I've found virustotal.com (VT) to be a great resource, but whenever I'm prompted that the file I'm uploading has been scanned previously, I always rescan it. That way I know that it's been done with what are supposed to be the latest definitions from all vendors and I can gauge whether it should pose a threat or if it's one that should be filtered out.
I know from using VIPRE that Sunbelt pushes new defs at least daily and sometimes twice daily, so if something doesn't get picked up by VT, it's not always an accurate indicator of what will be picked up by the client. Sunbelt has indicated as well that VT shouldn't be a definitive YES/NO answer for detections because they're sometimes a version or two behind with their defs. If something I send to VT comes back as unknown to Sunbelt, I submit it to them just in case. I figure it's only a matter of time before one of my users encounters whatever the threat is, so it's saving me a headache and handful of Excedrin later :)
Jon
Jon Galbreath
MCSE/Security+
Systems Administrator
International Studies and Programs
Ph: 517-884-2144
[log in to unmask]
-----Original Message-----
From: MSU Network Administrators Group [mailto:[log in to unmask]] On Behalf Of Al Puzzuoli
Sent: Thursday, June 18, 2009 4:33 PM
To: [log in to unmask]
Subject: [MSUNAG] Disparity in Antivirus Detection Between Scanners.
A spam email contained the following link to a .exe file:
http://mercadoabc.com.br/report_7070.exe
This file undoubtedly does bad things but out of curiosity, I downloaded
it. The first thing I found interesting was that Nod32 let me download
it at all. Once the file was downloaded, I scanned it with Nod32, no
badware detected. I then uploaded the file to virustotal.com, which
indicated that the file had been previously submitted. Instead of
letting the site rescan the file, I chose to look at the previous
report. I was struck by the results. Although a number of scanners
flagged this as a trojan, what was more interesting was the number that
didn't, including nod32, Symantec, and Sunbelt. I wonder, if I let
Virustotal reanalyze the file, if more scanners would detect something
bad. Not sure what, if anything can be gleaned from this. Are the
scanners that detected it updating their definitions more frequently,
just more sensitive or what?
Al Puzzuoli
Michigan State University
Information Technologist
http://www.rcpd.msu.edu
Resource Center for Persons with Disabilities
120 Bessey Hall East Lansing, MI 48824-1033
517-884-1915
|
