|
Donation/Premium |
|
 |
|
|
|
|
|
|
|
 |
 |
| View previous topic :: View next topic |
| Author |
Message |
giamorsi
Private

 Joined: Jul 25, 2007 Posts: 47 Location: Italy
|
Posted: Wed Jul 25, 2007 8:03 am Post subject: Prevx2 support on suspected false positive malware |
|
|
A week ago i was informed by a prevx2 on-screen message that my "unlimited trial license till first cleanup" was going to trial for 60 days because the software prevented malware from running on my PC.
There was no evidence of this malware in the interface:
jail empty, all processes on green .......and no one else had access to the PC so in no way someone could have accessed the jail or something else like that.
I contacted the support and they asked me for px_console.log that i uploaded to them.
After this.....only silence.
I looked at the console log and i found no evidence of malware, but i could be wrong on this.
I repeatedly contacted the support, asking them if there was a problem, like if they needed something more info, or simply more time was needed to analyze the log.
Again, no answer.
Despite the fact the i feel safer with Prevx2 installed, and probably will buy it anyway if/when the trial license expire (also if i'd like it reverted to its unlimited trial period state if this is a false positive), i find disturbing a few things:
- that a malware can be found and i have no clue what this can be, or it can be found only looking at the logs. If it wasn't for the license change and if it's really a malware and not a false, i'd have no clue at all that there was a problem. One shouldn't only be protected, it should be also kept informed in my opinion.
- That support can disappear this way. I don't think that a simple "more time needed" or "we need also these info" would've taken all this time from them.
I'd like to know some others experiences / opinions on matters of this kind.
Despite the good qualities of a software support is also a thing that matters a lot to me. I don't like extended periods of silence like these ones, but it could be me.
Thanks in advance for sharing your opinion.
Best Regards
|
|
| Back to top |
|
 |
Biscuity
Lieutenant

 Joined: May 05, 2007 Posts: 227 Location: Isle of Man
|
Posted: Wed Jul 25, 2007 9:42 am Post subject: |
|
|
Your experience seems to happen often with Prevx. The FPs in the trial have been seen by many posters. Regarding support, sometimes they are great, sometimes no response at all. I get the feeling that there are a few really good people at Prevx & the rest don't care. Otherwise I can't understand why the support is so inconsistent & why we get software releases that cause so many problems.
It's a great idea, with flashes of great support. My vote is to put Darren in charge before they destroy the company!
|
|
| Back to top |
|
 |
Whinters
Cadet

 Joined: May 31, 2007 Posts: 7 Location: UK
|
Posted: Wed Jul 25, 2007 11:37 am Post subject: |
|
|
Hi there,
I can't speak from a technical standpoint as ghiser or stubbs would, but I can assure you than any trial countdowns triggered due to false positives will always be reset.
giamorsi - I cannot understand why your messages into support have gone unanswered, therefore feel free to PM me your email address used for these communications and I'll look into it. Otherwise, please write into support again and I'll keep my eye out for it. 
|
|
| Back to top |
|
 |
giamorsi
Private

 Joined: Jul 25, 2007 Posts: 47 Location: Italy
|
Posted: Wed Jul 25, 2007 11:38 am Post subject: |
|
|
Quick update: i just received an answer, not much satisfying.
It seems that my console reported them a bad file, the issue why nothing is in jail and there is no sign of bad program activity is , it'd seem, still under investigation.
I asked to the support to show me which lines of the log i sent them describe such a treat, since i took a quick look and didn't see any sign.
Without need to say it, if my console reported them something, and this triggered my license to change and expire soon, but i have no means to locally see this reported, the thing is .... i don't find the right word, but you got the meaning.
Let's hope the support will be able to answer this.
I'll keep you up to date with the situation
|
|
| Back to top |
|
 |
Whinters
Cadet

 Joined: May 31, 2007 Posts: 7 Location: UK
|
Posted: Wed Jul 25, 2007 11:42 am Post subject: |
|
|
Ah, no problem then. It appears like it's being looked into 
|
|
| Back to top |
|
 |
giamorsi
Private

 Joined: Jul 25, 2007 Posts: 47 Location: Italy
|
Posted: Wed Jul 25, 2007 12:16 pm Post subject: |
|
|
Thanks for the offer , Whinters, very very kind.
Hope this really solves in a satisfying way, and, as you read in the main post, this doesn't mean that for me to be satisfied my license must be reverted to unlimited.
But, till now, i don't see any local sign of this malware,even in the log file , and i wasn't able to deduce where this bad file could be from the answer the support gave me (both the bad filename and the name of the directory where it should be are pretty nebulous).
And i don't like very much the fact that a non-logged event is not considered a false positive.
So. for now, i like the soft but i have still to think about my opinion on the support.
Let's see how this solves 
|
|
| Back to top |
|
 |
ghiser1
Prevx Host Premium Member
 Joined: Jan 07, 2005 Posts: 315 Location: UK
|
|
| Back to top |
|
 |
ghiser1
Prevx Host Premium Member
 Joined: Jan 07, 2005 Posts: 315 Location: UK
|
Posted: Wed Jul 25, 2007 3:35 pm Post subject: |
|
|
| giamorsi wrote: | But, till now, i don't see any local sign of this malware,even in the log file , and i wasn't able to deduce where this bad file could be from the answer the support gave me (both the bad filename and the name of the directory where it should be are pretty nebulous).
|
Hi giamorsi,
We think we're getting somewhere on this one. It looks from the central data on the CWC that you had a program that we had classified as Caution - that is risk-ware as opposed to malware. It seems that we are currently triggering trial countdowns when risk-ware is encountered as well as when malware is encountered. The reason you don't see anything in the Jail is that only malware is shown there - an issue in itself. We're currently reviewing the handling of risk-ware by the agent and the CWC to ensure that it is handled correctly and doesn't trigger trial countdowns inadvertantly.
Regards,
Darren
|
|
| Back to top |
|
 |
Biscuity
Lieutenant

 Joined: May 05, 2007 Posts: 227 Location: Isle of Man
|
|
| Back to top |
|
 |
giamorsi
Private

 Joined: Jul 25, 2007 Posts: 47 Location: Italy
|
Posted: Thu Jul 26, 2007 7:57 am Post subject: |
|
|
| ghiser1 wrote: |
Hi giamorsi,
We think we're getting somewhere on this one. It looks from the central data on the CWC that you had a program that we had classified as Caution - that is risk-ware as opposed to malware. It seems that we are currently triggering trial countdowns when risk-ware is encountered as well as when malware is encountered. The reason you don't see anything in the Jail is that only malware is shown there - an issue in itself. We're currently reviewing the handling of risk-ware by the agent and the CWC to ensure that it is handled correctly and doesn't trigger trial countdowns inadvertantly.
Regards,
Darren |
Hi, ghiser1
Thanks for the further info.
If i understood well that means that shortly riskware should appear not only detected but also showed by the console, which is really a very appreciated thing since i'd like to know what could be wrong in a machine were i work.
And also that my license should revert to unlimited trial.
Are these two right?
And i'd like an advise: do you think it's better for me to contact the support again or simply wait a little more?
The last thing i heard from them is that the reason for malware not showing was being investigated (on the matter you shed light, thanks again) and that the license couldn't be reset since malware was encountered, and this should not be true anymore.
Thanks in advance and my Best Regards
|
|
| Back to top |
|
 |
giamorsi
Private

 Joined: Jul 25, 2007 Posts: 47 Location: Italy
|
Posted: Tue Jul 31, 2007 8:15 am Post subject: |
|
|
A little update: i contacted the prevx2 support again pointing out that, not being malware, i thought the license should be reset.
This was last week.
Again, no answer from them 
|
|
| Back to top |
|
 |
giamorsi
Private

 Joined: Jul 25, 2007 Posts: 47 Location: Italy
|
Posted: Wed Aug 01, 2007 3:07 pm Post subject: |
|
|
Just received tihs one from the support.
**************
Hi again,
As far as I can tell this is something that is still being investigated. The
problem is that you have encountered something marked as "bad", therefore it is
impossible to revert your trial in this case.
I understand from reading Darren's reply on Castlecops that they believe the
"bad" in question to be "Caution" or "Riskware", and how these are handled are
still being discussed.
Sorry we're unable to provide more information or progress at this time, but
will keep this support call open and be in touch once a resolution has been
reached.
**************************
So the caution or riskware, for which handling is still being discussed, seems to be out of question for me.
I'm becoming confused again.
I've had a "bad" that is not reported anywhere it'd seem.
Doesn't make much sense for me.
Let's hope investigations bring some light on it.
Best Regards
|
|
| Back to top |
|
 |
|
|
|
You can post new topics in this forum You can reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum
|
Powered by phpBB © 2001 phpBB Group
|