slowly updating virus definition

system · 2006-08-15T18:12:12.000Z

Tech post:12:

Wetabax, please NEVER post here live links to infected or false positive files…
Can you edit the links? Thanks.

ok - sorry, I will delete the post.

Lisandro · 2006-08-15T18:17:30.000Z

wetabax post:13:

Tech post:12:

Wetabax, please NEVER post here live links to infected or false positive files…
Can you edit the links? Thanks.

ok - sorry, I will delete the post.

You can’t… only the Administrators could do that.
Anyway, edit is enough 8)
Thanks.

DavidR · 2006-08-15T19:35:13.000Z

By the way, recently one of the Alwil team said that they receive in excess of 4000 emails a day at virus @ avast.com so I would assume they have to prioritise or find some way to work through this. If they don’t clear 4000 a day then a back log will build up. Not to mention they also receive samples from VirusTotal and Jotti, and probably other sources, again recently it was mentioned that 80% of the stuff that comes from VirusTotal and Jotti was junk, but it still has to be checked.

Lisandro · 2006-08-16T03:00:53.000Z

DavidR post:15:

I would assume they have to prioritise

A white list of ‘good’ sample suppliers (specially the ones from Forums) will help…
After all, we help them on Forum that could give us some kind of priority, don’t you think David?

DavidR · 2006-08-16T11:30:39.000Z

I would have thought those coming from avast users not just those who help on the forums, so those coming from the chest submission should be given priority, unfortunately they too are routed through the virus @ avast.com address.

That would be very easy to rectify have a new email for the submissions from the chest, e.g. viruschest @ avast.com perhaps that may even reduce the amount of spam that is probably sent to the virus @ avast.com address due to its being plastered all over this forum.

Also the much talked about and much requested on-line submission of suspect or possible false positive samples could possibly help prioritise things.

system · 2006-08-16T16:11:54.000Z

DavidR post:17:

That would be very easy to rectify have a new email for the submissions from the chest, e.g. viruschest @ avast.com perhaps that may even reduce the amount of spam that is probably sent to the virus @ avast.com address due to its being plastered all over this forum.

That’s a great Idea! Congratulations!
PS - one of the 4 viruses I sent this week is still recognized by today’s update. Three are waiting.

Vlk · 2006-08-16T16:31:19.000Z

They are all routed to the same virus @ avast.com address, but files sent directly from chest are identified and separated automatically on our mail server - so it really doesn’t make any difference.
We now have two full-time engineers working on the “virus” mailbox. Once the whole backlog is processed (yes, there’re still some remaints) you should see dramatic improvement in processing time (well, even now it should be much much better than it used to be).

Thanks,
Vlk

RejZoR · 2006-08-16T16:56:33.000Z

Well i can certanly confirm this. Samples were added much faster.
Though i’m still missing web form from which i could upload stuff. Chest is the only way for me as GMail is blocking things and you have to pack them all over (annoying).

Lisandro · 2006-08-16T17:28:44.000Z

Vlk post:19:

We now have two full-time engineers working on the “virus” mailbox. Once the whole backlog is processed (yes, there’re still some remaints) you should see dramatic improvement in processing time (well, even now it should be much much better than it used to be).

Let’s be fair people…
I can SEE there is a difference in detection… really… my other scanners are not being able to detect anything nowadays…
They’re feeling rejected as avast is doing a very good first defense line 8)

Lisandro · 2006-08-16T17:31:35.000Z

RejZoR post:20:

GMail is blocking things and you have to pack them all over (annoying).

Yeah… very annoying to sample submition…
Good if we think that we’re not receiving that mails.

system · 2006-08-23T16:57:53.000Z

[message deleted after I have received an email from avast team asking for apologises.]

Lisandro · 2006-08-23T17:56:42.000Z

Wetabax, thanks for posting…
Alwil, thanks for improving detection 8)

system · 2006-08-25T14:49:00.000Z

GOOD NEWS!!!
message received from one of the avast virus team:

[ref delay to add virus signatures in a VPS file]
“I’m so sorry. All this delay is due to our testing system that have to
be reorganized. It is not so easy to make it more flexible, but it is
necesary. I hope that in some time we will be able to add signatures to
VPS in hours not in days. Hope all this will be better everytime you and
other users send us a suspicious files.”

let’s wait.

Lisandro · 2006-08-25T19:21:57.000Z

wetabax post:25:

All this delay is due to our testing system that have to be reorganized.

Does Alwil want to ‘share’ this info or open for suggestions and discussion? Or not, this is an internal stuff that won’t be posted by you here…
Just want to know to avoid loosing of time of making questions and waiting for answers that won’t exist… :-\

Dwarden · 2006-08-25T23:37:08.000Z

well Vlk already mentioned in past they working on these improvements …

so take it as public secret

Dwarden · 2006-08-27T13:51:33.000Z

just to continue on similar subject and avoid create new thread …

worst time to submit trojans/viruses to Alwil seems to be late friday GMT and weekend …

example there is / was Steam targeted scam caimpaing with trojan (that mean detection delayed by 3 days is useless as that threat is worst when sources are online)

submitted on friday midnight to Alwil, Kasperky, Microsoft, ESET, Grisoft …

over Saturday day it was added by Kaspersky bit later followed by ESET …
after uploading to VirusTotal and Jotti it was added over Sunday morning by Symantec and Antivir

clearly shows these companies got advantage in staff working 24/7 on trojan detections …

lets hope Alwil cleans up backlog soon and speed up

Lisandro · 2006-08-27T14:16:05.000Z

Thanks Dwarden.
I’ve asked in another thread about the Kaspersky engine into Active Virus Shield. I can’t install it if it is not the only resident.
Does anybody knows if there is a solution for this?
I’ve posted in Wilders forum as well… but, as usual for me, everybody drops a comment in Wilders but nobody answers my questions there…

Dwarden · 2006-08-27T23:34:07.000Z

no idea, as far i heard it’s dumbed down old version of KAV so i not messed with it yet … plus AOL tag … eww

in meantime VBA32 added detetion of that trojan too …

Dwarden · 2006-08-28T17:24:48.000Z

AVG, Fortinet, Norman added now detection too …

still waiting for Avast! and MS … and they were first informed

Dwarden · 2006-08-30T19:49:31.000Z

as from today’s VPS update, detection was added …


AntiVir 6.35.1.11 08.30.2006 Worm/Rbot.1247232 
Authentium 4.93.8 08.30.2006 W32/Sdbot.UIV 
Avast 4.7.844.0 08.30.2006 Win32:Rbot-CCK 
AVG 386 08.30.2006 IRC/BackDoor.SdBot2.GJR 
BitDefender 7.2 08.30.2006  no virus found 
CAT-QuickHeal 8.00 08.30.2006 Backdoor.Rbot.bho 
ClamAV devel-20060426 08.30.2006  no virus found 
DrWeb 4.33 08.30.2006 Win32.HLLW.MyBot 
eTrust-InoculateIT 23.72.110 08.30.2006 Win32/SpyBot.7bi!Worm 
eTrust-Vet 30.3.3051 08.30.2006 Win32/Rbot.FOA 
Ewido 4.0 08.25.2006  no virus found 
Fortinet 2.77.0.0 08.30.2006 W32/RBot.BHO!tr.bdr 
F-Prot 3.16f 08.29.2006 security risk named W32/Sdbot.UIV 
F-Prot4 4.2.1.29 08.30.2006 W32/Sdbot.UIV 
Ikarus 0.2.65.0 08.30.2006  no virus found 
Kaspersky 4.0.2.24 08.30.2006 Backdoor.Win32.Rbot.bho 
McAfee 4841 08.30.2006 W32/Sdbot.worm.gen.ca 
Microsoft 1.1560 08.30.2006  no virus found 
NOD32v2 1.1732 08.30.2006 Win32/Rbot 
Norman 5.90.23 08.30.2006 W32/Spybot.AXEH 
Panda 9.0.0.4 08.30.2006 W32/Gaobot.NZG.worm 
Sophos 4.09.0 08.30.2006  no virus found 
Symantec 8.0 08.30.2006 W32.Spybot.Worm 
TheHacker 5.9.8.201 08.28.2006  no virus found 
UNA 1.83 08.30.2006  no virus found 
VBA32 3.11.1 08.30.2006 Backdoor.Win32.Rbot.bho 
VirusBuster 4.3.7:9 08.30.2006 no virus found

As You can see Microsoft and BitDefende are still slower than Alwil :)))

Announcements