Found a bug in AVG 6.0, build 518

[Chip]

Today I came across a file that contained the trojan Backdoor.Subseven,
which was not found by AVG 6.0/518. The file had a name such as
"xyzabc.avi.com". Because the filename had the .com extension, AVG failed
to properly scan the file when I saved it. Being suspicious, I ran "list
xyz*.com" to view the contents of that file, and found many references to
socket support, to pwd=, trojan=, etcetera. The start of the file had a
..EXE header, so I renamed the file to have .exe extension instead of .com.
Afterward, AVG finally found the trojan embedded within the file. The
problem I uncovered is that AVG is looking at filename extensions and making
erroneous decisions about what to scan for or how to scan. If the file had
arrived with .exe extension in the first place, I suspect AVG would have
warned of the infection to start with.

If I had not been diligent and suspicious, AVG would have allowed my system
to become infected despite having AVG actively running. Something like this
is way beyond normal users, who would have then screamed that AVG is broken
(or worse).

I sent the above note to AVG's techsupport, with the s/n they gave me, but I
receive an autoresponse that their bot cannot determine the s/n from my
message, and they do not want to hear from users of their free version. Oh
well, maybe they will read about it here instead, albeit a little belatedly.

 

[George W.]

If I had not been diligent and suspicious, AVG would have allowed my system
to become infected despite having AVG actively running.

This is true about any anti-virus program.....diligent and suspicious
are the key words. By the way AVG is up to 6.0.520. Since you still
have 518 it looks like may have missed an update or two.

 

[Chip]

This is true about any anti-virus program.....diligent and suspicious
are the key words. By the way AVG is up to 6.0.520. Since you still
have 518 it looks like may have missed an update or two.

 

[Chip]

This is true about any anti-virus program.....diligent and suspicious
are the key words. By the way AVG is up to 6.0.520. Since you still
have 518 it looks like may have missed an update or two.

The auto-update wasn't, so downloaded the fe and xx directories and manually
updated. I don't have the original message that avg failed to detect, so I
do not know if 520 will pick it up.