OSBlues

The Register are running a further follow up article “AVG disguises fake traffic as IE6“, which states that AVG are now using a “new” user agent for the paid version of AVG’s LinkScanner.

This has been confirmed by Roger Thompson in the AVG Webscanning Google Group, to which I’m a member.  When asked if it was true Roger said –

..Yes, it’s true, but it’s not quite what it seems. It was a planned
service release that was already in the works when we found out about
the issue, and fixed some other critical issues at the same time.

It changes the User Agent string to SV1, but it leaves some of the
other request headers so that they’re different enough that you can
still parse them out of stats if you want to..

I personally don’t really see this as a “new” user agent, as I’m already filtering my logs for this one.  From what I’ve read, this is the original agent used by LinkScanner before they were purchased by AVG, so it’s already mentioned in my initial AVG log spam post.

That aside, it’s still not a great move from AVG at this point.  They are supposed to be working with the community (myself included) to resolve this from a webmasters point of view, switching (well mixing in another) user agent at this point is a little silly.

At this point I need to credit Michael Ducy who tipped me off this change yesterday, he however claims it’s affecting the free version also –

AVG changed the user agent with the latest release. They now use “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)”. I confirmed this by downloading and installing AVG free this morning and using wireshark to sniff the traffic.

The saga continues..

:: :: :: :: :: :: :: :: :: :: :: :: :: :: :: ::

Over the weekend, I had an email from Karel Obluk at AVG inviting me to a Google Group they have set-up for discussions around the AVG logfile spam issue.

..I would like to invite you to participate in a group dedicated to discussion
about AVG LinkScanner technology, its advantages as well as potential impact
on web sites, the nature of recent web threats and ways of protecting both
users and web masters. Your input and feedback will be highly appreciated.
The group is closed and by invitation only..

I have accepted the invite but unfortunately now have to be re-approved as I used a different email address (my Google account).

Hopefully we’re getting somewhere on this issue.

:: :: :: :: :: :: :: :: :: :: :: :: :: :: :: ::