Author Topic: Virus Report Form - no option for "not infected"  (Read 2760 times)

0 Members and 1 Guest are viewing this topic.

beerslayer

  • Guest
Virus Report Form - no option for "not infected"
« on: August 12, 2004, 12:53:51 AM »
This is a minor issue, but it bugs me:

On your "Virus Report Form", you ask a user to enter information about a virus which recently attacked his or her system.  I presume you want this information to get some idea of which viruses are prevalent out here in the wild, and where they're hitting.

The problem is that there is no option in any of these questions for "not attacked".  I often receive viruses in my email, but I'm not inexperienced enough to open them and thus allow them to attack me.  Instead, I carefully save them to a quarantine folder, then scan them out of curiosity to see which viruses they contain.

I assume my feedback as to where and what virus I received would be just as useful to you as that of someone who actually got victimized, but I cannot answer the questions accurately and say "I'm not a victim" to any of them!  For example, here are two questions on the form:

How many PC's were infected by the virus?
  • 1
  • 2
  • 3-5
etc.  Where's the option "0"?

Another one:
Did the virus cause damage to data?
  • No, it only infected some files or bootsectors.
  • Yes, but I had a recent backup so finally there was no damage.
  • Yes, I have lost some data.
Where's the option "No, it didn't infect me; I caught it in time."

There are several more questions with similar choices, but I won't list them here.  I'd like to ask you to consider rewording the questions and/or adding additional answer choices to take into account that perhaps the would-be victim foiled the attempted attack before any infection occurred!

Thanks.
« Last Edit: August 12, 2004, 12:56:12 AM by beerslayer »

beerslayer

  • Guest
Re:Virus Report Form - no option for "not infected"
« Reply #1 on: August 12, 2004, 12:00:57 PM »
By the way, and for whatever it's worth, the virus that got me started wanting to send the report was one that I received in my email a few days ago.  It was obviously suspicious, consisting of two files: an executable (.exe) file, and an html file with some javascript code apparently designed to launch the executable.  Yet when I scanned it with avast at the time, it didn't find anything wrong.  I kept it in my personal quarantine folder just for the heck of it... no way did I trust this thing despite nothing being detected by avast.

Two days later (yesterday), I received a data file (vps) update, and afterwards I scanned these files again.  What did I find?  The .html file was flagged as JS.IllWill [Trj] and the executable as Win32:BeagleCraw [Drp].  So obviously these definitions were in the latest data file... :)

That's pretty impressive, and makes me feel good about the quality of updates with Avast.

lee16

  • Guest
Re:Virus Report Form - no option for "not infected"
« Reply #2 on: August 12, 2004, 12:36:51 PM »
beerslayer

If you have a suspicious file that is not detected by avast! , the thing to do is password encript (zip) it, then send it to virus@avast.com for testing.
But make sure you include the password to open the file and any other info you can provide on the file/folder.

--lee