Jan Monsch redoes tests and comes up with interesting results

Last week, I had criticized Jan Monsch’s tests on how well antivirus engines detected viruses inside of variants of Word files, since he had relied on a fake EICAR signature for his testing (Jan was trying to see if viruses could evade antivirus programs by embedding themselves into RTF files, XML documents, and the like).

Jan is a good guy and to his credit (unlike others), he took the critique well and we started a discussion.  After a series of follow-up emails with Andreas Marx and me, Jon created a new test with a real, live virus (Netsky), and the test results are interesting to observe.  Basically, here is how virus engines fared by file format (I’ve edited his table for clarity):

(It’s worth noting that these document types are not being used as an attack vector for viruses at this time.)

Link to the full PDF here.

Alex Eckelberry