Dr.Web adding more virus signatures

I have noticed that Dr.Web Anti-virus is adding more virus signatures (per day) in their database since the start of April 2006.
http://www.dozleng.com/updates/index.php?act=calendar

For instance, on 4/4 (~750), 4/5 (~500), and 4/6 (~200). Not bad since they were adding close to 100 a day. Keep up the great work Dr.Web!

 

Let's hope that they get round to adding some of the missed samples from av-comparatives. They have a lot to add

Otherwise, they will continue to be classified at a "Standard" level with AVG.

 

Yes. But you and me both know that DrWeb is a mile ahead of AVG(No matter what av-comparatives says).



tD

 

The proof is in the pudding. I mean testing.

 

The only thing they need to do is to work extra hard for 20-30 days and add all those missed sample and score advanced+. Samples that you and me probably will never see.AV tests do matter, but they are not the whole picture…


tD

 

Dr Web are very fast in adding ITW malware.

 

and they catch many current threats heuristically without signature updates

 

I really don't understand why Dr.Web is so "unknown" and a little used.

I really like Dr.Web. Lately looks like that Dr.Web's team is doing an excellent job.

A very good detection rate, excellent heuristic with generic signatures. I believe it has everything to become one of the best antivirus softwares.

 

When I visit Jotti's site most of the time sample is detected by:

NOD32
DrWeb
Kaspersky
VBA32

Lately and by AntiVir.

 

Good, Good.

Good, Good.

Interface?

Hmm.....

Very Good!

<But remember, Jotti's online scanner is not to be counted as an AV-Test>

 

ROFL!
You really like me - do you?!

 

Of course I like you, Daddy....err, I mean Inspector.

 

Close to 1,000 virus signatures added today.
http://www.dozleng.com/updates/index.php?act=calendar&code=showevent&eventid=25033

Good job Dr.Web!

 

Some of these must be those missed zoo samples

 

I want to ask some questions, out of topic:

1. For making good detections (like %97-99) in av-comparatives or other tests, Is only adding definitions enough?
2. If it is enough. Why companies don't hire more analyst for adding more definition. I have two answer but dunno which is true:
a) There aren't enough analysts for all companies
b) Analysts salaries are too high

 

I like you too!

 

for a good scanner IMO yes. but it is not necessary to add a trojan which is not infecting anyone..

that is true ultimately. good, or great virus analysts like our "Inspector" here dont grow up in trees
what more there is a great demand for competent analysts

i dont know, i hope they're paying the analysts....
something more that just pizza, coffee or cola ....

 

I admit that when I look at the results of AV Comparatives I wonder why the following of Dr Webb. It did not reach the level of Avast for instance. If one is going to pay for an AV, why not go to one with a higher detection rate?

Just a question, and not an argument.

Jerry

 

Jerry, take a look at Technodrome's second post above. Most of the samples are ones that the average computer user are never going to see. They need more analysts to add the missed samples and obviously when compared to other AV vendors, they do not give av-comparative tests high priority at the present time.

ITW detection is the main one and here Dr Web is as good as the "big" AV's. Some reasons why users have chosen Dr Web include;

1. Official support process has now changed for the better with a Ticket number/Action/Status.

2. Its RTM, SpiDerGuard, has a low memory footprint and is very light, so IME, virtually no effect on system performance.

3. Incremental updating is very fast, as updates are very small with files of only 3-4kB.

4. Cheap to buy particularly if you take advantage of their Migration Policy.

5. Good heuristics, email scanner and soon to be released HTTP scanner. Will also scan for adware/spyware and it has a very good unpacking engine.

 

Blackcat,
Thanks for the reply. While I, without much knowledge in such things, do put a great deal of weight in the AV Comparatives tests, I do wonder about the real world, safe surfer experience. I do not really know how useful the Retrospective tests are as far as the average user is concerned.

Most of the people I personally know either use the "installed" AV or if free use AVG. Yet, in spite of its low ranking, not one of the people I know has gotten infected.

I also realize that it is more important how the program performs on the individual system that the detection rates. If it crashes the system or is always causing problems it is not worth it.

On the other hand, I only look at those which have a high detection rate, at least ADVANCED. I have decided that unless KAV permits two computers on one license, I am going to use Avast free on my laptop as it does not get much surfing use. Maybe that is inconsistent.

I appreciate the excellent response. I see that there are good reasons to choose Dr Webb.

Best,
Jerry

 

Hi guies,

Yes, we are currently adding a lot more viruses daily than ever.
The team is doing its job very nicely and we are happy about it.
Those are actually zoo samples from various tests - that's right.

BUT! We are not going to be at 100% of detection at every single test. Forget about it. Otherwise we shall no longer be Dr.Web anti-virus. We can never detect anything that can never be executed. A corrupted file detected by Symantec is not a verus for Dr.Web - by design. It does not matter for us that we shall not detect it in a test while others will do. Who would ever check every sample out of 30-40 thousand submitted for a test whether it is a real virus that can be launched or a dead body of a virus.
Our detection is based on the principle - evaluate the danger first and then look up the definitions base. We cannot change it And we shall be always missing something at other av-comparatives except for Virus Bulletin - for they never submit corrupted files for reviews

By the way - to give you a hint - others have been completely unaware of Win32.Polipos for about a month. We have been detecting it since March 20th. And added a curing function to the definitions base for this virus last night. You have to crack something like DES crypting algorithm to cure a file infected by that virus. And this is done by Dr.Web engine - and nobody else!

 

I know that i can trust you guys, great work

 

not true, happened also to VirusBulletin in past(1) and then a errata corrige was released.

(1)"Sophos Anti-Virus was noted in the Windows NT comparative as having missed one sample in the polymorphic test set. Further investigation determined that although this file was triply infected with W32/Zmist.D, the multiple infection had rendered the sample unable to replicate. Consequently this file has been removed from the test set. Although this does not affect percentages for other products, this does mean that Sophos Anti-Virus achieved 100% detection in the polymorphic test set, and indeed across all test sets."

 

Thanks for corecting me.
I just meant that we don't ask questions to VB about their collections.
Yet, we still have some 2 or 3 samples in their standard collection that we shall not detect by our on-access scanner since they are not ready to be launched - and we do not detect such viruses by our SpIDer Guard.

As for the others - we try to contact the testers in some cases to understand why we are so "missing" - but we rarely have some relevant answers.

The basic thing is that Dr.Web is ready to detect viruses and other malware - which is a real malware, but not the files that other AV programs detect as malware.

 

Yeah, I see Dr.Web is adding each month tousands of samples that in past were missing, as you say Dr.Web is not adding garbage, its a good thing to see Dr.Web adding the samples / improving its detection rates .