Before I get into the results, it is interesting to note that fake AV perpetrators often reuse the same names for different executables. For example, the malicious executable scanner.exe, was found with different file sizes, which resulted in different AV detection results, depending on where the executables came from. The opposite is also true. The same exact file (same size, same MD5) was found on different domains under different names. I made sure my 16 samples were indeed different files to not skew the comparison.
 |
| VirusTotal - Detection information for one sample |
The average detection rate was found to be 30%. The detection rate for each sample varied from 12% to 49%.
The best AV engine detected 13 of the 16 samples (81% detection rate). Only 13 out of the 43 AV software detected at least 50% of the samples.
 |
| Click on the image to see the detection rate for all AV software |
The best AV solution to detect fake AV malware is Sophos, with an 81% detection rate, followed by Sunbelt (75%).
 |
| 5 best AV solutions against fake AV malware |
The 13 AV engines which detected at least 50% of the malicious executables are (in alphabetical order):
- AhnLab-V3
- AntiVir
- BitDefender
- F-Secure
- GData
- Kaspersky
- NOD32
- PCTools
- Sophos
- Sunbelt
- Symantec
- TrendMicro
- TrendMicro-HouseCall
The following 7 AV engines did not detect any of the samples:
- ClamAV
- eSafe
- Fortinet
- Jiangmin
- TheHacker
- ViRobot
- VirusBuster
Conclusion
The AV vendors need to step up and improve their detection. Samples are easily found. I've explained how to get to the fake AV pages from a Google query of the Hot Trends in previous posts.
-- Julien
Posts
6 comments:
Hi,Julien
I worked AV company in Korea
I think you saw one testing.
I want to receive the 16 samples.
Nice to meet you.
thank you.
http://blog.hispasec.com/virustotal/22
you're using virustotal to test/compare anti-malware products? really? after numerous (including the hispasec folks themselves) have warned against it and said it's a bogus methodology, you still persist?
@kurt: Could you send me some references about your claims on issues with VirusTotal? I run a few AV in house (AVG, Kaspersky, Panda, ClamAV, etc.) on Windows and Linux, I got the exact same results as VirusTotal.
@julien sobrier
it seems to me that jcanto beat me to it. i included the url of my own post on the subject in the name/url pair used to identify myself in this comment.
the rule of thumb is this: virustotal is for testing samples, not for testing anti-malware products.
Ahnlab isn't well known product yet.
Maybe it;s good for detect other malware but for real major malware it's missed.
I was founr it's review on Youtube it's poor.
Post a Comment