Vipre detection improvement

I'm not an expert, but this seems to be a real step up in detection methods.

"MX-Virtualization" Dramatically Improves Detection of New Malware Threats

CLEARWATER, FL--(Marketwire - March 4, 2009) - Sunbelt Software, a leading provider of Windows security software, today announced the availability of its new malware analysis technology, MX-Virtualization™ ("MX-V"), as part of a significant enhancement to its popular VIPRE™ Antivirus + Antispyware product line. MX-V is a compact, high-speed virtualized Windows environment integrated directly into VIPRE, which performs rapid behavioral analysis of potential malware. The integration of MX-V is the latest addition to VIPRE's arsenal of detection methods to help protect users from unidentified or new variants of malware.

"With MX-V, we have created a method to rapidly analyze potential malware by observing its behavior in a virtual environment, providing enhanced protection against new or unknown threats," said Alex Eckelberry, CEO of Sunbelt Software. "Furthermore, because we developed the technology using an emulation technique known as Dynamic Translation, it is extremely fast, able to do its work without compromising system performance."

Background

The rapidly evolving sophistication of malware makes traditional detection methods increasingly obsolete, as new strains of malware use highly complex obfuscation techniques designed to hide from even the most sophisticated analysis systems.

MX-V is a major step in solving this problem by analyzing potential malware in a highly compact, proprietary virtualized Windows environment, tightly integrated into the VIPRE scanning system. Without any user interaction, malware is executed in an environment that mimics many core Windows functions, and analyzed for certain malware signatures and behavioral characteristics. This new functionality enables VIPRE to detect many types of malware without the necessity of creating a constant stream of dedicated signatures and heuristic systems.

MX-V is part of a number of other detection methods used by VIPRE, including classic signature detection and heuristics. The performance impact on a user's system is virtually unnoticeable, in keeping with Sunbelt's commitment to delivering next-generation antivirus without the large memory and CPU footprint common to other solutions.

Availability

The MX-V technology is available immediately in the latest VIPRE definitions update (definitions series 5,000 and up), in both the consumer and enterprise versions of VIPRE. The update also includes other enhancements, including improved signature and heuristic detections.

 

I think Norman has been doing similar kind of "sandboxing" for like 7 years.

 

But for some reason Norman Sandbox never made any significant breakthrougs...

 

I can vouch the knowledge and expertise to Inspector Closeau. I'm sure they're are not wasting time to create this new technology which is working according to their lab tests.

EDIT: I personally am interested in this new technology and await AV-COMPARATIVES test. Sunbelt posted a blog today. http://sunbeltblog.blogspot.com/2009/03/mx-virtualization-announced.html Read the comments.

 

no big surprise. they have some very good folks working on their products and it can only get better.

 

So MX-V is basically for real-time scanning, where it puts every running program in a sandbox to guage it. Right ?
So this will not have a direct impact on on-demand based test results, I guess. Its in someways similar to DW.

 

Wrong, read the comment from Alex E. It's both on-access and on-demand.

 

They'll benefit. If he stays in one place for a while. He's been moving around a bit the last couple of years.

 

Sorry, didn't read that fully (and/or understand it fully). In that case it probably similar to some other advanced heuristic tech. available in other products.
Sunbelt claims MX-V is superior to Heuristic approach. But that time will tell.

 

Not really. He's been working for ESET, FRISK and now Sunbelt. Thats not all that much changing.

 

If it comes anywhere near the 'big boys' in on-demand/detection testing and certifications there will be a mass exodus to it.

It's quite phenomenally light and has no impact on system performance when scanning.
Gone are the days where I had to walk away from the PC while a full scan was carried out!

 

So, Inspector Clouseau is Michael St. Neitzel?

 

Yes, he is

 

That's different. The Norman sandbox is a standard emulator.

Our emulation is different, as it uses a very high-speed method of virtualization, Dynamic Translation. There are a few other AV vendors that do this, but not many. On top of Dynamic Translation we added Windows virtualization.

MX-V is part of the detection pipeline of VIPRE -- we'll run a number of checks on a file both during on-demand and real-time scanning. MX-V will kick in if we can't determine what the file is. We'll actually "run" the file in the virtual environment.

There are no major perf issues. If you're running VIPRE right now, it already has MX-V in it. It happens without any user interaction.

And yes, Michael St. Neitzel is Inspector Clouseau, he works for Sunbelt and he wrote MX-V himself, while Eric Sites, our CTO, wrote the basic Dymanic Translation method that MX-V is based on.

Alex Eckelberry
CEO, Sunbelt Software

 

Does Vipre scan web traffic ?

 

nope.. not yet

 

But its protection level is untouched by most others here.

 

Trjam, how is performing Vipre?

Has anyone tested vipre with some malware collection and can someone tell what are detection rates?


Trjam, I saw yesterday that you have F-Secure, and couple a days ago F-Prot.

Man, it's hard to keep tracking all you change.

Maybe you should write you changes in your profile. It would be interesting to read.

 

You do realize some of us have multiple PC's and even multi-boot setups right?
It is possible to own and even like several products at one time on different machines. Make sense? It does not necessarily mean he changes that frequently. Avatars are easy to change to show support for a product.
Now if I could just find an avatar for Vipre... Hmmmm.

 

Hi Jeff

What firewall are you working with ?

 

Did you do a home grown test? No professional tester results available yet or are there?

 

Strengths are its light footprint and its fast scan speeds.

Weaknesses are that; it is unsuited for those on slow connections because of the sizes of the initial program download and the first update package. Further, no official confirmation of detection rates. But since it is still maturing, my guess would be that it is in Tier 2/3 for detection with AntiVir/KAV being in Tier 1.

 

Yes i realize that. I have multi-boot setup right now.

Make sense. But i don't understand what you are so negative about my post.


My primary question was regarding Vipre. Make sense ??

 

Sorry if it came off negative, I was in a mood.. lol. Did not mean anything towards you at all.
I've been here long enough to see him change avatars a lot and he catches a lot of flak here for it... Not my business I know, like I said I was in a mood...
Life marches on.......
Long live VIPRE!!

 

how often does Vipre usually update? every hour? every 3 hours? i dont want to know what you can set it to check, i want to know how often actual updates are given.