Prevx age/population heuristics - disappointment

Discussion in 'Prevx Releases' started by ako, Jul 27, 2009.

Thread Status:
Not open for further replies.
  1. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
  2. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    648
    Location:
    HKEY/SECURITY/ (value not set)
    I do not see anything heuristic about Prevx.
    The only heuristics I observe is the Prevx algorithm contacting the Prevx Server to determine the statistical age of an file according to the Prevx community, then jurying the file.
    That is not heuristics, true heuristics does not care about the age of an file, true heuristics juries an file by what action the file is performing right now in real time.


    HKEY1952
     
  3. raven211

    raven211 Registered Member

    Joined:
    May 4, 2005
    Posts:
    2,567
    Totally agree.
     
  4. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
    I'm not interested in nomenclature. I want to know if a given protection method works or not.
     
  5. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    648
    Location:
    HKEY/SECURITY/ (value not set)
    Well.....you just Posted your disappointment.....now you know.....


    HKEY1952
     
  6. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
  7. Saraceno

    Saraceno Registered Member

    Joined:
    Mar 24, 2008
    Posts:
    2,404
    ako, I don't know the 'technical' ins and outs of prevx, but I've learned from these forums, some of the best security programs don't get every problem file.

    For example, winpatrol might detect these, but misses others.

    What problems do these files create, if run?
     
  8. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
    The point is: they are new files, but one gets no warning even age/pop. heuristics set as maximum.
     
  9. Saraceno

    Saraceno Registered Member

    Joined:
    Mar 24, 2008
    Posts:
    2,404
    When Joe gets online, he's sleeping I'm betting, send them through to him and wait for his follow-up. :)
     
  10. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
    I've already done it...
     
  11. Saraceno

    Saraceno Registered Member

    Joined:
    Mar 24, 2008
    Posts:
    2,404
    Good stuff. :thumb: Just out of interest, what sort of site did these files come from, gaming, adult etc?
     
  12. raven211

    raven211 Registered Member

    Joined:
    May 4, 2005
    Posts:
    2,567
    He's doing an excellent job, definitely deserving his rest. ;)
     
  13. Saraceno

    Saraceno Registered Member

    Joined:
    Mar 24, 2008
    Posts:
    2,404
    I heard the man doesn't sleep, survives off mouthfuls of air. That true? ;)
     
  14. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
    Infected random sites,no special title.
     
  15. Kees1958

    Kees1958 Registered Member

    Joined:
    Jul 8, 2006
    Posts:
    5,857
    Ako,

    Have you set DefenseWall to protect additional folders? Or did you select the option to be informed when protected resourced are accessed?

    You know there is a nice trick with DefenseWall Resource Protection to add extra security (on files/registry). Simply add those items as resources of the "System" process.

    Ilya has added a lot of my extra file and registry protection by default. I am interested to known whether you have defined extra's yourself.

    Regards Kees
     
  16. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
    I haven't done so far any 'tweaking', unless proven otherwise, I hope I can trust the default settings of DW.

    please tell what's your ruleset?
     
  17. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    Hi ako,
    I'm unsure what the source of the issue is but could you get me some details about your system including what version of DefenseWall and what browser you're using/service pack level? There may be an incompatibility causing the detection to not work properly (it definitely works as it bugs me every time we make a new build :D).

    And @HKEY1952: only one portion of our centralized database uses age/popularity to detect the file, the rest is entirely based on heuristics/heuristics from behavior (we don't have 1-1 signatures).
     
  18. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
    XP sp2 (no updates), IE7, DW 2.56, Adobe 7.08
     
  19. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    Could you try a similar test with DW/WinPatrol not installed? I'm interested to see if it is related to them in particular as I just tried a similar setup (SP3 VM) and no malware got through (EDIT - said the inverse of what happened... coffee needed...)

    Also, does that VM image have a full Prevx license in it? That can make a difference with age/popularity protection.
     
  20. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    648
    Location:
    HKEY/SECURITY/ (value not set)
    I have been following your Posts and you always have an definite positive answer, fix , workaround, and soon to be updated fix for every single negative Post about Prevx.
    Prevx always works for you and it is always the clients configuration causing Prevx not working properly. No Program is that dynamically perfect and no human is that
    dynamically intelligent.....although your performance here on Wilders Security Forums is very convincing to the average person.


    HKEY1952
     
  21. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    :doubt: I'm sorry if I'm being too truthful... when something isn't working properly we issue a fix for it, and a fixed version is soon to be updated so I'm not sure where the problem is o_O I'm not blaming the client's configuration, I'm just working to be able to reproduce it so that we can correct the problem.
     
  22. TonyW

    TonyW Registered Member

    Joined:
    Oct 12, 2005
    Posts:
    2,633
    Location:
    UK
    Forgetting Prevx for a moment, when I look around at these and other forums, I see a mixture of users with product X; those who have problems and those who don't despite the fact it's the same product and version being used. There has to be a reason why one user has an issue, but another doesn't. The trick is finding out why, but often that's not an easy task to accomplish, which is why some users give up and move on to something else.

    I came to the conclusion a long while ago that the developers cannot know the myriad configurations that exist out there, and that being the case some anomalies may occur. They can do their best to cover most scenarios, but not all. Each and every one of us has a different configuration, and, unfortunately, some software may cause conflicts.

    Those that say they have no issues are lucky; the software they have installed works nicely within their configuration. Other factors to bear in mind are the fact that some of these people don't have as many programs installed, and some, like me, don't run too many things at once.

    Having said all that, when the support division of a vendor tries their best to work with the customer to resolve any issues, that is to their credit. Sadly, that doesn't always happen; in this instance Prevx has to be applauded for at least going some way to try and fix things as quickly and as humanly possible.
     
  23. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    5,828
    Location:
    Last Breath Farm
    But of course you're not convinced because you are not average, isn't that what you're saying? You are one of the very special people who show up now and then here at Wilders to enlighten the general population. I am so glad that I am alive during your time. :thumb:
     
  24. Keyboard_Commando

    Keyboard_Commando Registered Member

    Joined:
    Mar 6, 2009
    Posts:
    690
    HKEY1952's post was rather cryptic. Not sure if he was praising Prevxhelp for finding fixes & workarounds or just working hard, seemed like he was praising all three. What an butt-kisser. JK :p

    I think it would be legit to crucify someone for not trying.
     
  25. ako

    ako Registered Member

    Joined:
    Nov 16, 2006
    Posts:
    627
    Full licence.

    I uninstalled DW, and closed winpatrol. This time the malware was stopped (Due to recognized as malware, who knows why. Perhaps it is in the database already?)

    I just wonder: During my tests I have never seen age/pop heur. in action. Why?

    Could you do a favour: download DW trial, Winpatrol free and test yourself that combo.
     
Thread Status:
Not open for further replies.