WinAntiVirus

I work at a small PC Repair shop and finally talked the owners to start selling NOD32. I recently had a customer call me that had NOD32 v3 with updates and ended up with WinAntiVirus.

Why isn't this lousy 'software' not detected by the spyware engine? Will it be in the future?

Thank you,

Ed Smith

 

Hm, when I tried to access it I got this warning:

Details:

Web page:
hxxp://www.winantivirus.com/

Description:
Access to the web page was blocked by ESET Smart Security.
The web page is on the list of websites with potentially dangerous content.

 

Hello,
Ok for ESS but what's about EAV ? A lot of spywares (rogues) like winantivirus, vundo, navisearch, smitfraud etc... are currently infected numbers of PC and it seems that EAV is not able to detect them... And generaly speaking there are few AV able to detect them. I'm a bit surprised that, considering level of danger of such spywares, antivirus company did not decide to consider them...

Regards

 

It doesn't matter whether it's EAV or ESS, both block access to that site as you can see below. As for Virtumonde, they pay the authors well and release new variants every while. Detection is usually tested before a new version is released and the code is adjusted until it's not detected by the most famous AV programs. I've seen Virtumonde detected only by NOD32 and 1 or 2 more AV programs. Every AV vendor is trying to find ways how make Virtumonde detectable in spite of the obfuscation they use.

 

I concur with Marcos, EAV 3 knocks it on the head.
Had to turn off Outpost 2008 first, but both detected it instantly.

 

Well ! Thank you for your answer...
Regards

 

I've had some versions of this slip past NOD and infect machines, this one as well as some other variants of smitfraud, spyfalcon, spysheriff, virtumundo...they change so rapidly...I've seen them get into even NOD and Kaspersky protected machines. Some of these rogue trojans change so fast...many variants coming out frequently.

 

It appears at this moment in time the blocking of www.winantivirus.com may not be the answer as there doesn't appear to be any HTML code on that page to cause any damage but still checking. Users must be getting this by other means and\or URL's

 

I wonder if we submit samples of winantivirus they might consider adding it to the list of junkware?

Also, I am certain EAV and ESS are identical except for a SPAM filter and firewall on the latter so they will both detect the same junk.

 

I'm not sure if ESET is interested detecting them. I've sent 1 trojan sample 3 days ago, and it has not been added to database in spite of most of the other AV vendors detect it.

 

Please drop me a PM with the email address you sent the samples from as well as the subject of the email.

 

It seems the PM system is unavailable atm.

 

Hi!

User CP => Edit options => Enable Private Messaging

 

PM sent. Thank you