Very impressed with VBA32.

[SDS909]

I've been a pretty devoted NOD32 fan. Before that I was a MKS/Arca advocate, but left them due to the added firewall/bloat, poor interface and design, and slow threat response. Also it was light, but I wanted lighter.

I went to Dr.Web, they've been great. However they have been very slow in responding to threats lately, and sometimes my emails and submissions get totally ignored. (as seen recently in another thread). Also Dr.Web seems slow about progress, new versions, and improvements. But it was light, and reasonably powerful, so I stuck with it.

I recently tried VBA32 because of their new Dr.Web-like setting for checking only new/changed files. I have to say it is every bit as light, possibly lighter than Dr.Web, yet my tests are showing it has better detections than Dr.Web. I've noticed updates over the weekend, and a consistant stream of steady updates (which I didn't notice with Dr.Web).

Lookin' good, I think i'll be switching to VBA32 if no issues crop up over the next few weeks.

[Labrie]

Coudnt agree more! ;D Im beta testing vba32 and also very satisfied. Well about the detection capability they are still working in their database and it seems they already have acomplished a great job. Some no scientific test show they´ve got a powerful database already -for instance firefighter test- and the most respetable test (av-comparatives, in my opinion) has shown they do pretty well also. But surely they´ll improve this matter particulary when their updates system works sensational and is not noticeable at all...i think about 8 kbs. But what is more important to me is the great stability my pc has after installing this belorussian av -i had nod32 before-, and taking in account that is a beta product...Not laggs, no slow booting...everything lighty as a leaf. ;) Maybe the sounds they used are quite old fashioned...but oh well i love retro art. Also very configurable, clean and easy interface...outstanding support...what else can you ask for ;D Great job guys!

;D

[rothko]

hi SDS909, can i ask why you are not staying with NOD32?

thanks, lee

[Blackcat]

{QUOTE-> I recently tried VBA32 because of their new Dr.Web-like setting for checking only new/changed files. I have to say it is every bit as light, possibly lighter than Dr.Web, yet my tests are showing it has better detections than Dr.Web. Lookin' good, I think i'll be switching to VBA32 if no issues crop up over the next few weeks. <-QUOTE}
Yes, support is very good so far and it's RTM is very light. BUT.

I would like to see it's detection rate on a variety of sites before judging it's abilities against Dr Web.

Let's see how it's entry into the English market proceeds. For example, MKS/ArcaVir started off very well but appears to have lost it's way recently!

Overall, with time it may very well prove to be a strong competitor to Dr Web and other AV's.

[Honyak]

{QUOTE-> Yes, support is very good so far and it's RTM is very light. BUT.

I would like to see it's detection rate on a variety of sites before judging it's abilities against Dr Web.

Let's see how it's entry into the English market proceeds. For example, MKS/ArcaVir started off very well but appears to have lost it's way recently!

Overall, with time it may very well prove to be a strong competitor to Dr Web and other AV's. <-QUOTE}

I agree with Blackcat, I jumped on the MKS/ArcVir bandwagon early because of good detection rates and support forum. Then it started becoming an all-in-one and the forum disappeared. I then switched to DrWeb on my main comp.
I am currently running VBA32 on another comp and am impressed, but this time I will wait and watch the development of it.
I think you are better off sticking with established AV's.
No AV vendor is going to satisfy you 100% of the time in detection, suspicious file submittal or support, I have learned they all have their quirks in the way they handle things.
You may want to proceed with caution SDS909.

[SDS909]

I jumped on with MKS/Arcavir shortly after Kobra discovered it and indeed it was a very impressive product. But like you, I disliked their direction. Also the company they chose to handle it in the US (Stormbyte) was a pretty bad choice. Once they added a pretty lame Firewall, and weak IDS, and went to that horrible red interface I started to reconsider. Then when they missed several threats in a row, I dumped them.

Dr.Web has been great, however the update system is poor, and the "Quiet" update mode doesn't work for beans. I don't like the extra processes that run with as well. Lately i've been horrified with their lack of response to some threats i've submitted, and in general some of the things they've missed i've actually come in contact with. Also they seem incredibly slow making changes to their product.

I've watched VBA32 for months and months, and when I tried it back in April I was mildly impressed. I tried it again last week and was excessively impressed. Like today for example, it is early, but they've already added around 400 threats. Since April they'ved added around 30,000 I believe. Pretty impressive.

Also, I just love how it is light as a leaf on my systems. I refuse to use bloated av's... Should they decide to add a firewall and other crap to it, I will discontinue use.

Now my next battle is to convince my fellow friends at Star-Force to ABANDON the Firewall they are going to implement in Safe'N'Sec, I really really do not want SNS to become bloated.

[Blackcat]

{QUOTE-> Now my next battle is to convince my fellow friends at Star-Force to ABANDON the Firewall they are going to implement in Safe'N'Sec, I really really do not want SNS to become bloated. <-QUOTE}
I agree, particularly if it is a very primitive IDS system as in KAV 5.

If they do go ahead with the firewall, let's hope it is an optional install and not in the default settings. Or at least they carry on producing several versions of SNS, but the basic one staying as it is (firewall and antivirus free!!!).

[pvsurfer]

VBA32 is new to me - is it freeware, beta, or what?

Would you please provide more info on this AV?

[bellgamin]

{QUOTE-> ...a consistant stream of steady updates (which I didn't notice with Dr.Web). <-QUOTE}In all the threads I have previously read about DrWeb, this is the first where I've seen a comment that DRW doesn't update sigs often enough. If true I must reconsider my options. By the way, I wonder why a thread praising a particular AV seems always to end up by knocking its competitors?

I would suppose that a newer AV would add sigs a bit faster in order to *catch up*with a well-established AV such as DRW. In any event, I myself get a very "consistent stream" of updates from DrWeb -- multiple times daily, 7 days a week. Looking back a bit, DRW's cumulative sig additions, listed by week-ending dates, were: 7-3 652, 6-26 749, 6-19 591, 6-12 833, 6-5 630, 5-29 793, 5-15 435, 5-8 775, 5-1 1011.

Of course, I am unqualified to discuss how DrWeb counts sigs compared with VBA32 or any other AV. In any event, I hope other DrW users will reassure me that I am still well-protected.

[ellison64]

{QUOTE-> VBA32 is new to me - is it freeware, beta, or what?

Would you please provide more info on this AV? <-QUOTE}


You can download the trial version (uses a trial key)which is restricted or download the beta key which then makes evrything functional.
beta key
http://www.anti-virus.by/en/beta.html
vba32 downlaod
http://www.anti-virus.by/en/downloads.html

Ive tried many avs including nod ,avg,avast,antivir,rising,arcavir,and dr web.All had some quirk or other with my system (98)Dr web for instance wont allow me to send attachments or large files by mail with my router.Dr web support was very good however after a few weeks attempts to get it working i just gave up.Suprising of all i m now using kav personal and (with the high speed setting)my machine has no slowdown to speak and its easily as light as dr web or nod on my machine.I only tried vba32 for an hour or two this afternoon and it seems nice.Though i would say on the default settings it didnt warn of any trojan downloaders ist bar at some warez sites which kav and nod does using imon and script monitoring for kav.
ellison

[Honyak]

{QUOTE->

Of course, I am unqualified to discuss how DrWeb counts sigs compared with VBA32 or any other AV. In any event, I hope other DrW users will reassure me that I am still well-protected. <-QUOTE}

Not to worry bell, I have not used the DR as long as you but feel very well protected by it. And the updates may not be hourly but they are often.

[SDS909]

I agree Dr.Web is good. The problem is, I keep running into Malware out in the wild that it doesn't grab. That, combined with other issues (as i've already noted), have me scanning for a replacement.

SO far VBA32 seems most excellent.

[the Tester]

I have had a similar experience using Vba32 Personal beta.
It's been an impressive,stable program.
No glitches with the program or support so far..
I really like the way the program is configurable and easy on resources.
The price is competitive also.

[likuidkewl]

As I have stated many times I really like this also, BUT i have found it tends to be a little rough around the edges on Trojan/Backdoor detection, from my evaluations. Other than that, no quips. Detections are sky-rocketing . :)

[The Hammer]

{QUOTE->

Now my next battle is to convince my fellow friends at Star-Force to ABANDON the Firewall they are going to implement in Safe'N'Sec, I really really do not want SNS to become bloated. <-QUOTE}
Don't mean to hijack the thread. But I've been considering this program. How do you know this. Please consider posting an answer on this thread.http://www.wilderssecurity.com/showthread.php?t=87315

[djg05]

After reading through this thread and having current problems with Avast, I thought I would give it a try. Unfortunately it did not last long since it thought that my email prog 'Pocomail' was a trojan/virus and locked it from running. It identified it as suspect 'Backdoor Executive 4. As a precaution I re-installed Poco but with the same result.

I wrote to the developers about it and they say there will be an update in a couple of days that will right this problem.

Very fast response from them - about 30 minutes (from UK).

[NAMOR]

Ok with all the talk of VBA32 of that past few months I decided to give her a try... Anyone getting a FP on Total Uninstall 3?

[Siarheika]

{QUOTE-> Ok with all the talk of VBA32 of that past few months I decided to give her a try... Anyone getting a FP on Total Uninstall 3? <-QUOTE}
Just tested the files available for download from Total Uninstall home page: http://www.martau.com/index.php - no problems detected here. Could you please send the file which is causing FP to support-en@anti-virus.by? We'll try to resolve this issue.

[Siarheika]

{QUOTE-> Just tested the files available for download from Total Uninstall home page: http://www.martau.com/index.php - no problems detected here. <-QUOTE}
I'm sorry for providing not quite correct information here, that's why the explanation follows.

{QUOTE-> Could you please send the file which is causing FP to support-en@anti-virus.by? We'll try to resolve this issue. <-QUOTE}
File received, thanks a lot.

Total Uninstall 3 is packaged into Inno setup installer, we have extracted the files from it manually before, but it did not contain any false positive (even more, the file 'Tu.exe' in it is in a nonworking state, entry point contains invalid code that crashes after being started).

But when actually installing this software, the file 'Tu.exe' is valid and is the same as submitted by NAMOR (looks like it gets patched at the final stage of installing after decompression). In this form, it is really flagged as 'suspected of Unknown.Win32Virus' with heuristics.

Appears that this file is a Delphi executable but patched with some tool (unknown to me), that is probably intended to hide its original entry point. The original program itself is neither packed or crypted, only entry point contains some weird code typical for some cryptors or polymorphic viruses. It is this code that causes heuristics alert.

Looks like the author of Total Uninstall 3 is overly paranoid about reverse engineering of his program, but this also looks suspicious a bit :)

Now this heuristics alarm is fixed, virus database will be updated in a few hours. Thanks for reporting this problem, if you notice anything else, don't hesitate to contact us.

[NAMOR]

Thanks for the detailed explanation and quick reply Siarheika. ;)

[likuidkewl]

12:21:19 10-07-2005 C:\Program Files\ZipGenius 6\zg.exe : is suspected of Virus.Win32.HLLW.Antinny.1
12:21:21 10-07-2005 C:\Program Files\ZipGenius 6\zipgenius.exe : is suspected of TrojanDropper.Win32.Joiner.1
This is with excessive heuristics enabled.
Mailed to support-en.AT.anti-virus.by

//*************EDIT***********************//
I recieved an email back within a half an hour. These people even work on Sunday nights!!!
{QUOTE->
Thank you, we appreciate your help, the problem will be corrected in
the next update.

--
Sunday, July 10, 2005, 20:20:05 +0300
Regards, Xxxx X Xxxxx
VirusBlokAda Ltd., Minsk, Belarus
http://www.anti-virus.by/en/
<-QUOTE}

[SDS909]

Really? I was pissed when I found out Arcavir and Dr.Web folks don't work weekends.. Another reason to love VBA32..

[Honyak]

{QUOTE-> Really? I was pissed when I found out Arcavir and Dr.Web folks don't work weekends.. Another reason to love VBA32.. <-QUOTE}

Don't forget Holidays, Arcavir was delayed getting an update out for the last big outbreak because of a holiday.

There are DrWeb updates on weekends though.

[JayTee]

Does anyone find that their browsers are slower on surfing some sites with vba32?

Used it for a day before deciding to try out nod32 again. Latest version of nod works quite well with my pc, although the first version out of beta killed my surfing speed.

[SDS909]

No slowdowns at all with VBA, and I use "Check only new files" setting. Same as Dr.Web in terms of being ultra-light..

[Blackcat]

According to their sales people, a 2-year license for the Personal edition will be available through eMetrix for $41 from next week.

[SDS909]

{QUOTE-> According to their sales people, a 2-year license for the Personal edition will be available through eMetrix for $41 from next week. <-QUOTE}

Sold!

[NAMOR]

Just incase anyone wanted to know the discount for license renewals is 15%.

[NAMOR]

I am very impressed by their support. So far I have sent in a couple of FP's and I get a reply within a couple of hours. No bad at all.... ;D

[Miyagi]

The long awaited 2 year licenses are available via eMetrix.
http://secure.emetrix.com/order/allproducts.asp?DID=60826552

Great deal! I look forward to purchasing their license this year. ;D

[SDS909]

I just got into the Microsoft One-Care beta. I think I will switch all the PC's here over to MS's Antivirus solution when it launches.

VBA32 was promising for me though.

[SDS909]

Don't knock the heuristics. I just ran into a brand new outbreak, and check out these results.

http://www.boredmofo.com/downloads/vba2.JPG

Oh, and One-Care is aweful.. I uninstalled it less than a day after having it installed. There isn't even an on-demand scan, and it just all seemed like a bad joke. Oh well.

[jlo]

Hi,

can I ask what is VBA's updater like. Does it silently updated and are the updates incremental and how often does it check for an update?

Many Thanks

Jlo

[jmschwartz]

{QUOTE-> I just got into the Microsoft One-Care beta. I think I will switch all the PC's here over to MS's Antivirus solution when it launches.

VBA32 was promising for me though. <-QUOTE}

Hey SDS909,

How's it going? I installed Microsoft's Beta and after about 5 minutes got tired of its bloated, slow virus scan. The other tools (backup, disk defrag, etc.) work like the standalones in XP.

I restored my image (with VBA32) using Acronis TrueImage and emailed Microsoft to remove my name from their Beta list (this is so some other worthy tester gets a chance to evaluate the product).

Seems we had the same luck with the One-Care experience. Let's stick with VBA32.

[SDS909]

Yup, exactly the same experiance as you with OneCare. Like 2-3 HOURS for a scan on a fast SATA2 machine.. WTF?

I'm sticking with VBA32.. Especially since its heuristics have nailed several recent baddies for me.

[SDS909]

Oh and I REALLY regret installing OneCare.. I didn't have an image, and it totally borked my system to the core.

A format is in order now.. F-ing Microsoft crap.

[.....]

{QUOTE->
what is VBA's updater like. Does it silently updated and are the updates incremental and how often does it check for an update?
<-QUOTE}

Yup incremental updates via a method of binary patching (incremental updates of exe's, dll's etc too). Can be setup to be silent if i remember correctly.

Can be set to update as little as evey hour.

[jlo]

Thanks for for the update info!

May give it a try when my NOD32 licence expires

Cheers

Jlo

[Miyagi]

Jlo,
Vba32 can be updated silently. Just make sure to 'uncheck' the Interactive checkbox in the Loader module. You can also set to update hourly. Updates are available daily including the weekend. Nice compact product imo. ;)

[Peter2150]

How does VBA32 determine which files aren't changed. Hopefully they don't use the KAV approach of ADS.

Pete

[RejZoR]

Why do you all have such problem with NTFS ADS !? They work just fine and i really don't see any reason not to use them ::)

[Peter2150]

{QUOTE-> Why do you all have such problem with NTFS ADS !? They work just fine and i really don't see any reason not to use them ::) <-QUOTE}

In my case it's very simple. I use Raxco's First Defense-ISR, and if you check their website it states the program is incompatible with KAV 5.0. That really isn't true, but it is incompatible with KAV's use of ADS. I know I tried it. Had to uninstall KAV, clean off the ADS's and reinstall KAV without ADS, and it works fine. Since I won't give up FD-ISR for anything, the question remains:

Does VBA32 use ads?

Pete

[likuidkewl]

With version 3.10.4 I have found no evidence of streams at all.

[Brian N]

Got a screenshot of VBA anyone? I would like to see how it looks ;)

[Blackcat]

A number of screenshots found here. (http://www.wilderssecurity.com/showthread.php?t=73419&page=1&pp=25&highlight=VBA32)

[Brian N]

Thank you. Looks good, plenty of options.

[likuidkewl]

BTW for those of you who are going to trial VBA32, try out the Workstation version and do a custom install to utilize all the features, some are disabled by default, script-scanning, the bat plugin, etc. HTH

[Firefighter]

Vba32 has increased quite aggressively the number of defs. On the 8:th April 2005 it had only 54842 defs, today 91729, which is more than DrWeb has now with those nasty/risky beta defs, 91101. Is this speed the record of this year?

Best regards,
Firefighter!

[Rasheed187]

I have not installed VBA32, but I have to say I was a bit impressed when I saw that it was the only scanner that detected spyware in Easy Message at Jotti. It seems like their paranoid heuristics is working really well. :)

[jlo]

I am trialing it at the moment. I dowloaded the demo and the kind people at VBA sent me a months licence to trial it.

It has so far really impressed me with excellent Heuristcs, excellent Defs and quick to update a false alarm or add a new virus sample.

I had one false alarm on installing it but sent the file in and it was corrected later in the day.

Will be buying a licence for this AV for one of my computers. On my Laptop though I am sticking to Nod32.

Cheers

Jlo

[kkkkkkkkkk]

Definately a product with great future!
Some complains are that they should make it more simple for not experienced users so product should automatically clean_delete infections by default.

Than for paranoid heuristic they should make it automatically to submit suspicius files.

Also I did not notice scheduler, did anybody else?


After NOD this is my second favorite AV software.

[The Hammer]

{QUOTE-> Vba32 has increased quite aggressively the number of defs. On the 8:th April 2005 it had only 54842 defs, today 91729, which is more than DrWeb has now with those nasty/risky beta defs, 91101. Is this speed the record of this year?

Best regards,
Firefighter! <-QUOTE}Don't be looking at another girl. Your current squeeze (Dr. Web) might get mad. ;) ;D