Grisoft modifies its free AVG product after complaints

On Thursday, Webmasters around the world noticed unusual spikes in traffic. For some smaller sites the sudden surge of Web traffic toward their sites appeared to be almost a denial-of-service attack.

Turns out it was the free version of AVG Antivirus 8.0 just doing its job.

In a statement on Saturday, Grisoft said "We have actively listened to the Webmasters who have brought this to our attention, and as a company we have reacted quickly to solve them." What it did was issue a new build of the popular free program.

What's different in version 8 from previous versions is the inclusion of Linkscanner, a scanner that stops malware components embedded on compromised Web pages. LinkScanner was created by Exploit Prevention Labs and purchased last summer by Grisoft, maker of AVG products.

One feature of LinkScanner, Secure Shield, works by downloading the home page of each site returned in a common Web search then populates the search result page with colored icons indicating the relative safety of those sites. The feature, which has been previously available, apparently didn't scale to the large numbers of AVG free customers. On Monday, Roger Thompson, who developed LinkScanner and is now chief research officer for Grisoft, confessed, "We knew it would create a spike of some sort, but nothing like what happened."

How dramatic was the surge in traffic? The site AVG-Watch.org provides charts on bandwidth use after the release of AVG 8.0.

In an e-mail to CNET News, Thompson went on to say: "We did not consider the multiplying effect of any given Web site's own marketing within search engine results. In other words, if a Web site, through its marketing, became a common search result, it was scanned much more often than we expected. As soon as we found out, we gathered some data, talked to some Webmasters, and figured out what to do."

However, Thompson disputed a claim by AVG-Watch.org that the updated AVG version now only "pretends to prefetch," and does little more than a DNS (Domain Name System) lookup of the site. Thompson said "it doesn't pretend to pre-scan. It just works off the local blacklist. That involves a DNS lookup, so that we can compare both IPs and URLs."

Making matters worse last week, AVG disguised the scans as coming from Internet Explorer 6 browsers, and not Secure Shield. For a few days it was unclear who was responsible for the surge in Internet traffic. Thompson said they could have made the LinkScanner scans entirely stealth, but they wanted to give Webmasters the option of filtering the scans.

"The real issue is that, like it or not, we're at war on the Web," said Thompson. "Criminals, both organized and opportunistic want our PCs and our money, and they're attacking via the Web. It's no longer like the old days when they wrote this stuff for fun."

[Daniel_Brandt]

I don't understand why Thompson is claiming why a DNS lookup is needed along with the URL for purposes of checking a local blacklist. Due to name-based hosting, many diverse sites frequently share the same IP address. This address by itself tells you nothing about how dangerous a site may be, unless you are willing to simultaneously incriminate every other site that may be on that same IP address. Until someone educates me about the esoteric discipline of anti-virus engineering, I stand by my statement that AVG is "pretending to prefetch." I suspect that the cool green check marks are alluring for mom and pop, who might otherwise feel uneasy about using the web. They are a psychological success but have no technical function, now that the site prefetch "feature" has been disabled, and AVG no longer needs the IP address to fetch each link that's shown on page of search results.

[pbitton]

Just a quick note - the AVG component at issue here is named Search-Shield, not Secure Shield.

[Vegaman_Dan]

They listened to web masters complaining about the sudden huge surge of artificial hits to their sites which costs some groups bandwidth and very real economic results.
They said earlier that they intended to break a few eggs (websites) in order to make the omelette.

Here they say they are now at war on the web- but they don't say with whom. To me it looks like they are at war with the entire web. I'm embarassed to have had this product on my system in the past and cannot in good faith ever suggest it to anyone ever again. Not when they pull this sort of drity trick- and there really is no other term for it. What they are doing is dirty and can only cause problems for everyone involved.