I’ve been using Avast Internet Security since about a year and I find it a great antivirus software, in this period I didn’t have any kind of touble with online security threats.
Now this question…
Why doesn’t Avast have a Threat Encyclopedia?
When Avast finds threats I’d like to know what kind of threat it is, the risk level and what the threat could have done to my pc
As there is no convention in threat naming and classification, what is the use of a threat encyclopedia for the common user? If you want to know more about a particular threat, do a VT scan and report the results in a new topic in this forum’s “virus and worms” section. Through identifiable information like a unique hash we can tell you more about what threat was detected,
Aside from what has already been mentioned, there are a lot of generic ( -gen ) detections. This would mean that you would also get a rather generic description in the so called Encyclopedia.
To be quite frank and honest, most users don’t really care about such things.
All they care about is that avast! protects their computer with the least amount of noise
and computer interference.
That may have been the case back in 2012. But nowadays my customers are always asking what the virus is, what it does, how they got it, and how not to get it. I would like to give them what they seek. With the lack of a one-stop Avast threat encyclopedia, I am forced to piece together info from other antiviral sites.
It seems to me that if a store owner sends his customers to another store for what they seek, the risk of losing that customer increases greatly.
Does any antivirus vendor provide a “threat encyclopedia”? ???
I have yet to see one. If one does exist it must have listings
out to infinity. Considering how many new viruses and other malware
are produced daily compiling such an encyclopedia would be impossible.
Microsoft has a sort of general threat encyclopedia for their detections, sophos also have such info.
Best overall resources can be found at Clean MX: lists.clean-mx.com
When you have scanned the file via Virustotal you probably will have searchable virusnames and a searchable unique hash.
To establish the detection percentace of a particular malcode, search Clean MX combined with the virus name.
An example: Object: htxp://angelyuen.blogspot.com/
SHA1: 72d230d035316b4e673d8f18977448fe74c0f7e6
Name: TrojWare.JS.Agent.weq → http://worldguide.pt/clean-mx/md5.php?AVG=HTML/Framer
See here: http://quttera.com/detailed_report/angelyuen.blogspot.com
You see now that this is multiple iFrame malware encoded via document.write ->18 instances of this
/2011/04/self-deprecation.html
Severity: Potentially Suspicious
Reason: Suspicious JavaScript code injection.
Details: Procedure: unescape has been called with a string containing hidden JavaScript code .
undefined variable dF exploiting undefined behaviors.
Read on backgrounds of the vulnerability: http://felinemenace.org/~mercy/papers/UBehavior/Undefined%20Behavior.pdf
Threat dump : http://jsunpack.jeek.org/?report=46d8edfd60fccee7270b2eb32ddafa2e6ce912a1
Above link for security research only, open up in a browser with NoScript/ScriptSafe extension active and browser running in a VM/sandbox!
Threat dump MD5: D8C8D8E8056AFEB3EDB27657C44EE82E
File size[byte]: 39938
File type: ASCII
Page/File MD5: 18065860F4E6474C177E156E71D517E8
Scan duration[sec]: 0.287000
So you see now you know somewhat more about the threat at hand and you can inform the victim about the threat, the risks and how to prevent it’s reappearance in the future.
Security is more of an attitude and one grows into more secure practices.
now see what microsoft or kaspersky call it and search those sites for info … it is not 100% but it will give you a idea
if the detection is generic/heuristic like Win32:Malware-gen that can cover a large amount of malware types that other vendors may have many diffrent names for, so not easy to find correct info
others that have info sites are Sophos / F-Secure / TrendMicro / Symantec