lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20040105121717.61510.qmail@web60805.mail.yahoo.com>
From: sgmasood at yahoo.com (S G Masood)
Subject: Show me the Virrii! (heuristics)

Hi Alex,

Good points.

To add an example, Swen was detected automatically as
"W32.Automat.AHB" by Norton AV before its signatures
were added. When Norton AV detects a new virus based
on heuristics, it usually identifies it as
"W32.Automat.*", with "Automat" probably standing for
"Automatically Detected".

Regards,

--
S.G.Masood




--- starlabs <ashipp@...sagelabs.com> wrote:
> > Does anyone have reliable reports of an antivirus
> system firing 
> > off on a heuristic?
> 
> >I'm not aware of ever having seen one; always seems
> to be a
> >signature.
> 
> 
> As part of my job I regularly evaluate antivirus
> products. I have 
> seen plenty of heuristic detections; all the engines
> have different 
> heuristic capabilities, so some detect more new
> malware than others, 
> and of course some also have more false positives
> than others.
> 
> Your experience might be because you are using a
> poor heuristic
> engine, or because by the time you get a sample of a
> real new
> virus, your vendor has released a signature anyway,
> even if they
> detected it heuristically anyway.
> 
> My findings indicate that the state of the art is
> that most 
> new malware can be detected heuristically these
> days.
> 
> Regards,
> 
> Alex
> 
> 
> 
> 
>
________________________________________________________________________
> This email has been scanned for all viruses by the
> MessageLabs Email
> Security System. For more information on a proactive
> email security
> service working around the clock, around the globe,
> visit
> http://www.messagelabs.com
>
________________________________________________________________________
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter:
http://lists.netsys.com/full-disclosure-charter.html


__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ