Comments on: AVs prove less-effective

By: david.kierznowski

david.kierznowski — Sat, 05 May 2007 14:59:57 +0000

Kurt, can you send me the version info and i’ll update the list :)

kk, can’t comment for Julio, don’t really know much about VirusTotal. However, the debate of whether AV engines should detect malicious code is already being done. The debate is more “what” signatures should be added – it seems to be done by risk and personal preference at the moment. This really requires a post on its own.

Thanks for your guys feedback.

By: Kurt Grutzmacher

Kurt Grutzmacher — Mon, 30 Apr 2007 17:14:05 +0000

Looks like the latest Symantec AV-10 picks up on CFEXEC.CFM now. It can probably be modified to bypass heuristics. :)

By: kk

kk — Mon, 30 Apr 2007 17:09:08 +0000

Not only are the AV engines in VirusTotal different (perimeter, host, ..) which make “comparing” rather unscientific, but also it’s questionable if these scripts (which anybody can change its contents completely) should be detected by AV signatures or other technologies such as web app IDS/IPS or even web server configuration/filters. This study is not serious, not scientific and, worse of all, not relevant and a waste of time. Spend your time on more useful stuff.

By: david.kierznowski

david.kierznowski — Sun, 29 Apr 2007 19:53:37 +0000

Julio, don’t really get what your saying?

pp, what is difficult to read, the site in general or a particular post?

By: pp

pp — Wed, 25 Apr 2007 07:48:33 +0000

White on black is difficult to read. Use black on white.

By: Julio Canto

Julio Canto — Wed, 25 Apr 2007 05:35:17 +0000

Usint VirusTotal for this kind of things is not serious.