Re: AVG virus software fails to detect viruses!!!

From: half_pint (esboella.nospam_at_yahoo.com)
Date: 02/09/04 

Date: Mon, 9 Feb 2004 01:35:25 -0000

"JT" <datacare@www> wrote in message
news:471475cd96afb23f7fc4b5f32cae2644@news.teranews.com...
> On Mon, 9 Feb 2004 00:26:15 -0000, "half_pint" <esboella.nospam@yahoo.com>
> wrote:
>
> >
> >"Richard Kirkcaldy" <news@lordrich.com> wrote in message
> >news:xiyVb.17491$P32.12881@news-binary.blueyonder.co.uk...
> >> half_pint wrote:
> >>
> >> > AVG virus software fails to detect viruses!!!
> >> >
> >> > I ran a virus scan today with an uptoday version
> >> > of AGV 6 virus software. Fine, no viruses detected.
> >> > I then decided to run it on my old hard drive (d:)which
> >> > I had connected as a slave drive.
> >> > Result virus found!!!
> >> >
> >> > This was a surprise because my old drive was a copy
> >> > of my current drive!!!
> >> > Anyway the virus/trojan was "startpage" or startpage.DG
> >> > or whatever it is called (it's 'harmless' one), it
> >> > was hiding in
> >> > d:\program files\common files\microsoft shared\msinfo\msinfo.exe
> >> > (57,244 bytes)
> >> >
> >> > I then went back to my c: drive and checked in this location and
> >> > sure enough the same file was there and it was reported as a virus
> >> > with an *individual* AGV file scan.
> >> > I was a bit shocked at this so I ran a complete check on my c:drive
> >> > again (Opened AGV and clicked 'run complete test' (although it
appears
> >> > to only check your main drive anyway!) and it ran its check on
> >> > drive c:, - result - no viruses found!! even though an individual
> >> > check on the file (which I did not remove) shows it to be a
> >> > virus/trojan!!.
> >> >
> >> > So it appears AGV virus software is *serioously* flawed!!!!
> >> >
> >> > I believe I knew about this virus for some time as I had removed
> >> > most of it before with some anti-hijack software so it did not
> >> > affect my computer.
> >> >
> >> > However I was shocked to discover that AGV's virus scan missed it
> >> > completely!
> >> > AGV's anti virus appears to have a *serious* flaw in it.
> >> >
> >>
> >> If you've removed most of it, could it be that you removed most of it
> >> after making the backup?
> >
> >I actually remember using the virus scan to compare the speeds
> >of the two drive because it reports the time it takes to complete
> >the scan.
> >Neither reported the virus, and both disks were conected
> >seperately as master.
> >I thought a scan would be a good clock as both disks were identical.
> >however I an unsure of the results now (my new drive was quicker,
> >as I expected (but it's a bloddy noisy bugger too!!).
> >Interestingly the file in question has a creation date of 11/5/98
> >which is the same as all bar one of the other files in the
> >directory, which is odd to say the least.
> >I bet if it get a copy from microsoft it will fail the scan too!!

I know believe it is not a true MS file anyway.

> >
> >>
> >> What I suspect you are seeing is a flaw which also exists in Sophos.
By
> >> default, only the first few k of each file is scanned. Scheduled and
> >> on-demand scans should always be run with full scanning selected,
> >> otherwise there's no point.
> >>
> >> I've seen viruses lay dormant on backup drives for months, if not
years.
> >> The files are never accessed normally, so there is nothing to trigger
> >> on-access virus checking and on-demand scanning just kept missing them
> >> after being setup incorrectly.
> >>
> >> Having said that, I would recommend you submit the infected file to AVG
> >> just to be sure it's not a slightly different version of the virus,
> >> explaining what you have seen happen.
> >>
> >> --
> >> Richard Kirkcaldy
> >
>
> Try one or both of these online virus scanners
> http://www.pandasoftware.com/activescan
> http://housecall.antivirus.com

I may do but they tend to take a while.
AGV finds it if I do an *individual* check on it, but not during a scan.
Well I am downloading it now, its going to take a long time!!
(I am sure it will probably work?)

>
> Also look at the Avast antivirus program www.avast.com I use it and AVG
> (on different computers). Avast seems to have a slicker interface, and I
> like the way it updates better.
>
> JT

Relevant Pages

  • Re: Microsoft Error message & reboot
    ... side-effect of some virus activity. ... Microsoft uses the reports of problems in its OS to prioritize work ... versions of Windows. ...
    (microsoft.public.security.virus)
  • Re: Code Red
    ... All client computers were checked and they seen to be ... the server to connect to worm web page). ... Fixes related to Code Red Virus ... >still reports access to www.worm.com. ...
    (microsoft.public.win2000.security)
  • Re: "Net Threat Rising" says CR, zara claims otherwise
    ... >>>spyware, Consumer Reports carried out an extensive survey across 3,200 ... >>>Mac owners surveyed reported detecting a virus in the past two years, ... >>>reflects badly on the $2.6 billion US consumers spent on software to ...
    (comp.sys.mac.advocacy)
  • Re: Win32forth.exe deleted by McAfee VirusScan Enterprise
    ... We too observed an objection from a virus detector during installation. ... If the developers are told of the false positives they should make ... one of those reports was about Win32Forth... ...
    (comp.lang.forth)
  • Re: Program FilesExchsrvrMailrootvsi 1UceArchive
    ... Mcafee On demand Virus Scan reports 4 Trojans on SBS 2003 Premium Ed. ...
    (microsoft.public.windows.server.sbs)