How does OA add files/process/ to trusted?

Discussion in 'other firewalls' started by bonedriven, Nov 25, 2008.

Thread Status:
Not open for further replies.
  1. bonedriven

    bonedriven Registered Member

    Joined:
    Jan 14, 2007
    Posts:
    565
    Based on its name or what?

    Today Avira found "the file Txplatform.exe is the TR/Dlr.Hupigon.egy Trojan"

    While in OA,I see it was auto-trusted.
     
  2. alex_s

    alex_s Registered Member

    Joined:
    Aug 13, 2007
    Posts:
    1,251
    Based on whitelist and digital signature issuer. What was the file ?
     
  3. bonedriven

    bonedriven Registered Member

    Joined:
    Jan 14, 2007
    Posts:
    565
    txplatform.exe.A common file in IM QQ.

    Today,I sent the sample to Avira.The AV kept popping up about the detection when I tried to send the file.I kept clicking ignore.

    But the result is so confusing:

    Thank you for your submission. Below you can see the current status of the uploaded files.

    A listing of files alongside their results can be found below:
    File ID Filename Size (Byte) Result
    25162815 TXPlatform.exe 149.31 KB


    Please find a detailed report concerning each individual sample below:
    Filename Result
    TXPlatform.exe CLEAN

    The file 'TXPlatform.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.
    Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.


    Ain't it ridiculous?
     
  4. alex_s

    alex_s Registered Member

    Joined:
    Aug 13, 2007
    Posts:
    1,251
    Looks like FP. I have no other ideas :)
     
  5. bonedriven

    bonedriven Registered Member

    Joined:
    Jan 14, 2007
    Posts:
    565
    Their online scan engine doesn't use the same one of my up-to-date Avira free?

    I thought if it was a FP,they would tell me only after a deep analysis.

    You just don't know.These days I installed lot of stuff.Avira pops up too often for me.
    I heard this year has much more new viruses than the past.And the day 3 days before Thanksgiving is the VIRUSDAY.So I'm kinda paranoid.

    I scan my pc using AV,mbam,sas,F-secure anti-rootkit almost twice a day each!Nothing special could be found though.:ninja:
     
  6. Escalader

    Escalader Registered Member

    Joined:
    Dec 12, 2005
    Posts:
    3,710
    Location:
    Land of the Mooses

    Just a note for you. Avira is a good Av with the flaw that it tends to find too many FP's. You need to ensure that your Avira settings put "hits" into quarantine NOT delete as it is possible to delete a critical file.


    As already mentioned OA uses a white list to id safe files which is a very good concept. But please note this is a HIPS type scan NOT a virus scan so OA and Avira are NOT the same type of security tool at all!

    If you worry as much as you seem to, users can use web based AV scans from Kav and Bitdefender an some others to hunt for parasites. In this way you don't have to fill up your PC with all the software.

    Just some thoughts.
     
Loading...
Thread Status:
Not open for further replies.