Forum Moderators: phranque
Since nothing is there but the latest version of VB, I questioned the company on why this was happening, and wonder of wonder, got a reply. This part makes me wonder:
..This IP address was previously
shared with an exploit server. This has now been cleaned up...
Are they saying that since this is on a shared host that someone else (of the 16,000 or so?) on that same shared host was causing us to get false AVG warnings?
I don't understand this...
But that is not the question, question was, does all it take is one bad apple on a shared host to flag the whole domain series.
It may have not been one bad apple. An exploit server could consist of many domains or subdomains hosted by one individual or it could have infected many other innocent domains on the same server through some sort of security hole.
It is only since their recent upgrade that they set themselves up as the internet police.
They are simply not qualified for the job.
It is only since their recent upgrade that they set themselves up as the internet police.
It was the inclusion of LinkScanner that did that, which is new in version 8.
The problem with Linkscanner it seems is that they don't do real time checking - if they find a site that is "bad", the IP goes into their database and may not be updated for days, weeks, or months.
While LS might be useful, I wonder how many other false positives are out there because of an out of date DB.
AVG was pretty good and quite fast about checking and fixing the false positive on our IP, I wonder how many others are out there, and how often they update their data.
[edited by: Wlauzon at 7:05 pm (utc) on May 13, 2008]
how often they update their data
Roll-out of whatever new data they have seems to be done at least every 24 hours - an updated LinkScanner database (presumably of IP addresses) comes down every morning here.
Seems like Grisoft have much to learn
Making their stealthbot [webmasterworld.com] a bit stealthier would be a start.
They seem to know all about Windows and nothing about the internet.
Just like [insert name here].
Kaled.
...an updated LinkScanner database (presumably of IP addresses) comes down every morning here....
Yes, but how often do they actually check the IP/URL?
I kind of got the impression that unless someone complains, they don't actively go out and re-evaluate the offending IP's.
So the new database might have new data, but how good is that data?
how often do they actually check the IP/URL?
Given what you reported I would draw a distinction between the two.
URLs are checked locally every time they appear in Google/Yahoo/MSN search results, but whether the findings are transmitted to AVG may depend on the optional setting about sending information (the kind of thing most users ignore but which I always uncheck).
I suspect that the LinkScanner database (updated daily here) primarily holds blacklisted IPs, which as you found out the hard way can condemn a lot of innocent sites on a shared server.
I have always been happy for AVG to police Windows, but I don't want them policing the web (even if they were any good at it, which they clearly are not).
I would rather not install a "net-nanny" unless I ask for one.
