How does the zero hour anti virus of MX Lab performs?

How does the zero hour anti virus of MX Lab performs?

Category

Anti Spam

Virus outbreaks like in the past when tons of emails contained a virus, trojan or other malicious file attached are rare these days.

Distributors of these kind of mailicious codings are using other techniques to get their files on your computer. By email they try to attract your attention and get you clicking on a link to visit a web site. This web site then contains a script than will download the virus, trojan, or whatever malafide piece of code on your desktop. It is then very likely that you computer could be part of a zombie botnet.

However, virusses by email aren’t dead yet. During the last few weeks MX Lab has detected and intercepted emails with new virus variants. These virusses are attached to an email that mentions “You have received a Hallmark E-Card” or “Hot Pictures” and packed in a .zip or .rar archive.

Let’s find out how MX Lab performs with the zero hour anti virus technolgy and why you still need a very good anti virus scanning and filtering service.

How does the zero hour anti virus of MX Lab performs?

At 20:55 - local Belgium time - MX Lab detected some emails containing a .rar archive that where intercepted by our zero hour anti virus. The emails are in the German language with subjects like Abbuchungserlaubnis, Ihr neuer Arbeitsvertrag and Tilgungvertrag. This is an example of the content:��

At 22:04 we analysed the email and send the extracted Rechnung.exe file to Virus Total. Virus Total will scan each uploaded file to 33 anti virus engines.

This is the result: only 13 of the 33 anti virus engines did detect the virus!

Conclusion

With some major anti virus software vendors like Kaspersky, Symantec, Avast, Bitdefender,… don’t have a detection for this one you could face a serious security risk when you handle the incoming email without some attention. It is not the first time that we notice such a low detection rate when we analyse a file at Virus Total.

It is clear that some signature based anti virus engine alone aren’t sufficient. Combined with the zero hour anti virus service of MX Lab you will have a much better protection against virusses.

http://blog.mxlab.be/2008/06/23/how-does-the-zero-hour-anti-virus-of-mx