[Solved] Win32.Bagle not detected by avast

Viruses and worms
21

i have waited for more than 45 days to get that youtube,orkut and mozilla blocking worm detected…
and the root kit i sent around 2 weeks ack is still not dected.’
and the worst part is avast soes not send any kind of acknowlegment that i has included it in the database so we are forced to scan the file on every updated. >:( >:(

22

It’s becoming dangerous to be using just avast…

23

This is embarrassing, disappointing and not a good advert for avast in these public forums.

I do think that avast is a very good AV and I have no doubt that they are working hard to improve detections. But, this is very poor when people take the time to submit a virus/rootkit someone should be watching this the viruses and worms forum for this very thing overdue submissions.

24

Since this is a weekend, we’re probably at risk for this one till at least Mon.
Not good. Not good at all… :cry:

25

I know this problem has existed for a long time, but I also know there is a tendency on the part of Alwil to prefer large, all encompassing program releases that make a big splash. I hope the delay on the improved submission process, improved root kit detection etc is not simply out of a desire to make a grand statement when Version 5 (?) is finally ready.

It makes me sad to see the people who have given so much to such a great piece of software losing confidence in it. And I’m especially saddened by the fact that I have no arguments against what they say.

26

Sorry to think different, I mean, for the last years the only I can say is that program updates follow a different rule and policy than the virus databases. I won’t expect avast 5 improve submission process by itself. It could be a better program but the lack of updates is becoming dangerous for uses that have only avast…

What can we do? I get infected twice since I use only avast… :cry:
A friend of mine had to format and reinstall… this is sad…

27

Just trying to be an optimist, I suppose. Should I have said “formerly great …” ?

This is a weakness that must be fixed if avast! is to maintain any effectiveness.

And ya’ know, when someone speaks to me I at least acknowledge that words have been uttered, Alwil team …

28

Hi mauserme,

Here is a free removal tool for it: http://www.kaspersky.com/removaltools?vtopen=146410248#open
But I realize that no av solution can close the vulnerability window completely, so that is why I have a resident scanner and non-resident scanners on my system to keep it as close ajar as I can.
But avast should also flag the malware that is reported most to infect, and their web forum report is one of the best and cheapest indicators, where and why avast users are getting infected. The e-card.exe was an ominous example where Avast was not a front-runner. Sometimes I think don’t they read the important things that are posted here?

polonus

29
And ya' know, when someone speaks to me I at least acknowledge that words have been uttered, Alwil team ...
Unfortunately Alwil's lack of participation has only gotten worse over the past year. They used to be a regular part of this forum that no longer seems the case.

Space alone does not make for a good support forum. It takes active participation. :o

30

Thanks Polonus. I just wish I could feel confident that a week, or a month, or even two months from now we would have our own detection. Unfortunately my confidence is lacking.

31

we can only hope there is going to be big much needed improvment

i have been in this forum for the past few months …before i used to think avast evanglists wher staff members…but after davidr told me that its not like that i wonder
this has become a totally avast independent forum with the title “avast forums”

and for some one like me who makes it a point extract all files which avg anti-spyware detects [and avast does not detect ]…send it to virustotal for analysis …mail the sample to avast .with the virustotal analysis.and and added comments…
it almost makes my furious that
1>there is no detection of the sample for months together
2>no way of finding out if the sample rached them or not…

gee i am thinking to switch to bit defender after i get more RAM

32

We’re sort of a family here. And like any family, sometimes our dirty laundry gets aired publicly.

33

;D ;D ;D

but with or with out AWIL staff participation.
its one of the quickest and best forums around… 8)
it’ll tend to all our cribs :wink:

34

Another day we’re not protected…

I agree… what is their policy now? Most of them disappear… :cry:

Tested again with new iAVS update (VPS 753-0) for avast! program that has been released recently, no detection :-\

35

And another day has gone without any input from avast!.
What’s happening? Where is Alwil?

36

Are any of you who have posted to this thread paying users? I am a paying customer with 30 PCs protected on a corporate network, and a 3-year update license. I’m pretty concerned about the fact that the “postcard” virus (or at least one of its downloader) is still not detected by Avast even though it has been sweeping the Internet for several days now. I will open a support request on this topic, and also mention the apparent lack of response from Avast on stuff like this… unless someone else has already done so, only to find that being a paying customer doesn’t make any difference?

37

Yes, but that is not my role on the forum.

38

My answer here: http://forum.avast.com/index.php?topic=29124.msg239311#msg239311

Not detected by 000753-1. Sent to VirusTotal again to see the results of other antivirus companies.

39

Complete scanning result of “Infected.exe”, processed in VirusTotal at 07/03/2007 03:30:25 (CET).

[ file data ]

  • name: Infected.exe
  • size: 276814
  • md5.: 9716dea70cda530c18bf943184d8e607
  • sha1: 8ee3ec9261c66c15140180a505759f48a516d759

[ scan result ]
AhnLab-V3 2007.7.2.0/20070702 found [Win-Trojan/Bagle.88592]
AntiVir 7.4.0.37/20070702 found [TR/Dldr.Bagle.CH.15]
Authentium 4.93.8/20070703 found [W32/Downloader2.AJQP]
Avast 4.7.997.0/20070702 found nothing
AVG 7.5.0.476/20070702 found [Downloader.Generic4.YRB]
BitDefender 7.2/20070703 found [Win32.Bagle.SRN@mm]
CAT-QuickHeal 9.00/20070702 found [(Suspicious) - DNAScan]
ClamAV devel-20070416/20070702 found [Worm.Bagle-77]
DrWeb 4.33/20070702 found [Win32.HLLM.Beagle]
eSafe 7.0.15.0/20070703 found [Win32.Bagle.ch]
eTrust-Vet 30.8.3759/20070702 found [Win32/Glieder.FP]
Ewido 4.0/20070702 found nothing
F-Prot 4.3.2.48/20070702 found [W32/Downloader2.AJQ]
F-Secure 6.70.13030.0/20070703 found [Trojan-Downloader.Win32.Bagle.ch]
FileAdvisor 1/20070703 found nothing
Fortinet 2.91.0.0/20070702 found [W32/Bancban.CH!tr.dldr]
Ikarus T3.1.1.8/20070702 found [Win32.Bagle.SRN]
Kaspersky 4.0.2.24/20070703 found [Trojan-Downloader.Win32.Bagle.ch]
McAfee 5065/20070702 found nothing
Microsoft 1.2701/20070702 found nothing
NOD32v2 2371/20070702 found [Win32/Bagle.IS]
Norman 5.80.02/20070702 found [W32/Mitglied.AEC]
Panda 9.0.0.4/20070702 found [Trj/Mitglieder.OI]
Sophos 4.19.0/20070624 found [Troj/Bancban-QH]
Sunbelt 2.2.907.0/20070702 found [VIPRE.Suspicious]
Symantec 10/20070703 found [Trojan.Tooso]
TheHacker 6.1.6.141/20070702 found [Trojan/Downloader.Bagle.ch]
VBA32 3.12.0.2/20070702 found [Worm.Win32.Bagle.IS]
VirusBuster 4.3.23:9/20070702 found nothing
Webwasher-Gateway 6.0.1/20070702 found [Trojan.Dldr.Bagle.CH.15]

Detection improved since my first submission.

40
Detection improved since my first submission.
[b]Except:[/b] [b]Avast 4.7.997.0/20070702 found nothing[/b]

So those of us using avast! are still left out in the cold… :cry:

Good thing I can use ClamWin as a double check. It detects it.

Alwil, please understand that I’m making these critical remarks in order
for you to improve my Anti virus program of choice.