Reply to thread

Message

<blockquote data-quote="Fabian Wosar" data-source="post: 841321" data-attributes="member: 24327">It isn&#039;t for most users.Ikarus was cheaper than Bitdefender is. Avira is cheaper as well. Cyberreason is, too. It&#039;s not that we don&#039;t look at other engines but so far none of the engines is worth switching to. The biggest issue is, that those impressive detection results of those engines people constantly ask us to switch to are achieved by literally uploading those files to the AV vendor&#039;s cloud. We would have no idea what they are doing with the files except a piece of paper where they claim they delete them and don&#039;t do any tracking etc.. That&#039;s why we won&#039;t use them. If anything it is more likely we will ramp up the detection coverage of our own engine, which is perfectly capable of dealing with all forms of malware out there, and ditch a third-party engine entirely.We do have interpreters or &quot;emulators&quot; for certain scripting languages like JavaScript or Batch for example. However, once stuff is deobfuscated, which it is in case of AMSI, a simple regular expression is almost always enough to look for the relevant suspicious function calls and so on, ignoring formatting tricks and so on, in order to write even a good heuristic-based detection without actually understanding the script.</blockquote>

[QUOTE="Fabian Wosar, post: 841321, member: 24327"] It isn't for most users. Ikarus was cheaper than Bitdefender is. Avira is cheaper as well. Cyberreason is, too. It's not that we don't look at other engines but so far none of the engines is worth switching to. The biggest issue is, that those impressive detection results of those engines people constantly ask us to switch to are achieved by literally uploading those files to the AV vendor's cloud. We would have no idea what they are doing with the files except a piece of paper where they claim they delete them and don't do any tracking etc.. That's why we won't use them. If anything it is more likely we will ramp up the detection coverage of our own engine, which is perfectly capable of dealing with all forms of malware out there, and ditch a third-party engine entirely. We do have interpreters or "emulators" for certain scripting languages like JavaScript or Batch for example. However, once stuff is deobfuscated, which it is in case of AMSI, a simple regular expression is almost always enough to look for the relevant suspicious function calls and so on, ignoring formatting tricks and so on, in order to write even a good heuristic-based detection without actually understanding the script. [/QUOTE]

Verification