The biggest eye-opener comes from the occasional new employee who doesn’t know they aren’t using windows since their desktop only shows a few custom icons for the specific applications they need to use during the day and their desktops are normally always open to those specific applications and nothing else. The only thing they need to get used to is not closing their applications and shutting down the computer at the end of the day, instead they keep their apps open, their current work is saved but not shut down, and they get to start again the next day exactly where they left off the evening before. And the employees who come from other businesses who are still using Windows 95, Windows 98 (and for rebooting purposes to a lesser extent Windows XP, or even Windows for Workgroups who also used Windows 95/98), and who are used to rebooting after breaks or lunch or the afternoon because their desktop slows down after some hours of use, and who wonder why they never blue screen anymore.

My thoughts on the effectiveness of the blend of signature-based and behavior-based protections on the market today, I would say that for the most part the blending of the technologies is standard amongst vendors and it does work. Of course there are always exceptions to the rule. For instance, many of our customers come from our competitors after their computer or network has already been compromised. Is this an engine, technology, or a resource failure? Well, it’s hard to tell because there are many factors, but in many cases cybercriminals develop malware to subvert the technology of larger vendors, leaving the end users open to attack.
The biggest problem we tackled at Panda was not an engine or technology problem, it was a resource issue. When malware authors start to produce and distribute thousands of unique samples with the click of a button, it becomes a huge task to address. Our Collective Intelligence system automatically processes malware and creates signatures for over 99% of the 25,000 samples (avg) we receive on a daily basis. What do we do with the spare time? We’re developing the next innovative technology, of course ; -)

On who’s doing what that’s most interesting and effective, I think that many vendors are currently mixing and adding small improvements to their engine functionality but we are not seeing any major technological advancement. In the next two years I expect to see more vendors integrating automated malware classification systems and cloud services into their core product lines.

Juan

thanks for this great article…

I’m using TrustDefender which helped me detecting a silentbanker infection on my PC.

Their blog (http://www.trustdefender.com/blog/) has lots of technical information.

http://www.youtube.com/profile?user=mrizos&view=videos

Enjoyed reading your Zero Day Threat book. If you are looking for a security forum, Wilders is a great venue.

http://www.wilderssecurity.com/forumdisplay.php?f=35

You might want to also check Matt’s reviews where he actually performs anti-malware tests via Youtube.

http://www.wilderssecurity.com/forumdisplay.php?f=35

Interesting and ingightfull post.

Without trying to pitch Panda’s products, let me respectfully disagree with Jose Nazario’s quote when he says that the effectiveness of popular consumer antivirus suites in protecting against banking trojans? is only “modest”. He claims that “… the volume of malware and the technology they employ – and the incentive to avoid detection at all costs – means that most AV has only modest detection of these variants …”.

At Panda Security, we have developed a technology designed to fight an ever-growing number of malware samples, as this is a trend we foresaw back in 2006. We have labelled this system Collective Intelligence and this is already available in our consumer products to better protect our customers.

In addition, let me reference the following report that Pandalabs published last week “Bank details uncovered”, which may be interesting to you and your readers as it relates to this very same topic. You can find it here: http://www.pandasecurity.com/img/enc/Boletines%20PandaLabs4_en.pdf

Juan.
CEO, Panda Security