We welcome the Webroot scanner to VirusTotal.

[greenebola]

We welcome the Webroot scanner to VirusTotal. This is a machine learning engine from the US. In the words of the company:



"Webroot SecureAnywhere Business Endpoint Protection is a cloud-driven anti-malware solution and was the first next generation solution to offer a full replacement to conventional AV when launched in 2011.

Rather than rely on static signatures to identify malicious files and process, Webroot uses real-time monitoring and analysis of the events occurring within a device. Then, by using the extensive resources of cloud-based computing, threat and behavioral intelligence, Webroot is able to predict with negligible false positives any signs of malicious behavior. Windows PE files submitted to VirusTotal will be processed by the Webroot PE Scanner, non-PE files will not be scanned.”


Webroot has expressed its commitment to follow the recommendations of AMTSO and, in compliance with our policy, facilitates this review by MRG Effitas, an AMTSO-member tester.

VirusTotal Blog: VirusTotal += Webroot


Webroot Community Forum:
Webroot added to VirusTotal - Webroot Community

 

[In2an3_PpG]

That's cool.

Glad they joined in.

 

[Winter Soldier]

Good news.
Glad to see a new kid in town

 

[Like a Western!]

good for who?

it's bad for Webroot users : ))
the only way which Webroot was able to protect their users was their Database, and now that's published too! good for Malware Writers xDD

of course Webroot anti-phishing is impressive, but yet they have nothing but their Database. ( i need a budyguard to protect me against Webroot fanboys after posting this reply ))) )

 

[amir 957]

good for who?

it's bad for Webroot users : ))
the only way which Webroot was able to protect their users was their Database, and now that's published too! good for Malware Writers xDD

of course Webroot anti-phishing is impressive, but yet they have nothing but their Database. ( i need a budyguard to protect me against Webroot fanboys after posting this reply ))) )

Why do you say that's good for Malware writers?

 

[Like a Western!]

Why do you say that's good for Malware writers?

the only Webroot weapon against them was its Database, now its published, they can easly found out their malware will catch by Webroot or not

 

[Azure]

Well, this is weird... Considering that they left Virustotal more than a year ago (I believe).

 

[Like a Western!]

Well, this is weird... Considering that they left Virustotal more than a year ago (I believe).

even themselves believed that it would be not good for them to join VT what changed their believes? God knows!

 

[KGBagent47]

Scanning through VirusTotal detection's (Only this site will understand why that is amusing) I noticed the addition of a new AV engine Webroot. As a Webroot fan I'm glad to see this.

Perhaps somehow they can utilize this to improve their static detection.

 

[Wave]

good for who?

it's bad for Webroot users : ))
the only way which Webroot was able to protect their users was their Database, and now that's published too! good for Malware Writers xDD

of course Webroot anti-phishing is impressive, but yet they have nothing but their Database. ( i need a budyguard to protect me against Webroot fanboys after posting this reply ))) )

You do not understand how VirusTotal works, let me direct you to the FAQ where you can do some research: FAQ - VirusTotal

Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/agressiveness level than the official end-user default configuration.

The engine submitted to VirusTotal may not necessarily be identical to the engine implementation in the end-user or enterprise product. This means that the VirusTotal engine version may cause more false positive detection's, or have a worse detection compared to the actual product itself.

Regarding the "good for who?" part, it's good for normal people with safe browsing habits who scan downloads at VirusTotal prior to running them on their systems, since now they're will be an extra engine to scan the files with -> each engine may work differently therefore Webroot may help someone out there scanning a download that other vendors may not detect.

even themselves believed that it would be not good for them to join VT what changed their believes? God knows!

Business? Marketing?

 

[Winter Soldier]

Agreed @Wave
Webroot is a great addition on VT but antivirus products include many technologies: behavior blockers, heuristic behavior analyzers, dynamic heuristic engines, used to mitigate the gap between the creation of malware and the release of signatures.
If, when analyzing a file to VirusTotal, it comes out some heuristics detections, this doesn't necessarily mean that all the heuristic technology of a certain product was included in the on-demand scanners. Simply, there are some technologies that may not be included in an on demand scanners. These technologies play a crucial role in the interception of 0day malware attacks.

 

[Deleted member 178]

even themselves believed that it would be not good for them to join VT what changed their believes? God knows!

because VT's new rule enforce vendors to submit their engines if they want use VT in their software?

Business? Marketing?

maybe they need VT after all ?

 

[FleischmannTV]

maybe they need VT after all ?

That's what I am thinking, probably a lot more than they'd care to admit.

 

[greenebola]

WR_Paul wrote:
Product Manager

Hi Everyone,

We decided to launch the VirusTotal scanner to provide the wider community the ability to get our opinion on files, it's taken us a little while to get here as we've been heads down focussing on servicing the needs of our customers, via our product portfolio.

Also, it should be noted that the engine we published on VT is different to our engine in the Webroot SecureAnywhere product portfolio. The engine will statically scan files submitted to VT leverage our Threat Intelligence backend to provide classifications. As you all may know, in oue SecureAnywhere agent have classification for good, bad and unknown files returned ( our log files highlight this), VT focussed purely on the Bad (malicious) classifications, so you will not be able to see whether a submitted file is Good (whitelisted) via VT, please use our SecureAnywhere agent if you'd like to verify if files are whitelisted.

If you have any questions, feel free to post here or PM me.

Regards,

Paul
Product Strategy

Webroot added to VirusTotal - Page 2 - Webroot Community