VirusTotal += Arcabit

We welcome Arcabit scanner to VirusTotal. This is a multi-engine product from Poland. In the words of the company:

"Arcabit is a Polish vendor of the antivirus and protection software. Arcabit antivirus engine is the hybrid of two solutions - Bitdefender and its own, constantly developed 

engine with rapid response to the new threats. Arcabit uses advanced cloud solutions to identify trends in malware development and to ensure an early response to new threats.

The heuristic mechanisms implemented by Arcabit (identified as HEUR.*) offer the efficacy at the level of 99.9% in detecting threats spreading through popular Web channels - www, email etc."

Read More

A first shot at false positives

Every so often an antivirus detecting a legitimate file hits the headlines, this usually happens when a given vendor mistakenly marks as malicious a file belonging to a widespread software package, for example, a key operating system file.

These mistaken detections, commonly known as false positives, have all sorts of undesired effects:

• Software developers may face strong business impact as a large portion of their users see their programs rendered unusable. 
• Support teams for the affected programs may be suddenly overwhelmed by user emails claiming that the given software is not working correctly.
• End-users may be unable to interact with important software and see themselves unable to finish critical tasks.
• Antivirus vendors' reputation may be severely hindered.

It is, thus, obvious that false positives are a head ache both for the antivirus industry and software developers. Solving them can be a very challenging problem. Why? Nowadays antivirus vendors are increasingly required to become more proactive, this includes developing generic signatures and heuristic flags, which very often leads to mistaken detections in an effort to have a more secure user-base. 

Virustotal is strongly committed to helping the antivirus and security industry, this is why we also wanted to collaborate on this front. Our first shot at this is a project that we call trusted source. The goal of this first stage is to have huge software developers share the files in their software catalogue.

These files are then marked accordingly at VirusTotal and whenever an antivirus solution (mistakenly) detects them, we notify the pertinent vendor, allowing them to quickly correct the false positive. Additionally, when files get distributed to antivirus vendors, they are tagged so that potential erroneous flags can be ignored,  preventing a snowball effect with detection ratios.

We have already started marking files and you may have already noticed the new message dialog at the top of file reports, example:
https://www.virustotal.com/en/file/a70999ee28e6233ffcadb6cc3967417be4de2678b868fa2d45bdd3f826c7ed48/analysis/

As you can see, not only a trusted source dialog is displayed, mistaken detections are also dropped from the positives count and degraded to the bottom of the report. This is just a quick measure to make sure the false positives do not mislead users looking at the report, as said, these mistaken detections are also shared with the pertinent vendors in order for them to fix.

We have been working on this for just one week and with just one company, Microsoft, yet results look very promising: over 6000 false positives have been fixed. We would like to extend a big thank you to the Microsoft team for sharing metadata about its software collection and to the antivirus industry as a whole for the false positives remediation. 

So what are the next steps? We are looking to grow our collection of trusted software, if you happen to be a very large software development company you might want to contact us in order to share this data and help us mitigate the issue of false positives. Please note that this initiative is not open to potentially unwanted applications and adware developers. 

Read More

VirusTotal += Alibaba

We welcome Alibaba engine to VirusTotal. This Chinese antivirus is focused in Android malware. In the words of the company:

"Alibaba anti-virus engine is an ultrafast and accurate anti-virus engine based on cloud computing, big data technologies and a database with massive confirmed malwares and safe files. This anti-virus engine consists of multiple subsystems such as preprocessing, static analysis, dynamic analysis, and counterfeit software detection. These subsystems collaboratively and automatically analyze an unknown software to determine whether it is a malware or not.

Specifically, our anti-virus engine focuses on detecting malwares that threatening the safety of mobile shopping or payment. We aim to protect the privacy information and assets of the clients of Alibaba, as well as maintain a secure mobile cyberspace."

Read More

VirusTotal += ALYac

We welcome ESTsoft ALYac engine to VirusTotal. This South Korean multi-engine antivirus includes its own engine called Tera plus the popular BitDefender engine. In the words of the company:

"""ALYac provides differentiated service with the award winning Triple-Engines.

The ESTsoft's Tera Engine, the BitDefender Engine and the Sophos Engine establish several protection layers.

With the lightweighted engine and the memory optimization, ALYac minimizes its resource usage.

Moreover, ALYac boasts excellent detection power against variant malicious files through 'Smart Scan Technology'."""

Read More

VirusTotal += AVware

We welcome BluePex AVware as a new antivirus product at VirusTotal. In the words of the company, it offers special focus on threats from that zone:

“The antivirus AVware is developed in Brazil with focus on regional threats.

Apart from the concern with global malicious artifacts, we have a great effort to capture the artifacts that are taking place in Latin America, for this we have partnerships with financial institutions and governments for sending these samples, our engine also uses signatures and heuristics to detect new threats.”

Read More

VirusTotal += Zoner

We welcome Zoner antivirus as a new file scanning engine at VirusTotal. In the words of the company:

"Zoner AntiVirus is a relative newcomer to the anti-virus community, having previously created an Android protection app.

It is currently focusing on current threats and leaving some old ones for later (like old win95, bootsector viruses, etc.).

The whole engine and x86 emulator are being created in-house."

Read More

VirusTotal += Tencent

We welcome Tencent as a new file scanning engine at VirusTotal. In the words of the company:

"Tencent anti-virus engine is an independent R&D anti-virus engine, which contains three technology-leading methods to  detect malware.

1. TAV uses clustering to extract the micro-signature efficiently and make sure the detection of malware efficiency. TAV also has the powerful ability of processing infective virus.

2. QQsm is a new anti-virus engine which using machine learning methods to detect malware. There are massive confirmed malwares and safe file in out database and we use those to make the Mathematical model which has a great detection rate for new form malware. 

3. TCloud is a cloud-based anti-engine, which has efficient response capability."

Read More

VirusTotal += Zillya

We welcome Zillya as a new file scanning engine at VirusTotal.

Read More

VirusTotal += AegisLab

We start february welcoming AegisLab as a new file scanning engine working at VirusTotal. AegisLab was already collaborating with us with WebGuard in the URL scanning system. A description from the company about the engine:

"AegisLab’s intelligent virus DNA algorithm extracts the special one-to-many mapping virus signatures. It achieved the much higher detection rate for latest Windows PE and Android APK variant virus. Their scan engine also uses the DNA fast match algorithm and is very suitable for limited resources environment. In native streaming mode, the engine is able to catch the most virus very efficiently from network packets."

Read More

VirusTotal += Ad-Aware

We welcome Ad-Aware as a new engine working at VirusTotal. In the words of Lavasoft:

"Ad-Aware 11 is Lavasoft’s next generation anti-malware product that includes behavior based heuristics, generic detection routines and virtual machine analysis for executable files that is capable of detecting zero-day and new/unknown malware. It has support for more than 100 packers and runs full multithreading and concurrent scans."

Read More

VirusTotal += CMC

We welcome CMC as a new engine working at VirusTotal. In the words of the antivirus company:

"CMC featured in house developed engine called Odin with static, dynamic unpackers, an x86 virtual machine to provide advanced de-obfuscation and in-memory engine to detect malware called Sonar. There is also a reputation based system named CMCRadar to accelerate response time, early warnings and global white listing."

Read More

VirusTotal += Bkav

We welcome Bkav as a new engine working at VirusTotal. This scanner includes both signature based and cloud technologies. This vietnamese company, established in 1995, is also a smartphone manufacturer.

Read More

VirusTotal += Baidu-International

We welcome Baidu International as a new engine working at VirusTotal. In the words of the antivirus company:

“Baidu international antivirus engine innovated original ultrafast cloud security technology. We established a huge Black-White sample list system. By aligning the client software on the user's computer with servers in Baidu cloud security data center, Baidu Antivirus utilizes cloud computing technology and its massive file database to quickly and accurately eradicate the latest trojans, unknown trojans, and other malicious programs. This solves the problems faced by traditional antivirus software such as the lag behind the latest trojans and viruses and the huge consumption of computer resources.”

Read More