The good and the bad about AV multi-scanner services

Dermot7 · Feb 6, 2012

Online AV multi scanners are used quite often these days. However, not every user is aware of these sites and what their possibilities and limits are. Using the public online multi scanner services can be useful, but the analysis results don't allow straightforward conclusions.
Click to expand...

http://blog.gdatasoftware.com/blog/article/the-good-and-the-bad-about-av-multi-scanner-services.html

gugarci · Feb 7, 2012

Interesting information.
Thanks for the link.

RejZoR · Feb 7, 2012

That's why i prefer sandbox scanners that output the gathered data and then i decide.

Dermot7 · Feb 7, 2012

From the G-Data article:

Behavior detection, heuristic methods, intrusion prevention, sandbox mechanisms, cloud technologies and other technologies, like our own G Data BankGuard technology, will stop a lot of new malware proactively or just right after its appearance on the Internet. Comprehensive AV products do not rely on virus signatures only. But online multi scanners do – and this is a huge difference you should know about while using the public services.
Click to expand...

Seems to concur with what Marco of Prevx/Webroot said quite some time ago:

many new heuristic techniques that we use can't be included inside the on-demand scanner, which will simply check if the plain file signature is present inside the community database.

I've exposed the situation as it is for Prevx, but this is common to other security software too. They often include new techniques - behavior blockers, heuristic behavior analyzers, dynamic heuristic engines and so on - used to mitigate (or override, most of times) the gap between malware creation and signature release.

If sometimes you find heuristic detections on VirusTotal, it doesn't necessary mean that the heuristic detection is totally implemented inside the on-demand scanner. Simply, there are some techniques that can't be easily implemented inside an on-demand version of the scanner. Anyway their role is crucial and they allow security software to detect 0day threats.
Click to expand...

http://www.prevx.com/blog/106/Why-using-VirusTotal-for-AV-testing-is-a-bad-idea.html

J_L · Feb 7, 2012

Great article, forgot about criminals copying this concept for their own purposes.

Log in or Sign up

The good and the bad about AV multi-scanner services

Dermot7 Registered Member

gugarci Registered Member

RejZoR Lurker

Dermot7 Registered Member

J_L Registered Member

Log in or Sign up

The good and the bad about AV multi-scanner services

Dermot7 Registered Member

gugarci Registered Member

RejZoR Lurker

Dermot7 Registered Member

J_L Registered Member

Useful Searches