CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

Prevx2 support on suspected false positive malware

 
Post new topic   Reply to topic       All -> FavForums -> Prevx [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
giamorsi

Private
Private


Joined: Jul 25, 2007
Posts: 47
Location: Italy

PostPosted: Wed Jul 25, 2007 8:03 am    Post subject: Prevx2 support on suspected false positive malware
Reply with quote

A week ago i was informed by a prevx2 on-screen message that my "unlimited trial license till first cleanup" was going to trial for 60 days because the software prevented malware from running on my PC.

There was no evidence of this malware in the interface:

jail empty, all processes on green .......and no one else had access to the PC so in no way someone could have accessed the jail or something else like that.

I contacted the support and they asked me for px_console.log that i uploaded to them.

After this.....only silence.

I looked at the console log and i found no evidence of malware, but i could be wrong on this.

I repeatedly contacted the support, asking them if there was a problem, like if they needed something more info, or simply more time was needed to analyze the log.

Again, no answer.

Despite the fact the i feel safer with Prevx2 installed, and probably will buy it anyway if/when the trial license expire (also if i'd like it reverted to its unlimited trial period state if this is a false positive), i find disturbing a few things:

- that a malware can be found and i have no clue what this can be, or it can be found only looking at the logs. If it wasn't for the license change and if it's really a malware and not a false, i'd have no clue at all that there was a problem. One shouldn't only be protected, it should be also kept informed in my opinion.

- That support can disappear this way. I don't think that a simple "more time needed" or "we need also these info" would've taken all this time from them.

I'd like to know some others experiences / opinions on matters of this kind.

Despite the good qualities of a software support is also a thing that matters a lot to me. I don't like extended periods of silence like these ones, but it could be me.

Thanks in advance for sharing your opinion.

Best Regards

Back to top
View users profile Send private message
Biscuity

Lieutenant
Lieutenant


Joined: May 05, 2007
Posts: 227
Location: Isle of Man

PostPosted: Wed Jul 25, 2007 9:42 am    Post subject:
Reply with quote

Your experience seems to happen often with Prevx. The FPs in the trial have been seen by many posters. Regarding support, sometimes they are great, sometimes no response at all. I get the feeling that there are a few really good people at Prevx & the rest don't care. Otherwise I can't understand why the support is so inconsistent & why we get software releases that cause so many problems. Confused

It's a great idea, with flashes of great support. My vote is to put Darren in charge before they destroy the company!

Back to top
View users profile Send private message
Whinters

Cadet
Cadet


Joined: May 31, 2007
Posts: 7
Location: UK

PostPosted: Wed Jul 25, 2007 11:37 am    Post subject:
Reply with quote

Hi there,

I can't speak from a technical standpoint as ghiser or stubbs would, but I can assure you than any trial countdowns triggered due to false positives will always be reset.

giamorsi - I cannot understand why your messages into support have gone unanswered, therefore feel free to PM me your email address used for these communications and I'll look into it. Otherwise, please write into support again and I'll keep my eye out for it. Smile

Back to top
View users profile Send private message
giamorsi

Private
Private


Joined: Jul 25, 2007
Posts: 47
Location: Italy

PostPosted: Wed Jul 25, 2007 11:38 am    Post subject:
Reply with quote

Quick update: i just received an answer, not much satisfying.

It seems that my console reported them a bad file, the issue why nothing is in jail and there is no sign of bad program activity is , it'd seem, still under investigation.

I asked to the support to show me which lines of the log i sent them describe such a treat, since i took a quick look and didn't see any sign.

Without need to say it, if my console reported them something, and this triggered my license to change and expire soon, but i have no means to locally see this reported, the thing is .... i don't find the right word, but you got the meaning.

Let's hope the support will be able to answer this.

I'll keep you up to date with the situation

Back to top
View users profile Send private message
Whinters

Cadet
Cadet


Joined: May 31, 2007
Posts: 7
Location: UK

PostPosted: Wed Jul 25, 2007 11:42 am    Post subject:
Reply with quote

Ah, no problem then. It appears like it's being looked into Smile

Back to top
View users profile Send private message
giamorsi

Private
Private


Joined: Jul 25, 2007
Posts: 47
Location: Italy

PostPosted: Wed Jul 25, 2007 12:16 pm    Post subject:
Reply with quote

Thanks for the offer , Whinters, very very kind.

Hope this really solves in a satisfying way, and, as you read in the main post, this doesn't mean that for me to be satisfied my license must be reverted to unlimited.

But, till now, i don't see any local sign of this malware,even in the log file , and i wasn't able to deduce where this bad file could be from the answer the support gave me (both the bad filename and the name of the directory where it should be are pretty nebulous).

And i don't like very much the fact that a non-logged event is not considered a false positive.

So. for now, i like the soft but i have still to think about my opinion on the support.

Let's see how this solves Smile

Back to top
View users profile Send private message
ghiser1

Prevx Host
Premium Member

Joined: Jan 07, 2005
Posts: 315
Location: UK
Premium

PostPosted: Wed Jul 25, 2007 3:27 pm    Post subject:
Reply with quote

Biscuity wrote:
Your experience seems to happen often with Prevx. The FPs in the trial have been seen by many posters. Regarding support, sometimes they are great, sometimes no response at all. I get the feeling that there are a few really good people at Prevx & the rest don't care. Otherwise I can't understand why the support is so inconsistent & why we get software releases that cause so many problems. Confused

It's a great idea, with flashes of great support. My vote is to put Darren in charge before they destroy the company!


Thanks for the support Buscuity Embarassed Very Happy

Not sure on the reason lack of response on this particular support call, I know a few of us have been caught up in the bad weather and flooding over here. It may just have slipped through the cracks.

Back to top
View users profile Send private message
ghiser1

Prevx Host
Premium Member

Joined: Jan 07, 2005
Posts: 315
Location: UK
Premium

PostPosted: Wed Jul 25, 2007 3:35 pm    Post subject:
Reply with quote

giamorsi wrote:
But, till now, i don't see any local sign of this malware,even in the log file , and i wasn't able to deduce where this bad file could be from the answer the support gave me (both the bad filename and the name of the directory where it should be are pretty nebulous).


Hi giamorsi,

We think we're getting somewhere on this one. It looks from the central data on the CWC that you had a program that we had classified as Caution - that is risk-ware as opposed to malware. It seems that we are currently triggering trial countdowns when risk-ware is encountered as well as when malware is encountered. The reason you don't see anything in the Jail is that only malware is shown there - an issue in itself. We're currently reviewing the handling of risk-ware by the agent and the CWC to ensure that it is handled correctly and doesn't trigger trial countdowns inadvertantly.

Regards,

Darren

Back to top
View users profile Send private message
Biscuity

Lieutenant
Lieutenant


Joined: May 05, 2007
Posts: 227
Location: Isle of Man

PostPosted: Wed Jul 25, 2007 4:58 pm    Post subject:
Reply with quote

ghiser1 wrote:
Thanks for the support Buscuity Embarassed Very Happy


No probs! I still fully support the software & the whole Prevx project, but someone somewhere needs to be given a kick up the backside! I'm hoping that you know who that person should be! Wink Shocked [/b]

Back to top
View users profile Send private message
giamorsi

Private
Private


Joined: Jul 25, 2007
Posts: 47
Location: Italy

PostPosted: Thu Jul 26, 2007 7:57 am    Post subject:
Reply with quote

ghiser1 wrote:


Hi giamorsi,

We think we're getting somewhere on this one. It looks from the central data on the CWC that you had a program that we had classified as Caution - that is risk-ware as opposed to malware. It seems that we are currently triggering trial countdowns when risk-ware is encountered as well as when malware is encountered. The reason you don't see anything in the Jail is that only malware is shown there - an issue in itself. We're currently reviewing the handling of risk-ware by the agent and the CWC to ensure that it is handled correctly and doesn't trigger trial countdowns inadvertantly.

Regards,

Darren


Hi, ghiser1 Smile

Thanks for the further info.

If i understood well that means that shortly riskware should appear not only detected but also showed by the console, which is really a very appreciated thing since i'd like to know what could be wrong in a machine were i work.

And also that my license should revert to unlimited trial.

Are these two right?

And i'd like an advise: do you think it's better for me to contact the support again or simply wait a little more?
The last thing i heard from them is that the reason for malware not showing was being investigated (on the matter you shed light, thanks again) and that the license couldn't be reset since malware was encountered, and this should not be true anymore.

Thanks in advance and my Best Regards

Back to top
View users profile Send private message
giamorsi

Private
Private


Joined: Jul 25, 2007
Posts: 47
Location: Italy

PostPosted: Tue Jul 31, 2007 8:15 am    Post subject:
Reply with quote

A little update: i contacted the prevx2 support again pointing out that, not being malware, i thought the license should be reset.

This was last week.

Again, no answer from them Sad

Back to top
View users profile Send private message
giamorsi

Private
Private


Joined: Jul 25, 2007
Posts: 47
Location: Italy

PostPosted: Wed Aug 01, 2007 3:07 pm    Post subject:
Reply with quote

Just received tihs one from the support.

**************

Hi again,

As far as I can tell this is something that is still being investigated. The
problem is that you have encountered something marked as "bad", therefore it is
impossible to revert your trial in this case.

I understand from reading Darren's reply on Castlecops that they believe the
"bad" in question to be "Caution" or "Riskware", and how these are handled are
still being discussed.

Sorry we're unable to provide more information or progress at this time, but
will keep this support call open and be in touch once a resolution has been
reached.

**************************

So the caution or riskware, for which handling is still being discussed, seems to be out of question for me.

I'm becoming confused again.

I've had a "bad" that is not reported anywhere it'd seem.
Doesn't make much sense for me.

Let's hope investigations bring some light on it.

Best Regards

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Prevx All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer