Difference in update sizes ?

Discussion in 'NOD32 version 2 Forum' started by Update size, Jan 5, 2006.

Thread Status:
Not open for further replies.
  1. Update size

    Update size Guest

    I don´t understand why a big update is about 30kb and a small is about 170kb, for example:

    This one was about 30kb:

    NOD32 - 1.1354 (20060105) / posted 21:57)
    Virus signature database updates:
    IRC/Flood (9), IRC/Small.O, IRC/Small.P, Win32/Anar.C, Win32/Bobax.AP, Win32/Bobax.NAH, Win32/Brontok.AX (2), Win32/Chilly.C, Win32/Delf.AA (2), Win32/DNSChanger, Win32/Guap.H, Win32/Honk.A, Win32/IRCBot.PH, Win32/Iroffer.1227.D, Win32/Kelvir, Win32/Lewor.AE (4), Win32/Lowzones.NAF, Win32/Mabutu.C, Win32/Mash.B, Win32/Mocalo.ND (2), Win32/Mops.B (2), Win32/Mops.C, Win32/Mytob.OA (2), Win32/Mytob.OB, Win32/Mytob.OC, Win32/Nanspy.NAA, Win32/Nanspy.NAB, Win32/Netsky.AH (2), Win32/Opanki.BD, Win32/Opanki.BE, Win32/Pawur, Win32/Pawur.F, Win32/Pawur.G, Win32/Pawur.NAC (2), Win32/PSW.Hangame.H (2), Win32/PSW.LdPinch.RG, Win32/PSW.Legendmir, Win32/PSW.Lineage.ON, Win32/PSW.QQShou, Win32/Randon (3), Win32/RiskWare.RemoteAdmin.NetCat.110 (2), Win32/Rootkit.Agent.A, Win32/Shelp.NAA (2), Win32/Spy.Agent.HZ, Win32/Spy.Banpaes.O, Win32/StartPage.NEW, Win32/TrojanClicker.Small.HB, Win32/TrojanDownloader.Agent.KW, Win32/TrojanDownloader.Agent.NDH, Win32/TrojanDownloader.Agent.YG, Win32/TrojanDownloader.Dadobra.FX, Win32/TrojanDownloader.Delf.WO, Win32/TrojanDownloader.Small.AFQ, Win32/TrojanDownloader.Small.AWA, Win32/TrojanDownloader.Small.CEO (2), Win32/TrojanDownloader.Small.NGF, Win32/TrojanDropper.Agent.AEJ (2), Win32/TrojanDropper.Small.NBG, Win32/TrojanProxy.Ranky, Win32/TrojanProxy.Small.NAG, Win32/Tsipe.AK, Win32/VB.NEA (2), Win32/VB.NEB, Win32/VB.NEC, Win32/VB.NED, Win32/VB.NEE (2), Win32/Wisdoor

    And this one was about 170kb:

    NOD32 - 1.1353 (20060105) / posted 16:41)
    Virus signature database updates:
    Win32/Adware.Toolbar.Shopper (2), Win32/Agent.NJ (2), Win32/Agent.PD, Win32/Delf.AIG (2), Win32/Robobot (4), Win32/TrojanDropper.Agent.ADK (2), Win32/TrojanProxy.Agent.HS
     
  2. tazdevl

    tazdevl Registered Member

    Joined:
    May 17, 2004
    Posts:
    837
    Location:
    AZ, USA
    Simple answer... there's no set size for each definition. Some might require more code than another. Also could have added generic detection (for variants of the same thing) and remove redundant single definitions.
     
  3. flyrfan111

    flyrfan111 Registered Member

    Joined:
    Jun 1, 2004
    Posts:
    1,224
    Also depends on how similar some virii are, meaning a simple code string could detect numerous baddies depending on how similarly they were written. If the virii are alike, the detection code/strings will be alike.
     
  4. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    And don't forget that they can update different parts of NOD by using an update :)
    A good recent example of this would be the server list.

    After a number of complaints about u7 being offline all the time and making numerous lists of errors, they simply removed it with an update. It's back in action now though, but I'm just saying that the number of signatures should not be compared to larger or smaller update sizes.
     
Thread Status:
Not open for further replies.