My advice would be to treat the tests performed by ICSA and VB for what
they are; benchmarking. Certainly, the results you see from the VB
comparatives aren't influenced by advertisers. On the other hand, if you
assume because product x routinely gets 100% scores in these benchmarks,
that because product x scans your system and says it's clean, it is,
well, then you've just lowered your defenses. Example, I found two files
on a system my daughter was using that the darling of the VB
comparatives said were Kosher. I suspected at least one wasn't, as the
firewall I installed on that system told me it wanted internet
privileges. So, I sent both files to eset, Symantec and TrendMicro (to
be fair, SAV and TIS said these files were Kosher, too). Turns out, I
received a reply back from all three saying one was a variant of sdbot
and the other was a loader.
To add to this, I'm going to paste the result of a little test I ran
recently. I was curious about what scanners would have to say about
twelve files in particular I found recently in circulation which are
most probably viable malwares. They were uploaded individually to:
http://www.virustotal.com/flash/index_en.html
Here's the result:
File 1.
BitDefender found nothing
ClamWin found nothing
eTrustAV-Inoc found nothing
Kaspersky found [Trojan.Win32.VB.kz]
McAfee found [AdClicker-AO]
NOD32 found nothing
Norman found nothing
Panda found [Spyware/Adclicker]
Sybari found [Trojan.Win32.VB.kz]
Symantec found nothing
TrendMicro found nothing
File 2.
BitDefender found [Trojan.Dropper.Small.GT]
ClamWin found [Trojan.Dropper.Small-8]
eTrustAV-Inoc found nothing
Kaspersky found [TrojanDropper.Win32.Small.gt]
McAfee found nothing
NOD32 found [Win32/TrojanDropper.Small.GT]
Norman found nothing
Panda found [Adware/NetPals]
Sybari found [TrojanDropper.Win32.Small.gt]
Symantec found nothing
TrendMicro found nothing
File 3.
BitDefender found [Backdoor.Hackarmy.1.Gen]
ClamWin found [Trojan.Hackarmy.gen-4]
eTrustAV-Inoc found [Backdoor/AZV.Variant]
Kaspersky found [Backdoor.Hackarmy.gen]
McAfee found [BackDoor-AZV]
NOD32 found [Win32/Hackarmy.AE]
Norman found [W32/Hackarmy.Z]
Panda found [Bck/HackArmy.T]
Sybari found [W32/Hackarmy.]
Symantec found nothing
TrendMicro found nothing
File 4.
BitDefender found [JS.Dword.dropper]
ClamWin found [Trojan.JS.RunMe]
eTrustAV-Inoc found [JScript/IE.VM.Exploit]
Kaspersky found [Exploit.CodeBaseExec]
McAfee found [JS/IllWill]
NOD32 found [Win32/IE.Dword unknown infection
type (Exploit)]
Norman found [HTML/Bagle.AI@mm]
Panda found [JS/Illwill.A]
Sybari found [JS/IllWill]
Symantec found nothing
TrendMicro found [HTML_BAGLE.AC]
File 5.
BitDefender found [Win32.MyDoom.S@mm]
ClamWin found [Worm.Mydoom.S]
eTrustAV-Inoc found nothing
Kaspersky found [I-Worm.Mydoom.q]
McAfee found [W32/Mydoom.s@MM]
NOD32 found [Win32/Mydoom.T]
Norman found [MyDoom.M@mm]
Panda found [W32/Mydoom.R.worm]
Sybari found [Win32.Mydoom.S]
Symantec found nothing
TrendMicro found [WORM_RATOS.A]
File 6.
BitDefender found [HTML.NoWarn]
ClamWin found [HTML.Nowarn]
eTrustAV-Inoc found [VBS/1nternal.Worm]
Kaspersky found [HTML.NoWarn.b]
McAfee found [VBS/NoWarning.b]
NOD32 found [probably unknown SCRIPT]
Norman found [VBS/Internal.1921]
Panda found [VBS/Internal.A]
Sybari found [HTML.NoWarn.b]
Symantec found nothing
TrendMicro found [VBS_INTERNAL.E]
File 7.
BitDefender found [HTML.NoWarn.a]
ClamWin found [HTML.Nowarn]
eTrustAV-Inoc found [VBS/1nternal.Worm]
Kaspersky found [HTML.NoWarn.a]
McAfee found [VBS/NoWarning.a]
NOD32 found [probably unknown SCRIPT]
Norman found [VBS/Internal.1919]
Panda found [VBS/Internal.A]
Sybari found [VBS/NoWarn-A]
Symantec found nothing
TrendMicro found [VBS_INTERNAL.D]
File 8.
BitDefender found [VBS.Internal.A]
ClamWin found [HTML.Prep]
eTrustAV-Inoc found [VBS/Off]
Kaspersky found [HTML.Internal]
McAfee found [VBS/HTMLP.1670]
NOD32 found [probably unknown SCRIPT]
Norman found [VBS/Internal.1670]
Panda found [VBS/Internal.A]
Sybari found [VBS.Prepend.A]
Symantec found [VBS.Prepend]
TrendMicro found [VBS_INTERNAL.A]
File 9.
BitDefender found [VBS.Internal.B]
ClamWin found [VBS.Internal.B]
eTrustAV-Inoc found [VBS/Off]
Kaspersky found [HTML.Internal.c]
McAfee found [VBS/Redinal]
NOD32 found [probably unknown SCRIPT]
Norman found [VBS/Internal.1152.B]
Panda found [VBS/Internal.C]
Sybari found [VBS/Off]
Symantec found nothing
TrendMicro found [VBS_INTERNAL.B]
File 10.
BitDefender found [HTML.Umbriel.A]
ClamWin found [HTML.Umbriel.A]
eTrustAV-Inoc found [VBS/Umbriel.Trojan]
Kaspersky found [HTML.Fpumb]
McAfee found [Bat.ow/btg]
NOD32 found [VBS/Briel.A]
Norman found nothing
Panda found [Trj/Umbriel.A]
Sybari found [Bat.ow/btg]
Symantec found nothing
TrendMicro found [HTML_UMBRIEL.A]
File 11.
BitDefender found [Trojan.Downloader.Rameh.C]
ClamWin found [Trojan.Downloader.Rameh-1]
eTrustAV-Inoc found nothing
Kaspersky found [TrojanDownloader.Win32.Rameh.c]
McAfee found nothing
NOD32 found [Win32/TrojanDownloader.Rameh.C]
Norman found nothing
Panda found [Adware/NetPals]
Sybari found [TrojanDownloader.Win32.Rameh.c]
Symantec found nothing
TrendMicro found nothing
File 12.
BitDefender found nothing
ClamWin found [Worm.SomeFool.Gen-2]
eTrustAV-Inoc found [Win32/Netsky.B.Zip.Worm]
Kaspersky found [I-Worm.NetSky.b]
McAfee found [W32/Netsky.b.eml!zip]
NOD32 found nothing
Norman found nothing
Panda found nothing
Sybari found [I-Worm.NetSky.b]
Symantec found nothing
TrendMicro found [WORM_NETSKY.B]
---------------------------------------------------------------------------------
In particular, I thought that eleven "nothings" from NAV (Symantec) is
an awful lot of "nothings"
Art
http://www.epix.net/~artnpeg