Viruscape....A new antivirus on the market?

Re: A new antivirus on the market?

IBK - I am wondering what exactly is the reason for:

"Also I would not really call this product as "anti-virus", should I test it separatly, I would do it only if I would be allowed to publish all facts/results/etc."

How would this not be considered an antivirus program?

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

It also appears that everything that has been said has spread from one source. I have not seen any definitive proof of anything at all, and do not know why people are criticizing our operation so harshly without backing it up.

We are not out to do anything wrong, have not done anything wrong, and our product will not harm your system. It is a totally legitimate antivirus program and I cannot see why it would not be allowed to be included in various antivirus tests.

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

because 'none' of the replicants from a couple of viruses that your product detects and that are in hands of vxers. Maybe it is not "just a simply checksum finder" but an anti-virus that is not able to detect a replicant can not be called anti-virus imo. if it detect only static trojans you could call it anti-trojan or if it just detects the specific files you could call it 'somekindofchecksum-finder'. maybe it was just the beta....

btw, do not worry, it would be not just TI which can not participate due "strange behaviour", but at least the others admitted what they did, even before the facts were showed.

 

Re: A new antivirus on the market?

You are basing your claims off of claims made by one person, with a pre release version, over one or two viruses. It is hard to obtain copies of virus samples in our current situation, but, we are still adding new threats at an acceptable rate.

Our scanner, while not focusing mainly on viruses, does detect a great deal of viruses. Worms, trojans, and spyware are detected in great quantities, and are detected porportionately to viruses. Computer viruses are no where near as prevalent in our world as malware.

We recently encountered some 'false positives' because of an Elkern virus infection. Our scanner detected the samples while other scanners did not. Also - if our product was soley a MD5 scanner, we would never have false positives, and that is surely slowing down our release.

I believe this information was falsely spread, and the person who said it was a md5 scanner initially revoked their statement after testing it out.

As for admitting: I do not believe we have anything to admit. If it is impossible to take part in certain antivirus tests because of politics, or impossible to gain access into public scanners, I am alright with that. I just do not appreciate the bashing of our product or our president. We would like to atleast display a positive appearance to users, who are more or less unbiased and can formulate their own opinions.

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

"...even before the facts were showed."

Could someone show the facts? I am interested to learn what has been 'done wrong'.

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

May i ask a technically question regarding detection?

 

Re: A new antivirus on the market?

Yes, I have two scanner developers on-call who can direct me with the post.

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

Is there any reason to add very simple, non-polymorphic viruses with special engine detection?

 

Re: A new antivirus on the market?

By 'engine', we mean, an algorithmic detection engine. It was not complete yet, but the ability to have external bases which can use algorithms to detect viruses is important. A lot of viruses, although not being polymorphic, do require atleast a bit of algorithmic detection in order to find multiple variants (.a, .b). In viruses like JollyRoger, a much more complex engine is needed.

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

For what do you need an algorithm to detect Tenga? It's a very simple virus.

Look:

.text:10015DB9 cmp dword ptr [esi+eax-292h], 6F63796Ch
.text:10015DC4 jz loc_10016C53

That's your Tenga-Detection by comparing "lyco" as a DWORD at offset esi+eax-292h

 

Re: A new antivirus on the market?

Variant identifcation with a DWORD check?

Now *that* is innovative.

 

Re: A new antivirus on the market?

Although simplistic, this detection does work - and finds multiple variants of Tenga. Is there anything wrong with this detection?

This definition has not caused any false positives yet, and I see nothing wrong with a scanstring type detection approach for some simplistic viruses.

(On a side note, I would also like to inform you that you broke our license agreement by deriving that. Be careful in the future and please respect the intellictual property of the people that develop software.)

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

I'm no professional, and I know nothing about malware detection techniques, but I do however feel that the simplistic method of detection for Tenga in Viruscape seems like a lack of flexibility in the engine.

Of course, this is just an uneducated guess. Do correct me if I'm wrong, I'll be watching this thread.

 

Re: A new antivirus on the market?

Fine, end of discussion for me here - instead of admitting that i'm right you try to block this now by license agreement. Well, of course i stick to this rule.
Good luck with your AV program, you will need it.

 

Re: A new antivirus on the market?

You may continue to discuss this, Mike, as we understand your reason for evading the license agreement. In all actuality, what is the difference if the detection is simplistic or not?

Yes, we could probably concoct up some overly complicated algorithm but it is not necessary. Why compare more than is necessary?

We have a handful of simplistic detections, which have proven very beneficial with a very low amount of false positives. Some generic dialer detections, InService/Centim detections and a few others are note-able.

Who cares HOW an antivirus program detects their viruses? In the end, does it really matter at all?

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

Well seems that you don't understand what i mean. Your AV program does have a virus database? Why the signature is not stored there? There is absolutely no need to detect Tenga like this. If you cannot detect Tenga with normal virus scan functionallity as for all other viruses then there's something wrong with the design of your scan engine.

 

Re: A new antivirus on the market?

We have a few different types of databases, vDNA.vs, vNEW.vs, and some internal detections. To add the detection to Tenga as fast as possible (when you first said we didnt find it), it was added to the internal detections list.

I have seen various other antivirus programs use internal detections for certain viruses, and see nothing inherently wrong with it. It might not be the easiest to upkeep, but it does serve its purpose.

Again.... to the end user, does this matter? Our main engine DLL is rather small and would not be much of an impact on downloading off of the server in the event we would add more internal definitions.

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

I certainly don't care as long the RESULTS are acceptable.
I would be stupified, if all AV scanners would detect viruses EXACTLY the same way. That's humanly impossible.
Simple, bad, good or brilliant detection methods is a discussion for anti-virus writers.

Only one way to find out, TEST ViruScape thoroughly, just like the rest of AV scanners, which are also NOT perfect.
If the tests and/or detection rates are poor, bad luck for Tera Innovations, if NOT we have a new AV scanner.

I wasn't exactly waiting for a new AV scanner, based on definitions and heuristics, but I don't see any difference between ViruScape and the rest of AV scanners.
I'm waiting for something else.

 

Re: A new antivirus on the market?

Although our detection of some file infectors may not be perfect, in this current world, there is a MUCH higher concentration of malware (non infecting pieces of code) than there are of viruses.

If a program removes one virus, it is an antivirus program. I don't see how you could classify ViruScape as NOT being an antivirus program.

Botnets, malicious email borne worms, and worms through exploits pose a much larger threat than file infectors. Fast response and accurate detection of these threats is very important in the growing computer antivirus world.

For a long period of time, trojan detection in antivirus programs was quite low. It is now very high because antivirus programs and companies acclimate themselves to what is happening in the global situation. We do not see complex viruses like OneHalf, Driller, and some other nasties these days because virus writers are using high level languages and not writing anything incredibly complex - just complex enough to spread massively.

[tho... that is a different topic altogether ]

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

TeraInnovations,
Each time when a company and it doesn't matter which company, creates a new AV scanner, I'm very disappointed.
We have already so many AV scanners. We can't run them all on our little computer.

What's the point of re-inventing the wheel over and over again. That's what bothering me.
I'm waiting for NEW ideas, that break new grounds in the security world.

 

Re: A new antivirus on the market?

I am very aware of this 'problem'. What we are trying to do is provide an antivirus solution which does not perform like the others. By making a fast and efficient antivirus program, we can separate ourselves from the others.

Although current methods of detection are used in our scanner, we are developing a new heuristics engine. Details on this engine cannot be provided at this time, but this engine has always been our main focus. Since we started, we have not spent the entire time developing a signature based antivirus program. We have spent most of our time (actually now it seems almost even) researching and developing a heuristics based on-access guarding and 'Intelligent Virus Prevention System' and a static malware heuristic engine.

These features will make up most of version 2. Originally, ViruScape 2006 was supposed to have these heuristics in it, but we find it better to first release a 'standard' antivirus program with only simplistic benefits rather than a full-fledged heuristic antivirus program with no current ground in the market (many users are needed to test heuristic antivirus programs for false positives). This heuristic based engine is the reason we do not charge yearly for definition updates. Any serious antivirus company with a good heuristic engine that they believe in should not charge yearly for updates because technically, if they REALLY have a heuristics engine, it should not need to be updated.

Just some thoughts,
-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

ViruScape has a ForceField and a global file i/o monitor. It prevents malware from entering very well. The resident protection exists within VS32.exe, the core of it being in VS32.dll.

Don't know where you saw no protection....

-Tera Innovations, Incorporated Support Team

 

Re: A new antivirus on the market?

HAHA! Yes sure go with such claims You have always to FOCUS your heuristic based on ACTUAL threats - so how is it possible to develop a heuristic which will detect new threats completely without updating?! Hey we all might look stupid and maybe we do not match your very high technically qualification (because basically you just do the opposite of this what would make sense) but this is really strange! I would like to see YOU developing a heuristic which never needs to be updated. If you can do this with decent results i start working for you - EVEN FOR FREE!

 

Re: A new antivirus on the market?

All I'm saying is that there are flaws in the way that we currently view heuristic antivirus programs. Nothing currently on the market (or with the ever changing scope of malware, probably <EVER> on the market) is truely heuristic.

A lot of antivirus programs with generic detections claim that they have heuristics. Some do use code analysis and emulation, but IMO, there are many less than it appears.

I would like to point out the perfect antivirus program, made by Dr. Solly:
http://members.aol.com/drasolly/perfect.htm

I never said we could make something that never needed to be updated, updates for virus definitions just should not cost anything. If you do not believe in this, that is your opinion. It just seems a little ironic to charge for definition updates in a seemingly heuristic antivirus program, no?

-Tera Innovations, Incorporated Support Team