«

AVG virus software fails to detect viruses!!!

I ran a virus scan today with an uptoday version
of AGV 6 virus software. Fine, no viruses detected.
I then decided to run it on my old hard drive (dwhich
I had connected as a slave drive.
Result virus found!!!

This was a surprise because my old drive was a copy
of my current drive!!!
Anyway the virus/trojan was "startpage" or startpage.DG
or whatever it is called (it's 'harmless' one), it
was hiding in
d:\program files\common files\microsoft shared\msinfo\msinfo.exe
(57,244 bytes)

I then went back to my c: drive and checked in this location and
sure enough the same file was there and it was reported as a virus
with an *individual* AGV file scan.
I was a bit shocked at this so I ran a complete check on my c:drive
again (Opened AGV and clicked 'run complete test' (although it appears
to only check your main drive anyway!) and it ran its check on
drive c:, - result - no viruses found!! even though an individual
check on the file (which I did not remove) shows it to be a
virus/trojan!!.

So it appears AGV virus software is *serioously* flawed!!!!

I believe I knew about this virus for some time as I had removed
most of it before with some anti-hijack software so it did not
affect my computer.

However I was shocked to discover that AGV's virus scan missed it
completely!
AGV's anti virus appears to have a *serious* flaw in it.

--
regards half_pint.

half_pint wrote:

> AVG virus software fails to detect viruses!!!
>
> I ran a virus scan today with an uptoday version
> of AGV 6 virus software. Fine, no viruses detected.
> I then decided to run it on my old hard drive (dwhich
> I had connected as a slave drive.
> Result virus found!!!
>
> This was a surprise because my old drive was a copy
> of my current drive!!!
> Anyway the virus/trojan was "startpage" or startpage.DG
> or whatever it is called (it's 'harmless' one), it
> was hiding in
> d:\program files\common files\microsoft shared\msinfo\msinfo.exe
> (57,244 bytes)
>
> I then went back to my c: drive and checked in this location and
> sure enough the same file was there and it was reported as a virus
> with an *individual* AGV file scan.
> I was a bit shocked at this so I ran a complete check on my c:drive
> again (Opened AGV and clicked 'run complete test' (although it appears
> to only check your main drive anyway!) and it ran its check on
> drive c:, - result - no viruses found!! even though an individual
> check on the file (which I did not remove) shows it to be a
> virus/trojan!!.
>
> So it appears AGV virus software is *serioously* flawed!!!!
>
> I believe I knew about this virus for some time as I had removed
> most of it before with some anti-hijack software so it did not
> affect my computer.
>
> However I was shocked to discover that AGV's virus scan missed it
> completely!
> AGV's anti virus appears to have a *serious* flaw in it.
>

If you've removed most of it, could it be that you removed most of it
after making the backup?

What I suspect you are seeing is a flaw which also exists in Sophos. By
default, only the first few k of each file is scanned. Scheduled and
on-demand scans should always be run with full scanning selected,
otherwise there's no point.

I've seen viruses lay dormant on backup drives for months, if not years.
The files are never accessed normally, so there is nothing to trigger
on-access virus checking and on-demand scanning just kept missing them
after being setup incorrectly.

Having said that, I would recommend you submit the infected file to AVG
just to be sure it's not a slightly different version of the virus,
explaining what you have seen happen.

--
Richard Kirkcaldy

"Richard Kirkcaldy" <> wrote in message
newsiyVb.17491$...
> half_pint wrote:
>
> > AVG virus software fails to detect viruses!!!
> >
> > I ran a virus scan today with an uptoday version
> > of AGV 6 virus software. Fine, no viruses detected.
> > I then decided to run it on my old hard drive (dwhich
> > I had connected as a slave drive.
> > Result virus found!!!
> >
> > This was a surprise because my old drive was a copy
> > of my current drive!!!
> > Anyway the virus/trojan was "startpage" or startpage.DG
> > or whatever it is called (it's 'harmless' one), it
> > was hiding in
> > d:\program files\common files\microsoft shared\msinfo\msinfo.exe
> > (57,244 bytes)
> >
> > I then went back to my c: drive and checked in this location and
> > sure enough the same file was there and it was reported as a virus
> > with an *individual* AGV file scan.
> > I was a bit shocked at this so I ran a complete check on my c:drive
> > again (Opened AGV and clicked 'run complete test' (although it appears
> > to only check your main drive anyway!) and it ran its check on
> > drive c:, - result - no viruses found!! even though an individual
> > check on the file (which I did not remove) shows it to be a
> > virus/trojan!!.
> >
> > So it appears AGV virus software is *serioously* flawed!!!!
> >
> > I believe I knew about this virus for some time as I had removed
> > most of it before with some anti-hijack software so it did not
> > affect my computer.
> >
> > However I was shocked to discover that AGV's virus scan missed it
> > completely!
> > AGV's anti virus appears to have a *serious* flaw in it.
> >
>
> If you've removed most of it, could it be that you removed most of it
> after making the backup?

No I very much doubt it.
I doubt I would have backed up a malfuncioning machine and I can't
seem to find anyother traces of the virus on the old drive (quick check)
assuming it is the same virus (both seemed to redirect searchs IIRC)
>
> What I suspect you are seeing is a flaw which also exists in Sophos. By
> default, only the first few k of each file is scanned. Scheduled and
> on-demand scans should always be run with full scanning selected,
> otherwise there's no point.

When I scanned the old d: drive it reported scanning 1.4ish meg
of a 2gig disc with 530 gig free.(seemed to do it all)
When I scanned the new c: drive (3gig) it only reported scanning a gig
or so which means it missed about a gig as it has about 850meg free.

>
> I've seen viruses lay dormant on backup drives for months, if not years.
> The files are never accessed normally, so there is nothing to trigger
> on-access virus checking and on-demand scanning just kept missing them
> after being setup incorrectly.

Well I clicked 'run complete test' "which tests all drives" (it didn't
it only partially checked c: ) so thats a definite fault for a start!!!
>
> Having said that, I would recommend you submit the infected file to AVG
> just to be sure it's not a slightly different version of the virus,
> explaining what you have seen happen


I sent off a report, although I was a bit suspicious when it tried to
access the internet in the background (sneakilly), I wouldn't let it!!
It sends it by email (although that failed when I stopped AGV) but
I posted it manually anyway.

--
---------------
regards half_pint
>
> --
> Richard Kirkcaldy

>
> Having said that, I would recommend you submit the infected file to AVG
> just to be sure it's not a slightly different version of the virus,
> explaining what you have seen happen.

I did send a report but they told me to bugger off because I
use the free version!!

>
> --
> Richard Kirkcaldy

"Richard Kirkcaldy" <> wrote in message
newsiyVb.17491$...
> half_pint wrote:
>
> > AVG virus software fails to detect viruses!!!
> >
> > I ran a virus scan today with an uptoday version
> > of AGV 6 virus software. Fine, no viruses detected.
> > I then decided to run it on my old hard drive (dwhich
> > I had connected as a slave drive.
> > Result virus found!!!
> >
> > This was a surprise because my old drive was a copy
> > of my current drive!!!
> > Anyway the virus/trojan was "startpage" or startpage.DG
> > or whatever it is called (it's 'harmless' one), it
> > was hiding in
> > d:\program files\common files\microsoft shared\msinfo\msinfo.exe
> > (57,244 bytes)
> >
> > I then went back to my c: drive and checked in this location and
> > sure enough the same file was there and it was reported as a virus
> > with an *individual* AGV file scan.
> > I was a bit shocked at this so I ran a complete check on my c:drive
> > again (Opened AGV and clicked 'run complete test' (although it appears
> > to only check your main drive anyway!) and it ran its check on
> > drive c:, - result - no viruses found!! even though an individual
> > check on the file (which I did not remove) shows it to be a
> > virus/trojan!!.
> >
> > So it appears AGV virus software is *serioously* flawed!!!!
> >
> > I believe I knew about this virus for some time as I had removed
> > most of it before with some anti-hijack software so it did not
> > affect my computer.
> >
> > However I was shocked to discover that AGV's virus scan missed it
> > completely!
> > AGV's anti virus appears to have a *serious* flaw in it.
> >
>
> If you've removed most of it, could it be that you removed most of it
> after making the backup?

I actually remember using the virus scan to compare the speeds
of the two drive because it reports the time it takes to complete
the scan.
Neither reported the virus, and both disks were conected
seperately as master.
I thought a scan would be a good clock as both disks were identical.
however I an unsure of the results now (my new drive was quicker,
as I expected (but it's a bloddy noisy bugger too!!).
Interestingly the file in question has a creation date of 11/5/98
which is the same as all bar one of the other files in the
directory, which is odd to say the least.
I bet if it get a copy from microsoft it will fail the scan too!!

>
> What I suspect you are seeing is a flaw which also exists in Sophos. By
> default, only the first few k of each file is scanned. Scheduled and
> on-demand scans should always be run with full scanning selected,
> otherwise there's no point.
>
> I've seen viruses lay dormant on backup drives for months, if not years.
> The files are never accessed normally, so there is nothing to trigger
> on-access virus checking and on-demand scanning just kept missing them
> after being setup incorrectly.
>
> Having said that, I would recommend you submit the infected file to AVG
> just to be sure it's not a slightly different version of the virus,
> explaining what you have seen happen.
>
> --
> Richard Kirkcaldy

On Mon, 9 Feb 2004 00:26:15 -0000, "half_pint" <>
wrote:

>
>"Richard Kirkcaldy" <> wrote in message
>newsiyVb.17491$...
>> half_pint wrote:
>>
>> > AVG virus software fails to detect viruses!!!
>> >
>> > I ran a virus scan today with an uptoday version
>> > of AGV 6 virus software. Fine, no viruses detected.
>> > I then decided to run it on my old hard drive (dwhich
>> > I had connected as a slave drive.
>> > Result virus found!!!
>> >
>> > This was a surprise because my old drive was a copy
>> > of my current drive!!!
>> > Anyway the virus/trojan was "startpage" or startpage.DG
>> > or whatever it is called (it's 'harmless' one), it
>> > was hiding in
>> > d:\program files\common files\microsoft shared\msinfo\msinfo.exe
>> > (57,244 bytes)
>> >
>> > I then went back to my c: drive and checked in this location and
>> > sure enough the same file was there and it was reported as a virus
>> > with an *individual* AGV file scan.
>> > I was a bit shocked at this so I ran a complete check on my c:drive
>> > again (Opened AGV and clicked 'run complete test' (although it appears
>> > to only check your main drive anyway!) and it ran its check on
>> > drive c:, - result - no viruses found!! even though an individual
>> > check on the file (which I did not remove) shows it to be a
>> > virus/trojan!!.
>> >
>> > So it appears AGV virus software is *serioously* flawed!!!!
>> >
>> > I believe I knew about this virus for some time as I had removed
>> > most of it before with some anti-hijack software so it did not
>> > affect my computer.
>> >
>> > However I was shocked to discover that AGV's virus scan missed it
>> > completely!
>> > AGV's anti virus appears to have a *serious* flaw in it.
>> >
>>
>> If you've removed most of it, could it be that you removed most of it
>> after making the backup?
>
>I actually remember using the virus scan to compare the speeds
>of the two drive because it reports the time it takes to complete
>the scan.
>Neither reported the virus, and both disks were conected
>seperately as master.
>I thought a scan would be a good clock as both disks were identical.
>however I an unsure of the results now (my new drive was quicker,
>as I expected (but it's a bloddy noisy bugger too!!).
>Interestingly the file in question has a creation date of 11/5/98
>which is the same as all bar one of the other files in the
>directory, which is odd to say the least.
>I bet if it get a copy from microsoft it will fail the scan too!!
>
>>
>> What I suspect you are seeing is a flaw which also exists in Sophos. By
>> default, only the first few k of each file is scanned. Scheduled and
>> on-demand scans should always be run with full scanning selected,
>> otherwise there's no point.
>>
>> I've seen viruses lay dormant on backup drives for months, if not years.
>> The files are never accessed normally, so there is nothing to trigger
>> on-access virus checking and on-demand scanning just kept missing them
>> after being setup incorrectly.
>>
>> Having said that, I would recommend you submit the infected file to AVG
>> just to be sure it's not a slightly different version of the virus,
>> explaining what you have seen happen.
>>
>> --
>> Richard Kirkcaldy
>

Try one or both of these online virus scanners
http://www.pandasoftware.com/activescan
http://housecall.antivirus.com

Also look at the Avast antivirus program www.avast.com I use it and AVG
(on different computers). Avast seems to have a slicker interface, and I
like the way it updates better.

JT

"JT" <datacare@www> wrote in message
news: s.com...
> On Mon, 9 Feb 2004 00:26:15 -0000, "half_pint" <>
> wrote:
>
> >
> >"Richard Kirkcaldy" <> wrote in message
> >newsiyVb.17491$...
> >> half_pint wrote:
> >>
> >> > AVG virus software fails to detect viruses!!!
> >> >
> >> > I ran a virus scan today with an uptoday version
> >> > of AGV 6 virus software. Fine, no viruses detected.
> >> > I then decided to run it on my old hard drive (dwhich
> >> > I had connected as a slave drive.
> >> > Result virus found!!!
> >> >
> >> > This was a surprise because my old drive was a copy
> >> > of my current drive!!!
> >> > Anyway the virus/trojan was "startpage" or startpage.DG
> >> > or whatever it is called (it's 'harmless' one), it
> >> > was hiding in
> >> > d:\program files\common files\microsoft shared\msinfo\msinfo.exe
> >> > (57,244 bytes)
> >> >
> >> > I then went back to my c: drive and checked in this location and
> >> > sure enough the same file was there and it was reported as a virus
> >> > with an *individual* AGV file scan.
> >> > I was a bit shocked at this so I ran a complete check on my c:drive
> >> > again (Opened AGV and clicked 'run complete test' (although it
appears
> >> > to only check your main drive anyway!) and it ran its check on
> >> > drive c:, - result - no viruses found!! even though an individual
> >> > check on the file (which I did not remove) shows it to be a
> >> > virus/trojan!!.
> >> >
> >> > So it appears AGV virus software is *serioously* flawed!!!!
> >> >
> >> > I believe I knew about this virus for some time as I had removed
> >> > most of it before with some anti-hijack software so it did not
> >> > affect my computer.
> >> >
> >> > However I was shocked to discover that AGV's virus scan missed it
> >> > completely!
> >> > AGV's anti virus appears to have a *serious* flaw in it.
> >> >
> >>
> >> If you've removed most of it, could it be that you removed most of it
> >> after making the backup?
> >
> >I actually remember using the virus scan to compare the speeds
> >of the two drive because it reports the time it takes to complete
> >the scan.
> >Neither reported the virus, and both disks were conected
> >seperately as master.
> >I thought a scan would be a good clock as both disks were identical.
> >however I an unsure of the results now (my new drive was quicker,
> >as I expected (but it's a bloddy noisy bugger too!!).
> >Interestingly the file in question has a creation date of 11/5/98
> >which is the same as all bar one of the other files in the
> >directory, which is odd to say the least.
> >I bet if it get a copy from microsoft it will fail the scan too!!

I know believe it is not a true MS file anyway.


> >
> >>
> >> What I suspect you are seeing is a flaw which also exists in Sophos.
By
> >> default, only the first few k of each file is scanned. Scheduled and
> >> on-demand scans should always be run with full scanning selected,
> >> otherwise there's no point.
> >>
> >> I've seen viruses lay dormant on backup drives for months, if not
years.
> >> The files are never accessed normally, so there is nothing to trigger
> >> on-access virus checking and on-demand scanning just kept missing them
> >> after being setup incorrectly.
> >>
> >> Having said that, I would recommend you submit the infected file to AVG
> >> just to be sure it's not a slightly different version of the virus,
> >> explaining what you have seen happen.
> >>
> >> --
> >> Richard Kirkcaldy
> >
>
> Try one or both of these online virus scanners
> http://www.pandasoftware.com/activescan
> http://housecall.antivirus.com

I may do but they tend to take a while.
AGV finds it if I do an *individual* check on it, but not during a scan.
Well I am downloading it now, its going to take a long time!!
(I am sure it will probably work?)

>
> Also look at the Avast antivirus program www.avast.com I use it and AVG
> (on different computers). Avast seems to have a slicker interface, and I
> like the way it updates better.
>
> JT

"half_pint" <> wrote in news:c06o6k$13k4fd$1@ID-
204080.news.uni-berlin.de:

> I may do but they tend to take a while.
> AGV finds it if I do an *individual* check on it, but not during a scan.
> Well I am downloading it now, its going to take a long time!!
> (I am sure it will probably work?)
>

You've continually misnamed the antivirus software throughout these posts.
That tends to set off alarms.

I use AVG free version and I was quite happy with it until read this thread.

I just ran HouseCall and it found Mydoom.dam in one of my zip backup files
on my backup partition. Before deleting it I then ran AVG on the infected
file and it found nothing.

Now that's a definite worry

Strangely, the virus wasn't present in the original files.

--
Ken Russell


"half_pint" <> wrote in message
news:c0683s$vjh28$...
| AVG virus software fails to detect viruses!!!
|
| I ran a virus scan today with an uptoday version
| of AGV 6 virus software. Fine, no viruses detected.
| I then decided to run it on my old hard drive (dwhich
| I had connected as a slave drive.
| Result virus found!!!
|
| This was a surprise because my old drive was a copy
| of my current drive!!!
| Anyway the virus/trojan was "startpage" or startpage.DG
| or whatever it is called (it's 'harmless' one), it
| was hiding in
| d:\program files\common files\microsoft shared\msinfo\msinfo.exe
| (57,244 bytes)
|
| I then went back to my c: drive and checked in this location and
| sure enough the same file was there and it was reported as a virus
| with an *individual* AGV file scan.
| I was a bit shocked at this so I ran a complete check on my c:drive
| again (Opened AGV and clicked 'run complete test' (although it appears
| to only check your main drive anyway!) and it ran its check on
| drive c:, - result - no viruses found!! even though an individual
| check on the file (which I did not remove) shows it to be a
| virus/trojan!!.
|
| So it appears AGV virus software is *serioously* flawed!!!!
|
| I believe I knew about this virus for some time as I had removed
| most of it before with some anti-hijack software so it did not
| affect my computer.
|
| However I was shocked to discover that AGV's virus scan missed it
| completely!
| AGV's anti virus appears to have a *serious* flaw in it.
|
| --
| regards half_pint.
|
|


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.580 / Virus Database: 367 - Release Date: 6/02/2004

"donutbandit" <> wrote in message
news:c077n1$ijp$...
> "half_pint" <> wrote in news:c06o6k$13k4fd$1@ID-
> 204080.news.uni-berlin.de:
>
> > I may do but they tend to take a while.
> > AGV finds it if I do an *individual* check on it, but not during a scan.
> > Well I am downloading it now, its going to take a long time!!
> > (I am sure it will probably work?)
> >
>
> You've continually misnamed the antivirus software throughout these posts.
> That tends to set off alarms.

In the mind[sic]of pedantic spel checkers prehaps
>