Sunbeltblog comments
So if today you're staffed to handle 21,000 samples per day, the forecast says you'll need to staff to handle 100,000 samples per day. Where does it end?
Alex, where is the median between the vendors who decry the Wild List and the vendors who decry the Race To Zero?
With such a huge volume of "new" viruses, it's clear to me that they are permutations and that chasing patterns is *SO* 1990, the path to effectiveness must be in catching them by heuristics.
But heuristics has been a touted feature since 2000 in all antivirus products, so are the vendors selling soap, or have they just not gone "meta" enough?
I get enough false positives on Trend Micro that tell me they identify packers, with little regard for whitelisting. If that's their idea of heuristics, it is a pretty poor idea.
And while I'm at it, it would be great if Trend Micro would get with the program and allow VirusTotal.com to use their scanner, and to drop their lawsuit against Barracuda (which seems to threaten any appliance maker which uses ClamAV to scan email).
Interestingly, certain vendors will slag off the wildlist etc but will prominently display any VB100 awards on their homepages as "proof" of how good they are...
Trend is boycotting *VB*, they're just using the WL as a scapegoat.
Trend's was doing fine in their VB tests until August of 2007 when they failed to get a VB100 because they had a False Positive. Then they failed the next one because they had incomplete polymorphic detection for Virut, which Fortinet has as #4 family and VB has as #5 family of cases in April08. Then Trend failed the lastest VB because of two FPs.
VB100 looks quite relevent. Just that Trend is having trouble getting the award.
example:
ESET has achieved 49 Virus Bulletin VB100 Awards, more than any other vendor. In Virus Bulletin's comparative tests, ESET NOD32 Antivirus has not missed an 'In the Wild' virus sample since May 1998.
http://www.eset.com/company/awards.php
The same people that say it is no longer a good indication of the protection offered.
Commenting by HaloScan
