Similar Searches

  • Counting Badness (July 24, 2009)

    Following up on the recent post by my colleague Dave Marcus concerning malware growth, the guys from AV-Test in Germany just released their updated stats. To avoid confusion when comparing the different numbers, here’s a quick explanation of

  • Malware Is Their Business…and Business Is Good! (July 22, 2009)

    I cribbed the title from Megadeth–I admit it. However, when looking at this year’s growth in malware it seems disturbingly appropriate. Global economic downturn or not, malware production continues at a record-setting pace because this is how many cybercriminals make

  • Malware at Midyear: a Summary (July 7, 2010)

    Now that we’ve reached the middle of the year, it’s time to take a look at our malware collection. During the first half of the year, 10 million samples entered in our database. That’s certainly no decrease compared with last

  • Troj/PDFEx-DF: SophosLabs sees malware exploiting /Launch (April 12, 2010)

    Last week, I talked about how to disable some functionality in Adobe Acrobat (see blog). This morning, we released generic detection for something we call Sus/PDFJs-S. Sophos will generically detect PDF files which use this functionality to run executables.This

  • Downloader Trojan Exploits Hole in IE 7 (December 9, 2008)

    We have lost count of how many blogs we have written this year that have anything to do with zero-day threats or unpatched vulnerabilities. Today, many Internet users in China have reported an infection, presumably from browsing

Related News

  • Counting Badness (July 24, 2009)

    Following up on the recent post by my colleague Dave Marcus concerning malware growth, the guys from AV-Test in Germany just released their updated stats. To avoid confusion when comparing the different numbers, here’s a quick explanation of

  • Malware Is Their Business…and Business Is Good! (July 22, 2009)

    I cribbed the title from Megadeth–I admit it. However, when looking at this year’s growth in malware it seems disturbingly appropriate. Global economic downturn or not, malware production continues at a record-setting pace because this is how many cybercriminals make

  • Malware at Midyear: a Summary (July 7, 2010)

    Now that we’ve reached the middle of the year, it’s time to take a look at our malware collection. During the first half of the year, 10 million samples entered in our database. That’s certainly no decrease compared with last

  • Troj/PDFEx-DF: SophosLabs sees malware exploiting /Launch (April 12, 2010)

    Last week, I talked about how to disable some functionality in Adobe Acrobat (see blog). This morning, we released generic detection for something we call Sus/PDFJs-S. Sophos will generically detect PDF files which use this functionality to run executables.This

  • Downloader Trojan Exploits Hole in IE 7 (December 9, 2008)

    We have lost count of how many blogs we have written this year that have anything to do with zero-day threats or unpatched vulnerabilities. Today, many Internet users in China have reported an infection, presumably from browsing

Latest News

Security vulnerabilities in Pligg CMS version 1.0.4

The correct CV(or malware)

Zombie game inspires scammers to target your brains

We are good at finding names

To infinity and beyond

Counting Malware

Malware continues to increase at a rapid rate. With the DAT-5516 release, scheduled for 4 February, the number of drivers in the DATs will pass 500,000. Half a million is a huge amount. I remember my first antivirus program, back in the ’80s, that had a count of about 80. I don’t recall the exact number, but it’s easy to place it into perspective. We add way more on a daily basis now.

However, our current count is not an absolute number of detected malware files; this can confuse many people. Drivers can be written very specifically, say one driver for one sample, but that’s not very effective. Most drivers are written to generically detect many samples. For example, one driver can detect 50 or as many as thousands of malware files. Therefore, the number of detected malware files is way higher then the half-million number reflected in the DATs. For another look at the complexity of counting malware detections, please see François Paget’s blog as well.

Initially VirusScan would focus just on true self-replicating viruses, mainly 8-bit (.com/.exe), MS-DOS viruses as well as boot viruses, which were prevalent then–and some still are today. Malware has evolved into many areas including, but not limited to, VBA, VBScript, JavaScript, 32-bit (pe-type .exe binaries) mass-mailers, 32-bit file infectors, mobile malware, adware and password stealers, and others. Nowadays the

Continue reading...


Source: McAfee Avert Labs

  • Counting Badness (July 24, 2009)

    Following up on the recent post by my colleague Dave Marcus concerning malware growth, the guys from AV-Test in Germany just released their updated stats. To avoid confusion when comparing the different numbers, here’s a quick explanation of

  • Malware Is Their Business…and Business Is Good! (July 22, 2009)

    I cribbed the title from Megadeth–I admit it. However, when looking at this year’s growth in malware it seems disturbingly appropriate. Global economic downturn or not, malware production continues at a record-setting pace because this is how many cybercriminals make

  • Malware at Midyear: a Summary (July 7, 2010)

    Now that we’ve reached the middle of the year, it’s time to take a look at our malware collection. During the first half of the year, 10 million samples entered in our database. That’s certainly no decrease compared with last

  • Troj/PDFEx-DF: SophosLabs sees malware exploiting /Launch (April 12, 2010)

    Last week, I talked about how to disable some functionality in Adobe Acrobat (see blog). This morning, we released generic detection for something we call Sus/PDFJs-S. Sophos will generically detect PDF files which use this functionality to run executables.This

  • Downloader Trojan Exploits Hole in IE 7 (December 9, 2008)

    We have lost count of how many blogs we have written this year that have anything to do with zero-day threats or unpatched vulnerabilities. Today, many Internet users in China have reported an infection, presumably from browsing

Copyright © 2010 The Security Blog. All rights reserved.