Thanks for the comment, that’s exactly the point I am making, it is relatively trivial for a criminal to test their malicious binaries until they are no longer detected, by any vendor, before release. In fact there are criminal services that do this on an automated basis. Obviously once infected most “good” malware will blackhole security vendor sites. That is why it is important that serious anti-malware products do not simply focus on the file content but look at other vectors as well such as download sources, email sources and phone home activity. Pattern-based detection offers baseline protection, at best.

This rolls over into a bigger discussion around testing methodologies for security products. If you take a big pool of sample files and run each product against them, this no longer (with advanced solutions like OfficeScan) gives you any idea at all about whether or not you would have been protected by that vendor. Would you have received the malicious email that contained the malicous link or file or would it have been blocked? If you had clicked the malicious link would you have been allowed to access the site or would it have been blocked? If you did get infected, would the bot have been able to phone home to process updates or send all the stolen data out? These are challenges that need be addressed in the exposure layer, NOT just in the infection layer.

Cheers,
Rik

http://www.networkforensics.com/2010/02/19/kneber-update/