From: starlabs (ashippmessagelabs.com)
Date: Mon Jan 05 2004 - 03:33:32 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> Does anyone have reliable reports of an antivirus system firing
> off on a heuristic?

>I'm not aware of ever having seen one; always seems to be a
>signature.

As part of my job I regularly evaluate antivirus products. I have
seen plenty of heuristic detections; all the engines have different
heuristic capabilities, so some detect more new malware than others,
and of course some also have more false positives than others.

Your experience might be because you are using a poor heuristic
engine, or because by the time you get a sample of a real new
virus, your vendor has released a signature anyway, even if they
detected it heuristically anyway.

My findings indicate that the state of the art is that most
new malware can be detected heuristically these days.

Regards,

Alex

________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs Email
Security System. For more information on a proactive email security
service working around the clock, around the globe, visit
http://www.messagelabs.com
________________________________________________________________________

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]