Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Whenever I'm programming in C++, after I run a new executable, Avast suspends it informing me that "not much is known" about the file and asking if I'd like to continue execution or terminate the process. It's done this to a few files I've downloaded from the web too. Sadly, I just got a virus. So how is it while it's so paranoid a virus can sneak through?

I could see it if Avast reported "not much is known about this file" but to categorize a virus as safe certainly is a large slip up.

share|improve this question
2  
Nothing (and nobody) is perfect. You should have been more paranoid, though. –  Deer Hunter Aug 19 '13 at 8:35

1 Answer 1

up vote 1 down vote accepted

File reputation simply put is how much is known about the file in hand. If you have a file (executable) that you have created, the file will not be known on the internet. Well known files are the ones that have been around on the internet for a while and have been tested negative for malicious code. For example, Google Chrome executable would be a well known file as many users would have used it and many AV agents reported it to the reputation server to be clean. when you run an executable file, your AV agent will test it against virus signature. If the file did not match any signature, the agent (the ones that support reputation testing) will query the server about the information on the file. If many userss have used it and it was not reported as malicious, you get a response that the file is safe. Some times the response is that the file has no reputation as it is new and you should be careful if you dont know the origin of the file. I believe this is how you got the virus.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.