OPSWAT’s Metascan Online – A VirusTotal Alternative

I’m right and you’re wrong.

No, I’m right and you’re wrong!

You’re listening to a couple of sports fans arguing over who’s the best tennis player maybe? Could be – but, if you’re analyzing a downloaded file with more than one antimalware application (and you should), you could be witnessing a more serious difference of opinion.

You’ve primary anti-malware application is advising you that the application you just downloaded contains malware. But, since you’re an aware computer user, you’ve launched your secondary malware scanner and – surprise – there’s a difference of opinion – no malware.

So, you’re now dealing with the big question – are you dealing with a false positive thrown up by the primary malware scanner, or is it more likely that the secondary scanner is misbehaving?

You could just flip a coin, or go with your best guess – but, you didn’t become a super user by flipping coins, or guessing, when it comes to your system’s security. No, you’re better than that, so you upload the questionable file to VirusTotal, where it will be scanned for nasties by thirty five plus diverse online scanners.

VirusTotal result – a clean file. Elapsed time on this scan – under a minute.

As an alternative to VirusTotal, or in addition to (maybe not a bad idea), you can run the file through a new service now being offered by OPSWAT, the company behind the highly recommended AppRemover.

OPSWAT’s Metascan Online, is similar in many respects to VirusTotal – as the following screen shots indicate.

Browse your Hard Drive for the file to be uploaded (for this test I’ve selected a different executable – 15 MB as opposed to 3 MB).

Detailed results are shown in the  following screen capture. As you can see – the file has been processed through 19 AVs and has come up clean. Elapsed time on this scan – just over a minute.

This new service was launched just a few days ago, so you may experience a glitch or two. In testing, over several days (in both Windows and Ubuntu Linux), I must admit I bumped my head a time or two,  but after speaking with the company, the minor server issues I encountered were resolved quickly.

Responsiveness to customer issues is the hallmark of a client centered organization, and OPSWAT certainly meets that test.

Fast facts:

Use of multiple antivirus engines

Real-time automatic updates of virus signatures

Detailed results from each antivirus engine

Real time global statistics available

Keep in mind, an online scanning service is not a substitute for an appropriate local defense system, including a firewall (either software or hardware), and a sound and effective anti-malware application.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Two Free VirusTotal Apps Can Help You Catch Malware Preemptively

You’ve run your primary anti-malware application, and up pops a notice advising you that you have an infection. But since you’re an aware computer user, you launch both your secondary malware scanners in sequence and – surprise! According to your secondary scanners you are not infected.

But, you’re aware that anti-malware programs that rely on a definition database to identify malware files, can often be behind the curve in recognizing the newest threats.

So, decision time. Do you then trust your primary anti-malware application and attempt removal, or instead, do you trust the results produced by your secondary scanners, and leave well enough alone?

In reality, you’re not limited to just these two choices. There is another option open to you.

If you’re worried about a specific file, here’s an interesting twist on free Online scanners – you can have any computer file (files are restricted to a maximum of 20 megabytes), scanned for nasties by thirty five plus diverse online scanners; all in one go, through VirusTotal.

To take advantage of this service, simply upload a file that you’re uncertain of to Virus Total, or as an alternative, submit your suspicious file to Virus Total by email. What could be simpler?

File submissions (Last 7 days)

This graph shows the number of files received at VirusTotal over the last 7 days. The image illustrates how many of these were new at VirusTotal, and the submissions which were detected by at least one antivirus. Click on any graphic to expand to original size.

Top 10 file submissions (Yesterday – December 29, 2010)

This table shows the most submitted files yesterday to VirusTotal, the last detection rate, and the number of times they were submitted is specified.

Quick facts:

Free, independent service

Use of multiple antivirus engines

Real-time automatic updates of virus signatures

Detailed results from each antivirus engine

Real time global statistics

Keep in mind, this service is not a substitute for an appropriate local defense system, including a firewall (either software or hardware), and a sound and effective anti-malware application.

Upload your suspicious file/s to: Virus Total

VTzilla:

 

VirusTotal recently released a Firefox only extension – VTzilla. VTzilla has been designed to scan URLs, links, and files (potential downloads) for malware, by employing the installed toolbar, or alternatively, the right click context menu.

Using the toolbar, I’ve plugged in my own site address as an example.

VirusTotal’s report indicates my site is a safe site, and does not contain malware.

Next, I visited Download.com and set up a download. Before saving the file however, using the right click context menu again, I had VirusTotal perform a scan.

The result indicates a clean site.

A couple of caveats:

Regular VirusTotal users are aware that file size is restricted to 20 MB or less, and this restriction unfortunately, is still in effect for this new service.

VTzilla is available only as a direct download from the developer’s site at the moment. It should be available from Firefox’s add-on repository, in due course.

Overall, I think this extension has some value. But, it is not a panacea. More and more, if a site is imbedded with malware, just visiting the site can trigger a driveby download. Porn surfers particularly, need to take note of this.

System requirements: Firefox 1.5 – 3+

Download at: the developer’s site.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

False Malware Positive? Or Not? How Do You Decide?

You’ve run your primary anti-malware application, and up pops a notice advising you that you have an infection. But since you’re an aware computer user, you launch both your secondary malware scanners in sequence and – surprise! According to your secondary scanners you are not infected.

But, you’re aware that anti-malware programs that rely on a definition database to identify malware files, can often be behind the curve in recognizing the newest threats.

So, decision time. Do you then trust your primary anti-malware application and attempt removal, or instead, do you trust the results produced by your secondary scanners, and leave well enough alone?

In reality, you’re not really limited to just these two choices. There is another option open to you.

If you’re worried about a specific file, here’s an interesting twist on free Online scanners– you can have any specific computer file (files are restricted to a maximum of 10 megabytes), scanned for nasties by thirty five plus diverse online scanners, all in one go, through VirusTotal.

To take advantage of this service, simply upload a file, that you’re uncertain of, to Virus Total, or as an alternative submit your suspicious file to Virus Total by email. What could be simpler?

The following graphics indicate just how efficient this free service is.

Received Files/Infected Files (Last 24 Hours) May 28, 2010:

This image shows the number of files that have been detected as infected (red) among the total number of files received within the last 24 hours (clean ones marked in blue).

Top 10 Infected Files (Last 24 Hours), May 28, 2010:

This image shows the list of the most-uploaded infected files received within the last 24 hours.

Quick facts:

Free, independent service

Use of multiple antivirus engines

Real-time automatic updates of virus signatures

Detailed results from each antivirus engine

Real time global statistics

Keep in mind, this service is not a substitute for an appropriate local defense system, including a firewall (either software or hardware), and a sound and effective anti-malware application.

Upload your suspicious file/s to: Virus Total

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.