VBA32 and KAV, same bases ?

Discussion in 'other anti-virus software' started by Mack Jones, Aug 29, 2005.

Thread Status:
Not open for further replies.
  1. Mack Jones

    Mack Jones Registered Member

    Joined:
    Jul 9, 2003
    Posts:
    174
    Location:
    France
    Hi,
    It's not the first time I see VBA32 using the same name than KAV for a malware...
    and if KAV detect some samples VBA32 don't detect (and vice-versa), I wonder if they don't share a part of their bases...
    Thanks for your observations gents !
     
  2. SDS909

    SDS909 Registered Member

    Joined:
    Apr 8, 2005
    Posts:
    333
    There are a few strange things comparing them. They both use the IDENTICAL naming conventions, and both seem to have excellent signature detections. Both are Russian companies. In some tests VBA32 seemingly can keep up with KAV on detections (using same naming conventions).

    At a security convention here there was a "Rumor" that VBA32 purchased the KAV definition base early on, and spent a great deal of time stripping out the bloat from it. I have no idea if this is true or not, but there is some evidence.
     
  3. Mack Jones

    Mack Jones Registered Member

    Joined:
    Jul 9, 2003
    Posts:
    174
    Location:
    France
    Yes...
    And VBA32 seems to be kinda clone of AVP 3.x.
    And stranger to see VBA32 detecting malwares KAV don't catch (and vice-versa). Same bases, not the same, partially the same ? o_O
     
  4. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    I doubt they bought bases from them. But they could obtain samples from them (and later add them manually to their own bases).
     
  5. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    No, I do not think that KAV shares samples with VBA32. There must be some other unknown reasons.
     
  6. .....

    ..... Registered Member

    Joined:
    Jan 14, 2005
    Posts:
    312
    IBK does VBA32 reach the "magical" 85% on your samples yet? Or you not gonna tell us? If it does, will it be included in the tests of 2006?
     
  7. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    No, does not reach the 85%. And I predict that it will also not reach in Feb2006, so it will be not included in the on-demand tests next year (but maybe in the retrospective tests; i have to change a bit some rules).
     
  8. .....

    ..... Registered Member

    Joined:
    Jan 14, 2005
    Posts:
    312
    Thanks for that.
    Is it mainly DOS samples it misses (or can you not say that?)
     
  9. dan_maran

    dan_maran Registered Member

    Joined:
    Aug 30, 2004
    Posts:
    1,053
    Location:
    Stamford, CT
    In my limited selection, it has mainly been Dos nasties that VBA32 misses, and a few ad-related backdoor's/Trojans.

    note: Before anyone asks, as I stated before I cannot rightfully test VBA32 and produce non-biases results, due to the fact that as I weed through my small collection of about 15,000 I send them to VBA32.

    HTH
     
  10. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    No, it is not due the DOS samples; it is low in all categories. Do not ask for more details, I tested it only for the companies.
     
  11. mrhero

    mrhero Registered Member

    Joined:
    Jul 15, 2005
    Posts:
    297
    Location:
    Ankara , Turkey
    In my opinion they only use the name of malware. Here is a sample that VBA32 found but KAV not.
    http://jotti1.jpg
     

    Attached Files:

  12. dan_maran

    dan_maran Registered Member

    Joined:
    Aug 30, 2004
    Posts:
    1,053
    Location:
    Stamford, CT
    They name straight viruses different.
    VBA32
    [​IMG]

    KAV5
    [​IMG]
     
  13. .....

    ..... Registered Member

    Joined:
    Jan 14, 2005
    Posts:
    312
    Many thanks for the info.
     
  14. jlo

    jlo Registered Member

    Joined:
    Nov 29, 2004
    Posts:
    475
    Location:
    UK
    And another example of KAV and VBA detecting something with different names.

    Cheers

    Jlo

    Last file scanned at least one scanner reported something about: Server.exe, detected by:

    Scanner Malware name
    AntiVir X
    ArcaVir X
    Avast X
    AVG Antivirus X
    BitDefender X
    ClamAV X
    Dr.Web X
    F-Prot Antivirus X
    Fortinet X
    Kaspersky Anti-Virus Backdoor.Win32.Amitis.143
    NOD32 X
    Norman Virus Control X
    UNA X
    VBA32 Backdoor.Amitis.1
     
  15. Mack Jones

    Mack Jones Registered Member

    Joined:
    Jul 9, 2003
    Posts:
    174
    Location:
    France
    Don't you think VBA32 is too good to detect malwares as well as KAV ?
    I can't imagine they don't use (partially) the same bases...
    This compagny seems to be too little to perform like this.
     
  16. mrhero

    mrhero Registered Member

    Joined:
    Jul 15, 2005
    Posts:
    297
    Location:
    Ankara , Turkey

    Attached Files:

  17. SDS909

    SDS909 Registered Member

    Joined:
    Apr 8, 2005
    Posts:
    333
    That is strange, I ran VBA32 over 61,000 samples this month and VBA32 scores 94.6%, while Kaspersky scores 96.1% on the same subset.. But my samples are generally Win/Win32 samples, I have zero interest in DOS detections - does anyone?

    I'm rather dubious of any claims VBA32 scores less than 85%, especially given its incredible performance at Jotti(and anyone can refresh to see VBA32 detecting stuff nothing else does), and my personal test experiance with VBA.

    PS: on those 61,000 samples, the vast majority have identical naming conventions between VBA32 and Kaspersky. That has yet to be explained to me, but is most mysterious.
     
  18. SDS909

    SDS909 Registered Member

    Joined:
    Apr 8, 2005
    Posts:
    333
    I agree. This is why I purged all DOS samples from my inventory - why would I care how a AV performs on DOS? Who the hell runs dos anymore anyway? VBA32 performance on DOS samples is lackluster, while i've witnessed better than KAV performance in many other aspects.

    Not to mention I think VBA32 is light and reasonably bug free. Which is difficult to say for some other AVs.
     
  19. Firefighter

    Firefighter Registered Member

    Joined:
    Oct 28, 2002
    Posts:
    1,670
    Location:
    Finland
    I agree. They just can't be mostly False Positives or Crap files that Vba32 detects but the most REAL ItW stuff, especially trojan like nasties, where Vba is among the top of scanners. It just seems to be the "wrong" top 3 av:s, that are now in Jotti's according to many here at Wilders. :D

    Best regards,
    Firefighter!
     
  20. SDS909

    SDS909 Registered Member

    Joined:
    Apr 8, 2005
    Posts:
    333
    This brings up another point - doesn't VBA32 score high for you in your samples Firefighter? Similar to what it scores for me?
     
  21. Firefighter

    Firefighter Registered Member

    Joined:
    Oct 28, 2002
    Posts:
    1,670
    Location:
    Finland
    Maybe even too high. It scored the second, very close to KAV engined av:s and with a few samples more than the third, BitDefender 8.0 Free/9.0 Std, against my 2699 randomly picked nasties collection. :cool:

    Best regards,
    Firefighter!
     
  22. Blackcat

    Blackcat Registered Member

    Joined:
    Nov 22, 2002
    Posts:
    4,010
    Location:
    Christchurch, UK
    BUT if they are not one of the chosen AV's tested how can they obtain the missed samples? Catch 22!
     
  23. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    They get them also from their sources (e.g. other AV companies) or somewhere else, like I do. The reason why companies get missed samples from me is primary not because they do not have already those samples (they usually have them already), it is just in order that they can see that the results are not invented/faked/biased. Due the conditions of the av companies, I am allowed to send missed samples only in accordance with the test conditions and if all conditions are filled.
    But as I said, I am planning to include them probably in the other tests (FP and retrospective, where the results may be interesting).
     
  24. Firefighter

    Firefighter Registered Member

    Joined:
    Oct 28, 2002
    Posts:
    1,670
    Location:
    Finland
    Maybe a stupid question but anyway. If those av-vendors already have those missed samples, why do they not add them to their definions then? :oops:

    Best regards,
    Firefighter!
     
  25. IBK

    IBK AV Expert

    Joined:
    Dec 22, 2003
    Posts:
    1,819
    Location:
    Innsbruck (Austria)
    Overload of work? Other priorities? no interest to add them? dunno...
    well, they add samples, but I heard e.g. from a company that they have a backlog of 100.000 samples still to check :eek: , and adding all those takes time (esp. if the company is small and does not have a lot of analysts etc.), so they will first give priority to single samples they get from users (or are currently 'really' ITW), then small collections they get from users, than if time remains and the samples are still undetected, they will samples coming from big collections of other vendors or testers (IMO).
     
Loading...
Thread Status:
Not open for further replies.