Anyone using Trend Micro 2008?

~98%.

 

OT question for IBK: How often do you update your malware collection, and clear them of old, obsolete samples?

Would we be seeing any major difference in the detection rates if you only tested against, say, malware from 1-2 years ago, instead of repeatedly pitting the scanners against the same samples from the past comparatives?

Thanks in advance.

 

older samples are always removed, esp. this time many samples were removed.
i think this can be seen in some categories where the number of samples is lower than in previous sets. even more samples will be removed next time (esp. in some categories). nearly all of the "older" samples are detected to ~100% by practically all vendors.
just have a look at the graph of added missed samples (and consider that the graph contains also some older files that were removed later) to see that samples from previous set are in great part covered in the meantime and what is now missed is mainly samples added recently.

 

Thanks again for the clarification.

 

Before I forget: I have this one question that's been nagging at me for some time now. How exactly do vendors and testers determine the "age" of any given sample? As in, how long has the sample been in circulation and since when, as opposed to simply how long they've had it in their collection?