Avira Epic Fail ?

Discussion in 'other anti-virus software' started by Doco, Apr 19, 2011.

Thread Status:
Not open for further replies.
  1. Doco

    Doco Registered Member

    Joined:
    Dec 2, 2010
    Posts:
    20
    I looked at a computer today which was reported to be running mega slow. Given that this was a computer I setup several months ago, I know it shouldn't be slow. When checking the Task Manager I noticed a large number of suspect processes running.. cmd.exe, net.exe, net1.exe. Each of these were running about 40 instances.

    The computer was running...
    Avira Premier Security Suite
    Prevx Safe Online
    Malware Bytes

    I ran a scan with Avira, PrevX, and MalwareBytes but nothing came up. However, every few minutes Avira alerted me to a trojan VBKrypt. Even when selecting delete, the alerts continued every so often. There is nothing unusual listed in HiJackThis or msconfig. In Windows Safe Mode the computer was a lot faster and the unusual processes weren't running. However the three applications still didn't find anything malicious. Again, nothing in HiJackThis to suggest any problems.

    So why could the three anti-malware applications not find any malware? Surely there was at least 1 malicious process running to cause the virus alerts. Could I be right in assuming these malicious processes are being hidden by a rookit? If so, what would you consider the next step in removing them?

    For the record, I have already re-installed Windows but I would just like to know the processes involved.
     
  2. monkeybutt

    monkeybutt Registered Member

    Joined:
    May 18, 2009
    Posts:
    126
    Epic Fail? Really, please don't bring that kind of kiddy stuff to these forums:mad:
     
  3. 1000db

    1000db Registered Member

    Joined:
    Jan 9, 2009
    Posts:
    718
    Location:
    Missouri
    You could have tried to scan with a bootable AV CD to detect a possible rootkit or other stuff before windows loads. In the end if it was that infected you're better off wiping it and starting over (assuming there was no data to retrieve first).
     
  4. kjdemuth

    kjdemuth Registered Member

    Joined:
    Jul 29, 2005
    Posts:
    2,960
    Location:
    Boston, MA
    Doco,
    Not to sound like a broken record but you might want to start a search on the forum for rootkits. Other than that it sounds like you might need a different approach. Try running EAM, Dr Web or HItman pro. Sometimes even the highest rated AV's miss things. Run these in safe mode and make sure system restore is off. Don't want any of the nasties coming back. Also you might try kaspersky rescue disk. There are a number of rootkit options to choose from. Like I said try running a search and you'll find many an article on what rootkit scanner to use and how to use it. A few common ones are gmer and unhack me and sophos anti-rootkit.
     
  5. trjam

    trjam Registered Member

    Joined:
    Aug 18, 2006
    Posts:
    9,057
    Location:
    North Carolina
    Avira added protection for this on 4/13. here

    It may not have been able to clean it effectively, as all are guilty of. But to label your thread Epic Fail, I mean come on, ~ Off Topic Comment Removed ~ :cautious:

    If anything it is cool they detected it accurately before the others you have.
     
    Last edited by a moderator: Apr 19, 2011
  6. Doco

    Doco Registered Member

    Joined:
    Dec 2, 2010
    Posts:
    20
    Its a shame Avira doesn't have Drive-By Download protection.
     
  7. Cloud

    Cloud Registered Member

    Joined:
    Feb 1, 2011
    Posts:
    1,030
    Location:
    United States
    It does. ;)
     
  8. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    3,770
    Location:
    Nicaragua
    Perfect example of why we can not depend on antiviruses blocking zero
    day threats. This computer would have been better off if SBIE or
    DefenseWall had been on board instead of the team of applications
    that it had.

    Bo
     
  9. vasa1

    vasa1 Registered Member

    Joined:
    May 1, 2010
    Posts:
    4,152
    It's interesting that OP has problems with more than one security program but highlights just one.

    I feel the thread title should be modified to reflect all the "Epic Fail".
     
  10. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    4,220
    It is odd that 3 top performers didn't detect anything (actually Avira did detect something) but you choose to question Avira's performance.

    Avira in the last AV Comparatives was not up to its usual standards, but I agree with bo elam this is a perfect case that shows the limitations of the AV defense, and the power of other tools.
     
  11. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    4,220
    vasa1, we must have been posting almost simultaneously the same feeling.
     
  12. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,516
    Also, why are you blaming Avira when it's the only one that actually detected something? (even though it couldn't remove it)
     
  13. bollity

    bollity Registered Member

    Joined:
    May 9, 2009
    Posts:
    179
    my advice is to begin from a clean image backup. full cleaning in your case is not guaranteed. you may have some system files or registry values changed.
     
  14. dawgg

    dawgg Registered Member

    Joined:
    Jun 18, 2006
    Posts:
    817
    IMO this thread belongs to a malware removal forum... and the title's inappropriate - more what I'd expect from a troll.
     
  15. doktornotor

    doktornotor Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2,047
    Yeah, indeed...

    http://technet.microsoft.com/de-de/library/cc512587(en-us).aspx

    P.S. +1 on the stupid trollish subject of the thread.:thumbd: :mad:
     
  16. shadek

    shadek Registered Member

    Joined:
    Feb 26, 2008
    Posts:
    2,363
    Location:
    Sweden
    I will stay out of the childish 'epic fail'-discussion as it is my strong belief that those type of things don't belong at Wilders.

    As to why Avira detects something every now and then; it could be a rootkit running in the background dropping malicious files which are detected by Aviras heuristics. After deletion of the dropped malicious file, the rootkit will eventually drop another.

    Try running Norton Power Eraser, Hitman Pro or anything similar which is specialized in removing rootkits.
     
  17. Doco

    Doco Registered Member

    Joined:
    Dec 2, 2010
    Posts:
    20
    The trojan in question was dropped through IE8. So whatever drive-by download protection Avira offers, it was by-passed.
     
  18. PJC

    PJC Very Frequent Poster

    Joined:
    Feb 17, 2010
    Posts:
    2,959
    Location:
    Internet
    Can't agree more! :thumb:
     
  19. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    4,950
    Location:
    USA
    You should probably run GMER, and see what it finds. It is really great for rootkits!
     
  20. trjam

    trjam Registered Member

    Joined:
    Aug 18, 2006
    Posts:
    9,057
    Location:
    North Carolina

    yeah, it finds quite a bit if you are running Avast paid AV or suite.:cautious:
     
  21. jasonbourne

    jasonbourne Registered Member

    Joined:
    Aug 26, 2010
    Posts:
    247
    All AV's have experienced not detecting a threat or two. All apps are not perfect but all strives to improve with user interaction/community help. What might be your settings for APSS/MBAM/Prevx..? Maybe some of the guys here can take a look and see what may be needed adjusted or something.

    I have APSS and drive-by-downloads are detected especially when I am at a "hot site". Try adding SBIE or BufferZonePro in your set-up. If you can try posting at the Avira/MBAM/Prevx-Official forums so they will also know and extend help to you.

    -- Had experienced that also when I was with AvastPro late 2010.
     
    Last edited: Apr 20, 2011
  22. trjam

    trjam Registered Member

    Joined:
    Aug 18, 2006
    Posts:
    9,057
    Location:
    North Carolina

    Good post. I have used AP on Malware Domain, which isnt the totally latest malware, but pretty close and it did well. Not publishing results because they really dont matter anymore. All the products he used are very good, but water will find a leak no matter what.

    Please do not refer to him as a troll because his post may be exactly accurate. If you want to help him, then do it, but leave the hurt feelings behind. Hear that Jeff!:cautious:
     
  23. trjam

    trjam Registered Member

    Joined:
    Aug 18, 2006
    Posts:
    9,057
    Location:
    North Carolina
    And if I needed proof on Aviras detection, it is the only product I have usded my 18 year old son has not beaten. And that includes some future beta products and others.

    When he gets hit, I will move on, but their WebGuard has proven to me that no other product can touch it. As far as lightness, why some love this, I judge this by how long it takes my browser to open and retrieve pages. Avira is so far the fastest, WebGuard and all.

    Try it folks while the discount lasts. It really is that darn good.


    "No bad words";)
     
  24. Sevens

    Sevens Guest

    Please do not refer to him as a troll because his post may be exactly accurate. If you want to help him, then do it, but leave the hurt feelings behind. Hear that Jeff!:cautious:[/QUOTE]

    trjam,

    Good call!
     
  25. lab

    lab Registered Member

    Joined:
    Mar 2, 2006
    Posts:
    22
    I bought Avira last week and great so far.
     
Loading...
Thread Status:
Not open for further replies.