Return to Answer

Detection for a piece of malware is never removed from a mainstream AV.

Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.

Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific detection. So variants start trickling in: Malw.1, Malw.B, Malw.X.32768, ... . The AV company then starts seeing a pattern and produces a smarter signature that finds a common factor and detects all of the variants.

This smarter signature might be:

• the same classical byte pattern but on something that doesn't change between variants
• a regular-expression-like pattern
• a combination of byte patterns and metadata about the executable
• features extracted from emulating the malware, like packers, loading patterns and behavior

This smarter signature is slower than the simple byte pattern but when there are a lot of variant signatures, the overall performance will favor the smart signature. When the performance is better with the smart signature, the simple signatures will receive a lower priority or will be deleted. Some AV engines will output the detection with multiple signatures, not just stop at the first detection.

Periodical re-scanning of the entire collection of malware is performed to check if some changes in the AV have lead to malware not being detected or false positives have been introduced by smart signatures.

Detection for a piece of malware is never removed from a mainstream AV.

Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.

Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific detection. So variants start trickling in: Malw.1, Malw.B, Malw.X.32768, ... . The AV company then starts seeing a pattern and produces a smarter signature that finds a common factor and detects all of the variants.

This smarter signature might be:

• the same classical byte pattern but on something that doesn't change between variants
• a regular-expression-like pattern
• a combination of byte patterns and metadata about the executable
• features extracted from emulating the malware, like packers, loading patterns and behavior

This smarter signature is slower than the simple byte pattern but when there are a lot of variant signatures, the overall performance will favor the smart signature. When the performance is better with the smart signature, the simple signatures will receive a lower priority or will be deleted. That means Some malware will lose specific detection although some AV engines will output the detection with multiple signatures, not just stop at the first detection.

Periodical re-scanning of the entire collection of malware is performed to check if some changes in the AV have lead to malware not being detected or false positives have been introduced by smart signatures.

Detection for a piece of malware is never removed from a mainstream AV.

Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.

Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific detection. So variants start trickling in: Malw.1, Malw.B, Malw.X.32768, ... . The AV company then starts seeing a pattern and produces a smarter signature that finds a common factor and detects all of the variants.

This smarter signature might be:

• the same classical byte pattern but on something that doesn't change between variants
• a regular-expression-like pattern
• a combination of byte patterns and metadata about the executable
• features extracted from emulating the malware, like packers, loading patterns and behavior

This smarter signature is slower than the simple byte pattern but when there are a lot of variant signatures, the overall performance will favor the smart signature. When the performance is better with the smart signature, the simple signatures will receive a lower priority or will be deleted. Some AV engines will output the detection with multiple signatures, not just stop at the first detection.

Periodical re-scanning of the entire collection of malware is performed to check if some changes in the AV have lead to malware not being detected or false positives have appeared from smart signatures.

Detection for a piece of malware is never removed from a mainstream AV.

Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.

Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific detection. So variants start trickling in: Malw.1, Malw.B, Malw.X.32768, ... . The AV company then starts seeing a pattern and produces a smarter signature that finds a common factor and detects all of the variants.

This smarter signature might be:

• the same classical byte pattern but on something that doesn't change between variants
• a regular-expression-like pattern
• a combination of byte patterns and metadata about the executable
• features extracted from emulating the malware, like packers, loading patterns and behavior

This smarter signature is slower than the simple byte pattern but when there are a lot of variant signatures, the overall performance will favor the smart signature. When the performance is better with the smart signature, the simple signatures will receive a lower priority or will be deleted. Some AV engines will output the detection with multiple signatures, not just stop at the first detection.

Periodical re-scanning of the entire collection of malware is performed to check if some changes in the AV have lead to malware not being detected or false positives have been introduced by smart signatures.

Detection for a piece of malware is never removed from an AV but certain signatures are replaced by a more generic signature for performance reasons. The name by which the malware was detected is lost in this process. Periodical rescanning of the entire collection of malware is performed to check if some changes in the AV have lead to malware not being detected.

Detection for a piece of malware is never removed from a mainstream AV.

Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.

Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific detection. So variants start trickling in: Malw.1, Malw.B, Malw.X.32768, ... . The AV company then starts seeing a pattern and produces a smarter signature that finds a common factor and detects all of the variants.

This smarter signature might be:

• the same classical byte pattern but on something that doesn't change between variants
• a regular-expression-like pattern
• a combination of byte patterns and metadata about the executable
• features extracted from emulating the malware, like packers, loading patterns and behavior

This smarter signature is slower than the simple byte pattern but when there are a lot of variant signatures, the overall performance will favor the smart signature. When the performance is better with the smart signature, the simple signatures will receive a lower priority or will be deleted. Some AV engines will output the detection with multiple signatures, not just stop at the first detection.

Periodical re-scanning of the entire collection of malware is performed to check if some changes in the AV have lead to malware not being detected or false positives have appeared from smart signatures.