Samples missed by avast (VirusTotal links only!)

[Lisandro]

@DavidR post:179

It is a total waste of time

Don’t lose yours then

[Lisandro]

@Omid Farhang post:180

This kind of topic is useless.

Sorry Omid, but does this make your suggestion also useless? I don’t think so…

@Omid Farhang post:180

avast! need more way for collecting malwares, a web-interface is essential, something that does not cost much for avast because they already have resource for that (A public FTP Folder with enough hosting, bandwidth etc) and just need time and a technical team work on that a few days. I don’t want post link to other vendors website because some people don’t like, if not, I could post some example

[DavidR]

@Tech post:181

@DavidR post:179

It is a total waste of time

Don’t lose yours then

No it is a total waste of time posting the VT results as I have stated quite clearly and not as you have taken an extract of my comments and posted it in isolation.

It is a total waste of time, avast will always be trying to improve detections. It is the nature of the beast that AVs will always be playing catchup. This is why the generic, algorithmic, behavioural and heuristic signatures/rules were introduced to help improve over just signature based detection.

I’m not the one wasting time posting VT results.

[Lisandro]

@DavidR post:183

I’m not the one wasting time posting VT results.

Just let the thread there. Don’t post. Don’t read. Don’t waste your time. But don’t say a thread that I have opened with the best intention and with 180+ posts is a waste of time. It’s a matter of personal respect to the one who opened the thread.

[DavidR]

The number of posts or who started it or respect for who started it has nothing to do with how useful or useless or a waste of time a topic is. That is down to clear hard facts, simply posting the VT results isn’t going to help detections, samples are.

Why if it isn’t a waste of time have several of the virus labs team said it doesn’t help them. So to that end it has to be a waste of time and as I keep banging one if you don’t bother to update your posts when a missed sample is added then it is totally unbalanced. So those visiting the forum get a totally unbalanced view about avast missing samples when there are no subsequent updates when they are added.

So sorry, if I decline your autonomous command not to read, post or waste my time. That is my right to waste my time as it is yours ;D

No one has said anything about your best intentions, that isn’t in doubt, just the fact that it isn’t meeting your intention.

@Tech post:1

As my first thread get hijacked and closed without even warning me :P, I’m starting a new one trying to help avast improving detection if possible.

[Marc57]

@Tech post:170

Are you submitting the samples to avast?
If not, you’re losing your time posting the links…

Sure Tech, Everything I post here is sent to Avast (Along with as many others that aren’t detecting them as possible)

[Marc57]

Rogue A/V Program.

http://www.virustotal.com/file-scan/report.html?id=28ae36996382d05cf5ab0bd5c6763ccef9f4ee50eb62feeb3b4b453eb304218f-1289621871

Now being detected as Win32:Malware-gen

[system]

trojans

http://www.virustotal.com/file-scan/report.html?id=df80dcf3f0d3ee24a508423e48e8d0bb96e44bb5945957b39953d9ab33c97477-1289674128

http://www.virustotal.com/file-scan/report.html?id=38f243ad6fe99e3dfc0f0c9a17bb069b16024ce3afa1e1e88d6246f17b83fc34-1289691606

http://www.virustotal.com/file-scan/report.html?id=798daa4884f51105d09442e585dffa82a35d8e772ef54884aa9f1270ca59991b-1289693895

http://www.virustotal.com/file-scan/report.html?id=d71c12a31f4c01f4502e4a552a9ba9150633db00653753a9e073bef1c1d7cc38-1289673984

http://www.virustotal.com/file-scan/report.html?id=798daa4884f51105d09442e585dffa82a35d8e772ef54884aa9f1270ca59991b-1289693895

http://www.virustotal.com/file-scan/report.html?id=38f243ad6fe99e3dfc0f0c9a17bb069b16024ce3afa1e1e88d6246f17b83fc34-1289697638

http://www.virustotal.com/file-scan/report.html?id=55a39c0b8a8ca16da175bcb3643845296596668504d9a93c1ad322cf68bbb1f5-1282137832

http://www.virustotal.com/file-scan/report.html?id=7430213bca3d3e0abd5e41fbb2b4c09981b14dbcb266fdccfb7706f92a0b1003-1289697253

bot

http://www.virustotal.com/file-scan/report.html?id=b7689c6c10d9887a0fdff2379fae8acc73403e3a68a4236bbb5112d41994d3d7-1289650783

[Marc57]

Possible Trojan.

http://www.virustotal.com/file-scan/report.html?id=bd3edd73b282c48a040ed0673fdae723b26c518358fa94fc26f7814f79dd5086-1289705161

[system]

Is possible that a trojan can be disguised as a Screen Saver file extension?

http://www.virustotal.com/file-scan/report.html?id=a0aa12cdd31154dec56880f57577c316d154945f74dc4e0cceeaba36e5b7cb4d-1289748843

The file was submmited to avast!

[system]

Zeus v2 sample

http://www.virustotal.com/file-scan/report.html?id=eb6cd7f47545e9c7e1811b49c1e9f07c012a987147cd82210b0192d05d371419-1289748173

Submitted to avast!

[system]

http://www.virustotal.com/file-scan/report.html?id=91016ccb7ebc08d77fecea5b305f84eeb0d67d2dc22a2391c3d4fb0ba4a4731d-1289938070

http://www.virustotal.com/file-scan/report.html?id=c0d931378b3746894dfc3efc3900dccb112f065e077c2a5e18c236d6dda345b8-1289937663

http://www.virustotal.com/file-scan/report.html?id=fa99a37e7e76a0853a1f9c0c9ab91eb638c1aaf0641f450d8e00d0bd5b7911b1-1289938624

[system]

http://www.virustotal.com/file-scan/report.html?id=6de1250a22772eb6417e3e896961a3cc6e227b5eb781172d61ca8145c4018b7a-1290143899

http://www.virustotal.com/file-scan/report.html?id=78373ec7d52d511d6ff3334c9d24f50db16a1a5f7038de00add5f436754fdb8f-1290137657

http://www.virustotal.com/file-scan/report.html?id=27b20bf0d034211adfa1ec9b27e2184ff939c89a0047c903315da5e70f9bcd11-1290114380

http://www.virustotal.com/file-scan/report.html?id=1fec86b0ca32c32b47b6a147d4a88ede46aadd4771a17def67178fedc344e1e0-1290122349

http://www.virustotal.com/file-scan/report.html?id=7e48b9e7f34b42a1cfc4ba6c4f0d51fd8ff11eacb4353563995de1f56c091cd7-1290142292

http://www.virustotal.com/file-scan/report.html?id=7666bdb4ffa6344e8167633852966560501b5cdee7cd254f732a5f956cc30868-1290140660

http://www.virustotal.com/file-scan/report.html?id=f7a82722948184ced6a580bf8df3966201832b9b0a07bdf2e05fec314f3a9172-1290142349

http://www.virustotal.com/file-scan/report.html?id=75e3e48ba79564386b215681f279072f817f421655e9bb76b093d876831cf376-1290142320

http://www.virustotal.com/file-scan/report.html?id=0e1882c26fffb718ebe61379e612597a750562248f4371d963e217abfcde91c6-1290123692

[system]

http://www.virustotal.com/file-scan/report.html?id=6de1250a22772eb6417e3e896961a3cc6e227b5eb781172d61ca8145c4018b7a-1290235107

http://www.virustotal.com/file-scan/report.html?id=618c8fe42aa8d4ab93e45fbe15556676c8955e532f1327059d3b9b51cb0191b6-1290210980

http://www.virustotal.com/file-scan/report.html?id=48c3e39c6a9f265e50ae4c2f5977e58d0fa71abaaa463b4cb7f31905f3c7d123-1290227360

http://www.virustotal.com/file-scan/report.html?id=9b42b3ff4e302328ff1593c9867941587b110a2e511528adc980807055f6d764-1290237285

[JuninhoSlo]

Fake AV program

http://www.virustotal.com/file-scan/report.html?id=935231acde473f769a003ccafec31823aa333122623ff0965bb473e0d18ed5d4-1290283102

[system]

http://www.virustotal.com/file-scan/report.html?id=283dd498f973656fd6840a666b0857cf4376ff4e8bdeb0bf69107216555a5a9e-1290274802

http://www.virustotal.com/file-scan/report.html?id=25d13f2dfc380191d488f5218cb16187f9ba0f30136b34c58806223db198d866-1290281390

http://www.virustotal.com/file-scan/report.html?id=9233ec6abbe7c2e885fdd5e6126e8c13d83c3d09710525b225073d8f748d0455-1290281147

http://www.virustotal.com/file-scan/report.html?id=b10d97488bea300be1dfbc5ecd8b349a0daa5a3730daa5a139c2fabfd30cd682-1290287246

http://www.virustotal.com/file-scan/report.html?id=1915f81042991096778b05d89903ac97b8edea768d8bf680db5d93dd3702017b-1290270167

http://www.virustotal.com/file-scan/report.html?id=8e051f3c1a40a2b6bf312a73fee364f8bd13e67b60df518c51eb70ac8e4cfa58-1290286601

[Marc57]

Trojan.

http://www.virustotal.com/file-scan/report.html?id=982590d692dad38821beeac8a67bca0d48588411da840f1e7cdc52551131d90e-1290405306

[Marc57]

Another Trojan.

http://www.virustotal.com/file-scan/report.html?id=7405481483e0db3a217206d44ab7bed0a67cd612022b48c3e0609e1953f36874-1290486211

[Marc57]

Trojan Downloader.

http://www.virustotal.com/file-scan/report.html?id=08be62efec518609ffdc23be0a6487a23c7ff2905ce4cce878e039235c1b7fba-1290919831

[Lisandro]

Malwares and PUPs not detected by avast (but from ESET on line):

Nero Burning Rom installers as Win32/Toolbar.AskSBar application
Format Factory 2.10 as a variant of Win32/Adware.ADON application (file >20Mb).
Keygen (http://www.virustotal.com/file-scan/report.html?id=2988cd576f121a7ec4a6465c0b7c34e54693534fe17fc420c8f82e04d19eba21-1290964254) submitted from Chest.
Keygen (http://www.virustotal.com/file-scan/report.html?id=351b67dc73b4b42b90160ed2363d99dc40b39ea07be1788c034767a088ced236-1290964252) submitted from Chest.
Keygen (http://www.virustotal.com/file-scan/report.html?id=5dc9c2613e0fcbe975aa8eb644b8c331a29b94221313f175db1e5c29b4065f64-1290964594) submitted from Chest.
Asterisk Password Reveal (PUP?) (http://www.virustotal.com/file-scan/report.html?id=84e280f5ec0c7c5a79b2f885d4a3672dde199a27a22dd6c01e62657fcced2f4c-1290964888) submitted from Chest.
Patch missed by avast (http://www.virustotal.com/file-scan/report.html?id=20f1df38534b05fb80b6ebbe43ec909aa8b5e4980a0bcdf7a117737d307e4fa5-1290965268) submitted from Chest.
Patch missed by avast (http://www.virustotal.com/file-scan/report.html?id=913d463352eee7bd9f8c4d2e341aeaf1396d22f2e6b90d47c3b8f110c0efdeb7-1290965252) submitted from Chest.
KillProcess 2.44 (PUP? a variant of Win32/KillProcess.A application?) (http://www.virustotal.com/file-scan/report.html?id=014d58b0ba45495ba72c07f68afb8d74cd7d818e5c740f3b3be97d908166988e-1290965661) submitted from Chest.

Is Unlocker 1.9.0 setup a Win32/Adware.ADON application? (http://www.virustotal.com/file-scan/report.html?id=1ad20b852885783d90567d61089f369c9fdcaaa52116a0377663bac4b1c30572-1290965148).

In my tests, only one false positive of NOD32 (ESET): http://www.virustotal.com/file-scan/report.html?id=d5c67fea9f9d0de88f10a4acb728e6d4f1807f43ecc348cb2523e332bfae61b7-1290965863

At least after 1 hour of work, can I have an answer from the virus analysts to this particular post?