Virus Daily Stats

Notes

There has been a lot of discussion on how well each vendor does in a 'zero-day' situation, and that our stats seem to be higher than the industry norm. To better understand why these statistics show what they do, we have to look back to the sources of the binaries. Since August of 2007, we have seen a very large increase of dropper style malware being propagated. The detection rate for these types of malware (mostly trojans), is not as good as the malware that they eventually download and install. Once a system has been infected and controlled, a more reliable and stable binary is loaded. These binaries are detected at a much higher percent than the other binaries that we see because they are in many case nothing new to the Anti-Virus vendors. This trend is more clearly seen by looking at our source table and because the majority of the binaries are coming from the sandboxing process means that we are receiving the greatest amount of malware from the malware samples themselves. These in turn are all fed back into the Anti-Virus testing systems and reset to the sandbox systems.

If and when this trend changes again, the charts will reflect those new directions the malware authors are taking the infection vectors.