report samples : angry !

Viruses and worms
1

Hi,

I always report samples (eset, avast, comodo etc…)
I have report more 500 mo, 15 days after i have a reply…but after 1 month …not detected… Eset add in the day.

Friday, i have get spam in my phone with bad APK, i have report immediately, more 24h ago not detected…

I have 4 computer with avast premium an my phone…i paid, someone work in avast ?
Why more 1 month for add samples ?

i report :
https://support.avast.com/Tickets/Submit/&cls04&ptf01&lic04&scr05 and virus [at] avast [dot] com

Please can ou do your job ?

ticket :
TQQ-624-26535 08 September 2015 01:56
more 500mo…

Processus: 6 PUP.Optional.Nosibay, C:\Documents and Settings\Laurent\Application Data\Nosibay\Bubble Dock\LBubble Dock.exe, 156, , [fd129c911378b58136e51783ab5a8f71] PUP.Optional.PayByAds, C:\Program Files\Pay-By-Ads\Yahoo! Search\1.3.26.12\dsrlte.exe, 868, , [59b6f43997f4bb7b9438cf8943bd30d0] PUP.Optional.Loffinam, C:\Program Files\loffinam\updateloffinam.exe, 2644, , [16f932fbf8930036ee14bfdb8d78728e] PUP.Optional.BoldLetters, C:\Program Files\ace race\bin\utilacerace.exe, 2724, , [20efab825536082e41f8d0c9d82d8e72] PUP.Optional.Loffinam, C:\Program Files\loffinam\bin\utilloffinam.exe, 2776, , [7798200d4e3da393c2404159e0256997] PUP.Optional.Nosibay, C:\Documents and Settings\Laurent\Application Data\Nosibay\Bubble Dock\Bubble Dock.exe, 4060, , [0a0534f94447af87b269e4b65baa41bf]

Modules: 4
PUP.Optional.Nosibay, C:\Documents and Settings\Laurent\Application Data\Nosibay\Bubble Dock\WindowsHook.dll, , [000fa18c800bf244ae9a987d9b68dc24],
PUP.Optional.Nosibay, C:\Documents and Settings\Laurent\Application Data\Nosibay\Bubble Dock\WindowsHook.dll, , [000fa18c800bf244ae9a987d9b68dc24],
PUP.Optional.Nosibay, C:\Documents and Settings\Laurent\Application Data\Nosibay\Bubble Dock\WindowsHook.dll, , [000fa18c800bf244ae9a987d9b68dc24],
PUP.Optional.Nosibay, C:\Documents and Settings\Laurent\Application Data\Nosibay\Bubble Dock\WindowsHook.dll, , [000fa18c800bf244ae9a987d9b68dc24],

QZI-149-13694 08 September 2015 05:05
https://www.virustotal.com/fr/file/1cbbe73bd9116b121ff9353aec8241e88c76081e265fa30f4228a03642b81ddf/analysis/1442447780/

QLU-670-29734 - 04 September 2015
https://www.virustotal.com/fr/file/0f0d736131f5a6cc53735ade6eb1d2142aad6bbfdc259effd91f9df345f66730/analysis/
https://www.virustotal.com/fr/file/925266c82a9777c857beac1d48551ad0154545fccc7aace930898ddf760642bb/analysis/

#GAI-198-98525 (french) - VLA-160-63972 (english) 18 September 2015 22:09
https://www.virustotal.com/fr/file/3feba132b13d3f2af1b18a9c97e510730a71c061b56969d63278f9290c1dbdfc/analysis/

How you can fight virus, to say have cloud … if you don’t detect after more 24 hours ? unreactive all that …

2

Going to stir the hornets nest here.

Do you have PUP detection’s enabled?

3

Hi Arnaud,

Most of the samples are not particularly malicious - usually those are only PUPs, sometimes even borderline clean (for example this one, which you sent to us: https://www.virustotal.com/en/file/1cbbe73bd9116b121ff9353aec8241e88c76081e265fa30f4228a03642b81ddf/analysis/1442447780/ - we replied that we do not want to detect it at all).

The trouble with PUPs is that they are not our number 1 priority - we do add them to our database, but then are processed automatically, and only if there are troubles, or the samples are very prevalent, analysts process them manually.

I hope I explained our workflow, if you have additional questions, feel free to ask ;-)!
Honza