Avast low detection on malware pack?

system · August 23, 2012, 9:06am

I’m only posting what I see, I don’t know how Avast was configured or anything like that and of course these videos aren’t guaranteed.

39 detected from 324 “samples”

hxxp://malwaretips.com/Thread-Malware-Pack-324-malware-samples-by-ReviewsAntivirus-InternetChicken

Apologies if I’ve posted in the wrong place, and remove the link above if inappropriate (but it’s a link to the samples) – if any avast! staff want to have a look.

Was there any reason or just currently undetected, and soon to be added? Just wondering. Thanks

system · August 23, 2012, 9:22am

I have seen some of those files in the archive…you can quickly upload the files to virustotal…they have very low detection rate at VT…i wouldnt expect any good result from avast! keeping in mind many files have low detection rates like 5/42 or 12/42 etc etc…

Btw its a test bed problem…this is the thing that most testers dont notice…

Igor had already specified test bed problems…and this is what it is on this pack…most of them are very very new zbot,FakeAV Samples having low detection rates…So dont expect much.

and so on…most files are of low detection rates.

so still expecting a AV to get 85 to 90% detection for such brand new things from avast or for any other decent AV? I dont think so… ;D

Nevertheless,we dont need to worry because avast will get these files from VT regularly to add to database…most of the time these files come out from particular IP’s that are usually blocked by avast network shield

Hope this was helpful to make you understand.

read this reply: http://forum.avast.com/index.php?topic=76317.msg635067#msg635067

system · August 23, 2012, 11:08am

As I said, I only posted what I saw on Youtube. I’ve never come across this “test bed problem” before, so it’s all new for me.

I also have computers with avast! Free installed and this caught my attention.

Thanks for understanding my post concern.

PS: As for your PM, I wasn’t bashing the product.

system · August 23, 2012, 11:17am

tip: Dont watch tests,believe on only your own personal experience ;D

polonus · August 23, 2012, 12:43pm

Hi true indian,

Now let us just take the first example you provide: http://systemexplorer.net/file-database/file/savings%20sidekick-exe/11006802
Has been around since 1993 and 2008 and file has a shield toleration from Kaspersky’s
Given as safe here: http://www.isthisfilesafe.de/sha1/C92EB4207AA5A2BC8EF9618C0E3C194D253D45BC_details.aspx
Here again given as threat: http://threatcenter.crdf.fr/?More&ID=90990&D=CRDF.Malware.Win32.PEx.C.386825682
Compare to: http://reports.antivirus-lab.com/134128/savings-sidekick/
See: http://minotauranalysis.com/search.aspx?q=e99a5d8064116eeb28eee7db2a497f3f
Flags come in the Heur.Suspicious category, these catches more malware from pirated sites than FP’s found.
Here we have 20 often found on infected websites: http://www.securiteinfo.com/attaques/hacking/stats_malwares_internet.shtml
All come from not trusted mediums as in our example, see the detection of this component: http://speedutilities.com/virus/component_567.html
So detection and risk is found within a certain arena and this is not a general risk,
so good user habits and common sense can grossly prevent you from being affected, going to pirated content (flash drives/USB sticks)
will enhance the risk of running into such so-far undetected malware,

polonus

polonus · August 23, 2012, 4:40pm

Just another one which is not being detected by avast: https://www.virustotal.com/file/ca0c405a571b55406b5d65e59924eae73d5477d54f0046aa042127dffeb648b7/analysis/
Here we had 8 detections: https://threatcenter.crdf.fr/?More&ID=92454&D=CRDF.Trojan.Fakealert-Generic.1414665203
avast detects a similar one here: https://www.virustotal.com/file/4af9bc3d7561c426b83a91560bf9e93d04ff52561a90bae200d512578110ce17/analysis/
Srating from the DrWeb detection: http://v.virscan.org/Trojan.Fakealert.32747.html
and in a lot of virscan results there avast does not appear, avast could have flagged a dropper there,

polonus

Avast low detection on malware pack?

Announcements