thrilled to discover a new threat so they could add a useful feature to what is mostly a bog standard feature set throughout the industry. I already have to deal with minor malware infections on my network that Avast! recognises but doesn't remove - perhaps another rough edge that puts a dent in your promotion of a "professional" edition.

A virus scanner that works 98% of time I suppose is fine until you enter the 2% zone of time when it doesn't work and you're f*cked. Personally, I think the value of that scanner is pretty much based on the 2% of the time.

So when is Avast! going to offer functionality that immediately scans a USB drive when it is inserted into the computer, hopefully with the option to exclude certain drives either by drive letter or serial number?

And why wasn't "deskinf.pif" recognised by your scanner?

As a pro license home user and a 20-seat small business user whose licenses are up for renewal within the year, I await a meaningful response.

Regards.

[Lisandro]

Lack of detection... shame.
I know it's not an official answer, but you can check this to scan USB drives while inserted: http://blog.didierstevens.com/programs/usbvirusscan/

[igor]

I'm afraid it happens sometimes - no antivirus detects everything these days.
If you could send us the sample of this malicious file (deskinf.pif), I'm sure the virus guys will be happy to add the detection.

Regarding the rest - no, it wouldn't change anything. avast! resident protection (the Standard Shield provider, in particular) scans all executed files - no matter if they're started by AutoPlay or manually, from hard disk, USB drive, diskette, network... all the same. So, if the resident protection didn't stop the execution, no automated scanning of inserted USB drives would change anything here (and vice versa - if the executed file is stopped by the resident protection, there's no need for additional scanning either).

So, for the question "when" - I'm not aware of any such plans. Of course, it may be reconsidered, but I don't think this feature would really add much value. USB drives are usually pretty slow, so the scanning would take quite a while, and it would scan the whole drive, while you may be only copying a few images taken from your camera - and it wouldn't detect anything else than the usual resident protection.
(Btw, what would be excluding drives by their serial numbers be good for? I mean, what kind of drives exactly would you plan to whitelist?)

[soneil]

Thanks for the replies, guys. I guess that's more or less a failure of detection then.

I'm going to see about sending you the malicious file. I need to check the submission requirements first and I think if I disconnect all of my removable drives I should be able to get it submitted. The payload is really for every flavour of Windows, save Vista, so I'm thinking as long as my removable drives are disconnected, I should be all right. I do want to get it submitted so that other Avast users can be protected from this kind of devastating loss of data.

I did read the thread on Didier's USBScan but I haven't been able to get the start.bat script to work yet - I'm still playing with it. In his script it seems like you can select drives via drive letter and he also captures the volume serial number so I just thought that would be a way to provide some user customisation. I would whitelist my own LaCie 1 TB external drive because I scan it regularly and manage all of the data transfer myself - I wouldn't need it scanned every time I connect and disconnect it to reconfigure my hardware setup.

Anyway, thanks again. I appreciate your comments on the subject. It does seem that if an independent developer like Didier can come up with this functionality, a software company like Avast could offer the same to users (esp. since USBScan isn't exactly user friendly). It would be a valid addition to the feature set. I mean, you may have noticed from the age that we live in that most "security" is pure theatre anyway so...it couldn't hurt. 

[Dwarden]

what exactly and how You lost Your drives ? did the worm erased it, encrypted them or was there some other failure in the worm code causing it ?

if it was just damaged / erased You may try one of these tools http://www.runtime.org/data-recovery-products.htm

but remember in moment there are data written into drive in question You most likely render it unfixable
so always rescue the data to new physical drive with enough free space

btw. i see no point to 'demand' USB specific scanner because there is no difference from 'scan drive' nor from 'resident scanner on execution or if You use manual settings even other file operations'

the only problem is 'marketing' where firms let people think that 'such automatic USB scan' results into safer enviroment ...

actually even if there is software security with own 'virtual heuristic analysis' it may fail and allow something bad executed via autoplay
same goes for HIPS it may pass the rules (dropper with hidden later real threat)

atm only safe solutions are :
- disable and prevent completely automatic play
- virtual 'box/machine' w/o write access to any sensitive data

[RZPogi]

when inserting a flashdrive on your pc, be secured. open my computer in windows already and once the usb flashdrive is detected, right-click and select scan X:/ (X just represents what drive does the flashdrive appears on your pc) I never been infected from flash drive to pc because of this. the viruses just get stuck in the flashdrive and never infects my pc. I just let avast delete those viruses.

[soneil]

what exactly and how You lost Your drives ? did the worm erased it, encrypted them or was there some other failure in the worm code causing it ?

...

You know, I've suffered major data loss - close to 500 GBs worth of relevant data. I don't really care to hash over this. If you're interested in the payload, click on the link I've provided above from the Symantec Virus Encyclopedia.

Also, the AutoPlay feature really had nothing to do with it outside of identifying the name of the file "deskinf.pif" which was presented as an option but not selected. (I believe it was residing in the \RECYCLED folder on the USB memory stick.) To the best of my knowledge, the worm is not detected by Avast so no amount of pro-activity would've prevented the infection, save not inserting the drive at all.

[Lisandro]

the worm is not detected by Avast

This is the problem... this is what concerns to all of us :'(