Avast failed me

[Lucifer66]

I have been using the free edition of avast for just over a year now and thought it was working pretty well until yesterday. I tried to email a file to someone and it was rejected because there was a Trojan (Tool Win32:LamBot) attached to the file. I thought "How could that be?...I have avast and it's been installed on this brand new machine since day one with auto updates working." In fact as I pondered this it auto updated right then.

So I scanned the file with avast and nothing. Scanned the entire folder, nothing. Scanned the entire hard drive, nothing. Scanned my entire system, nothing. After that I went and did an on line scan with...well let's just say another brand and they found some 30 viruses and Trojans that avast had failed to protect me from.

So what's the deal? Is it that you only get real protection if you buy the full version? Or is it that avast just can't get the job done, not to be rude about it, but seriously I can't go into battle with a paper shield and think it's made of the finest hardened steel. Hope you understand my point. Sure I know it's free, but if it's not going to afford me the same protection as the paid version you should call it "The free but useless version that will only stop a few viruses...maybe" or something like that, because right now I'm not very inclined to purchase the paid version if it's just a more colorful and costly paper shield.

[Gopher John]

Avast Free has the same protection against malware as the paid versions.

You should upload the file that you tried to email to http://www.virustotal.com/ and post the resulting URL to the results of that site here.  This will indicate which of more than 30 antivirus programs think that it is a virus.

FWIW, there are a lot of phony scanning sites that are nothing but FUD.  Without posting the URL you used to scan, there is no way to tell if you visited a reputable site or not.

[Lisandro]

So what's the deal? Is it that you only get real protection if you buy the full version?

No, the security level (protection) is not dropped in the free version.
Just that a software is not perfect (you won't find this product to buy wherever you go...).
Who "rejected" the email? Your friend's provider? avast in your computer?

[DavidR]

Well to start with there isn't any information that can really help.

If there was an attachment on the email you sent and it was the file you scanned and avast found nothing, it needs confirmation one way or another as currently it is one word against another, so to speak.

You could also check the offending/suspect file at virustotal as suggested and report the findings here the URL in the Address bar of the VT results page.

What supposedly found this infected attachment ?

The detections (virus signatures) are the same in both free/pro versions.
What avast version are you using 4.8 or 5.0 ?

[Lucifer66]

Well I tried to send the file via gmail and it was block and it listed the Trojan in my original post as the reason. I'm afraid I no longer have the file as the other site , Micro Trend House Call (hope the mods don't mind me saying their name here) deleted it and all the other infected files when I scanned my PC with their free scan. I only deal with the major virus protection companies and know there are sadly alot of shady ones that actually put stuff on your computer instead of removing anything.

I'm not looking to insult or inflame avast makers, I have been using their free version for a while now and I like it and appreciate they make it available, however I really need to know it actually is going to work and not leave me having to bounce around getting scans all over the web just to keep my PC clean. To be honest, I don't think you should have to have more than one virus scanner. Besides the fact that you can't install more than 1, you shouldn't have to go elsewhere to find out whether or not the one you have is functioning properly.

I guess what I'm trying to say is avast should have detected all those files and maybe they need to look at ways to improve it. Like how could it miss anything if it's updating properly and I scanned the file myself? Maybe something I had interfered with avast's operation and ability to detect viruses and therefore when it updates it should check functionality at the same time. Maybe it should check outgoing files as well as incoming files. I'm no expert by any means, but perhaps there are some areas that could stand improvement in the program.

[DavidR]

The point is we can talk about this till we are blue in the face and we won't know which is correct, avast didn't detect it or the other detection was a false positive.

That is why we have suggested uploading to virustotal as that currently has 41 different scanners and that will confirm one way or another and then we can do something about it.

You also have to consider your past experience and not a single issue as no single AV is going to give you 100% detections. So if you are going to jump ship on every missed detection, you aren't going to stick with an AV for very long.

[randunyogo]

No antivirus solution is perfect like DavidR said. I don't suggest using Trend Micro, it has many false positives according to an AV-Comparatives test. (I'm not bashing on Trend Micro just poiting something out.) Next time you should upload to Virustotal and use a better scanner like Malwarebytes to check.

[Lucifer66]

OK then I got a full scan running from housecall as we speak and it's found 12 more viruses that avast has missed. As soon as the scan is complete I will post the results. So then, do any of you work here at avast?

[Dch48]

I ran the housecall on my system and it found nothing. As others have said though, Trend Micro, and Housecall itself, has a track record of giving many false positives. I remember a number of years ago when Housecall wanted to delete the file that told my Norton AV whether it was genuine and needed updating or not. Luckily, I knew enough to Google the file in question and find out what it was before I made the mistake of letting Housecall nuke it.

[Pondus]

I recomend you install and run Malwarebytes
http://filehippo.com/download_malwarebytes_anti_malware/
after install run update so you are scanning with latest database
run quick scan and click the remove selected button to quarantine anything found
post the scan log here

[Lucifer66]

Ok here are the links to the files House Call found that Avast missed. It found more but as it turns out they were more copies of the same ones so no need to post duplicate links.

http://www.virustotal.com/analisis/4103c4d4931b3f54f6924144f21ae321a281f87d851eecaf5eac67b817134e66-1269342821
http://www.virustotal.com/analisis/137fe71984eb52f8e8ed94f33d887143629c976898e60b153d4066eb5fda5adb-1275594536
http://www.virustotal.com/analisis/ebf499ee29384cf6febee35fa4c2b6afd8559f51ae83e22ee3120109c8472d08-1274907057
http://www.virustotal.com/analisis/98772ed97782692c9a3eebfe5a8d9f0fb55cbeded5868ddf67cb7e00a59d96ba-1269462371
http://www.virustotal.com/analisis/75af93a11306be052213fdea81c60680e3038e8eeeb5a9ca3b9f9ffdbb127aa2-1273418832
http://www.virustotal.com/analisis/98e4497de65ea40e0dc7f3f595bed3e8602ea39ac3a71a2ed8b39d5771938e1c-1270049332

[PapaSmurf]

quick question for you...
Do you use mIRC? Or any of its' variants?

I have researched the results.
This amount of contamination is something that I have seen thru irc chat clients.
Basicaly, it goes something like this.......
IRC or a variant is allowed thru the scanners....
A script is installed into the irc client, either for music or color or op control, ect...
Unknown to the user, the script opens a door from with-in irc and installs keyloggers and other parasites into the system. Because IRC was allowed, the scanner may not capture the events taking place.

[SafeSurf]

I'm not an expert on reading the results of all these VT samples, esp. ones that you gave us from back in March and earlier in May.  The May results are more encouraging at least.

You need something more recent.  I suggest what Pondus recommended to you already:

Install and run Malwarebytes http://filehippo.com/download_malwarebytes_anti_malware/

After installing, run update so you are scanning with latest database.
Run Full scan and click the remove selected button to quarantine anything found.

Post your scan log here (cut and paste your log into the forum thread).

[SafeSurf]

@ Papa, sorry I didn't see your post while I hit click to post...my fingers were too quick.

[DavidR]

OK then I got a full scan running from housecall as we speak and it's found 12 more viruses that avast has missed. As soon as the scan is complete I will post the results. So then, do any of you work here at avast?

All of the people responding in your topic here are avast users like yourself and don't work for Avast Software, just trying to help other avast users.

Blowfish is a commercial key logger, so does that ring any bells for you (?) as many will flag key loggers of any kind, commercial or otherwise. The biggest problem is intent, who installed it, etc. and that isn't something that an AV can determine.

It is also associated with encryption, again does that ring any bells ?
What was the location it was found in ?