Author Topic: The quality of the service of the analysts needs to be improved  (Read 11843 times)

0 Members and 1 Guest are viewing this topic.

Offline Henrique - RJ

  • Sr. Member
  • ****
  • Posts: 247
Hello

I've been drawing some conclusions why some very similar trojans are not detected by avast even if the signature of one of them has been included in the database.

I believe the quality of the service team of analysts is not the best. I have noticed that the detection of trojans bankers by Avira AntiVir is much better than avast. I wonder if it would be the choice by analysts of the line of code that does not accurately characterize the malware.

The names of malware identified by analysts avast are not accurate (example the name "Win32: Malware.gen" given the trojans bankers).

Am I correct ?

There is some expectation of improvement ?

Thanks very much.
« Last Edit: June 02, 2010, 11:19:36 PM by Henrique - RJ »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: The quality service analyst needs to be improved
« Reply #1 on: May 29, 2010, 07:28:25 PM »
I have noticed that the detection of trojans bankers by Avira AntiVir is much better than avast.
Common voice in our country.

There is some expectation of improvement ?
There is always hope :)
The best things in life are free.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9315
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: The quality service analyst needs to be improved
« Reply #2 on: May 29, 2010, 07:29:33 PM »
As far as naming is concerned, there is absolutelys no standard or rule how to name them. Companies could name them "Malware/Virus" or even just "Threat" and that's it. To 99% of ppl, names of the malware families don't mean a thing. If it's Banker or Virut, only one thing is in comon. They want it off their computer.
As for everything else you complained about, i cannot really comment that. Only ALWIL programmers/analysts can answer you to that...
Visit my webpage Angry Sheep Blog

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83014
  • No support PMs thanks
Re: The quality service analyst needs to be improved
« Reply #3 on: May 29, 2010, 07:45:55 PM »
I feel the same way, the name isn't an issue, what is, is that it is detected as I mentioned in the other topic.

The win32:Malware-gen is a generic detection designed to catch multiple occurrences of a type of malware, so long as it makes the detection, the name given is totally unimportant as there is no standardisation/convention in malware naming.

You will see this when you do a virustotal check and you will see the many different aliases given in detections across the 42 different scanners.
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline Henrique - RJ

  • Sr. Member
  • ****
  • Posts: 247
Re: The quality service analyst needs to be improved
« Reply #4 on: May 29, 2010, 07:50:51 PM »
As far as naming is concerned, there is absolutelys no standard or rule how to name them. Companies could name them "Malware/Virus" or even just "Threat" and that's it. To 99% of ppl, names of the malware families don't mean a thing. If it's Banker or Virut, only one thing is in comon.

But the nomenclature is important to tell what type of malware is and what does.

There are cases where the name indicates a type of malware when in fact it is another kind.

Offline Henrique - RJ

  • Sr. Member
  • ****
  • Posts: 247
Re: The quality service analyst needs to be improved
« Reply #5 on: June 02, 2010, 11:15:13 PM »
No response of the one malware analyst ?

I have two similar trojans to prove what I say.

This question seems very important.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 64658
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: The quality service analyst needs to be improved
« Reply #6 on: June 02, 2010, 11:24:55 PM »
I have two similar trojans to prove what I say.

So, did you send them to avast yet..??
Meanwhile all AV companies (kind of) depend on users feedback..!!!
asyn
Win 8.1 [x64] - Avast PremSec 20.4.2408.B#3 [UI.520] - CC 5.65 - EEK - FF ESR 68.8 [NS/AOS/uBO/PB] - TB 68.8.1 - ASB/ACP/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Henrique - RJ

  • Sr. Member
  • ****
  • Posts: 247
Re: The quality service analyst needs to be improved
« Reply #7 on: June 02, 2010, 11:34:11 PM »
So, did you send them to avast yet..??
Meanwhile all AV companies (kind of) depend on users feedback..!!!
asyn

Already sent have a few days.

One is already detected by avast not the other.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 64658
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: The quality service analyst needs to be improved
« Reply #8 on: June 02, 2010, 11:49:15 PM »
Already sent have a few days.
One is already detected by avast not the other.

Great, thanks for submitting...!! :D
Let's hope the other one will also be detected soon...
asyn
Win 8.1 [x64] - Avast PremSec 20.4.2408.B#3 [UI.520] - CC 5.65 - EEK - FF ESR 68.8 [NS/AOS/uBO/PB] - TB 68.8.1 - ASB/ACP/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Henrique - RJ

  • Sr. Member
  • ****
  • Posts: 247
Re: The quality service analyst needs to be improved
« Reply #9 on: June 03, 2010, 12:01:05 AM »
Great, thanks for submitting...!! :D
Let's hope the other one will also be detected soon...
asyn

Because the Trojans are similar since they must all be detected and not just a.

Therefore to say that the service quality of analysts needs to be improved.

This also occurs with AVG (Grisoft).

If there was quality in the analysis the cracker could create several trojans that all would be detected by the same signature.
« Last Edit: June 03, 2010, 12:09:13 AM by Henrique - RJ »

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 64658
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: The quality service analyst needs to be improved
« Reply #10 on: June 03, 2010, 12:11:37 AM »
Because the Trojans are similar since they must all be detected and not just a.
Therefore to say that the service quality of analysts needs to be improved.
This also occurs with AVG (Grisoft).
If there was quality in the analysis the attacker could create several trojans that all would be detected by the same signature.

You should never rely on one security solution. Never ever..!!
A layered protection is the ultimate secret..!!! ;)
asyn
Win 8.1 [x64] - Avast PremSec 20.4.2408.B#3 [UI.520] - CC 5.65 - EEK - FF ESR 68.8 [NS/AOS/uBO/PB] - TB 68.8.1 - ASB/ACP/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Henrique - RJ

  • Sr. Member
  • ****
  • Posts: 247
Re: The quality service analyst needs to be improved
« Reply #11 on: June 03, 2010, 12:18:08 AM »
You should never rely on one security solution. Never ever..!!
A layered protection is the ultimate secret..!!! ;)
asyn

I just want that avast is as good as Avira AntiVir in detection.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 64658
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: The quality service analyst needs to be improved
« Reply #12 on: June 03, 2010, 12:31:53 AM »
I just want that avast is as good as Avira AntiVir in detection.

I don't care about Avira...!
If you want maximum detection rate use Emsisoft AM.
But I guess we (users of avast) all like it to be the best and imo it is the best AV, otherwise I (and many others) wouldn't use it..!! ;) Nevertheless, as already said, don't fully rely on it, protect your browser at first level and get a second opinion with an antimalware like Mbam or A²...
asyn
Win 8.1 [x64] - Avast PremSec 20.4.2408.B#3 [UI.520] - CC 5.65 - EEK - FF ESR 68.8 [NS/AOS/uBO/PB] - TB 68.8.1 - ASB/ACP/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline kubecj

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1123
    • ALWIL Software
Re: The quality of the service of the analysts needs to be improved
« Reply #13 on: June 04, 2010, 11:41:49 AM »
1) Please check the photo, which comes from F-Secure's blog from CARO 2010 conference:


From our internal testing it seems that in day 0, the best AV gives you maximally 60-70% protection by the signatures. This is not an excuse, this is an explanation why you may see what you see. I could as well show you many samples missed by antivirus X, in the very same way.

2) Nomenclature does not exist, and while you're getting 50 000 new samples a day, it's nonsense to spend time and resource with naming something which will be extinct tomorrow. Also, from our tests it sometimes seems like these names are assigned by random generator.  8)
Jindrich Kubec

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: The quality of the service of the analysts needs to be improved
« Reply #14 on: June 04, 2010, 02:31:43 PM »
From our internal testing it seems that in day 0, the best AV gives you maximally 60-70% protection by the signatures. This is not an excuse, this is an explanation why you may see what you see. I could as well show you many samples missed by antivirus X, in the very same way.
So, how to be protected by day 0 attacks? Which is your suggestion side by side with avast?

naming something which will be extinct tomorrow
Solution for the 50.000 new malwares per day?
The best things in life are free.