Huge decrease in Intelli-Signatures [Archive]

View Full Version : Huge decrease in Intelli-Signatures

Jack Bauer

11-02-2007, 04:35 AM

Chippa

11-02-2007, 04:49 AM

You're currently using an older version of Spyware Doctor. A very old build :eek: See http://www.pctools.com/forum/showthread.php?t=49050. May want to upgrade :)

Sometimes there will be a decrease in the number of intelli-signatures - reason being - http://www.pctools.com/forum/showthread.php?t=49312

Cheers,
Chippa

Jack Bauer

11-02-2007, 04:54 AM

How can I be using an old version when my version is up to date. Correct me if I'm wrong but isn't 5.1.0.272 the newest version? Yep it is, so how is it old? Also I can understand a decrease in sigs when it's just 2 or 3000 but a difference of over 400,000! Something else must be wrong.

Also if you click here http://www.pctools.com/spyware-doctor/ and then click on the screenshot of spyware doctor it shows version 5.1.0.268 with just 180,430 sigs. I know that this is a slightly older version but it also doesn't show nearly as much sigs as version 5.0.1.201 which was over 600,000 like I've stated before.

Chippa

11-02-2007, 05:15 AM

My bad, sorry, i thought you were on build 201. Im going to run a test now and will post the results.

Chippa

11-02-2007, 05:50 AM

My SD GUI is displaying 627,165. Not really sure what is happening on your side.

AChen

11-02-2007, 05:54 AM

kentroup

11-02-2007, 06:47 AM

I recently upgraded Spyware Doctor to version 5.1.272 from my previous version of 5.0.1.201. My current database file is 5.08490e, which contains 182,027 Intelli-Signatures. When I had version 5.0.1.201 it had over 600,000 Intelli-Signatures!!! Why the decrease in this new version? Is it supposed to be like this?

Thanks in advance.

Version 5.0.1.205 was a radical turning point in the development of this program. Versions before this, when registered, had intellisignatures in excess of 600,000 and the program was easily cracked.
Versions after this had the intellisignature database split up into a 'spyware database' (around 180,000 signatures) and an 'antivirus database (the remaining signatures). The old registration methods (cracks and patches) only appear to work as they only keep alive the spyware side of the program (which will update whether it is registered or not). To update the antivirus database, a valid serial number must be used which is checked via the internet each time an update is requested by the program.
Too bad for us - but it makes sense commercially.

Jack Bauer

11-02-2007, 04:19 PM

Hi Jack and Chippa,

I have also just checked the Intelli-Signatures and it is displaying the correct amount as Chippa's Intelli-Signatures 627,165. When did you upgrade to the latest version of SD 5.1.0.272? Did you do this via Smart Update or an uninstall/reinstall of SD.

Please see PM.

I did an uninstall of the old version to an install of the new version. The new version was not available via smart update.

I probably should have also noted that I'm using the starter edition of SD, but I've used that in the past and it had the correct number of sigs, so why can't I see the same results here.

InvisibleMan

11-03-2007, 10:02 AM

My personal situation may or may not relate to yours.

Firstly, I am using an old PC that will only operate OK with SD4.1. But, when recently experimenting with a newer version of SD5, I performed a complete un-installation of SD4.1, followed by the installation of what was the latest version of SD5.

Everything ran OK during the first download and scan, of/using SD5. And, I noticed that there were approximately 200,000 (+/-) Intelli-Signatures with that initial (new) download/installation of SD5. Then, when I clicked on Smart Update...another approx. 400,000 Intelli-Signatures downloaded and installed on this 7-years-old (upgraded somewhat) PC. With a Motherboard that operates at only 800MHz, and only 384MB SD RAM, this PC slowed down to a standstill. So, I am content with SD4.1 for the time being.

The point is, however, the initial installation of SD5 gave me approx. 200,000 Intelli-Signatures, with a subsequent Smart Update bringing the (updated) total to over 600,000.

Again, my experience may or may not apply to your situation. Best wishes.

Gambit

11-05-2007, 03:10 AM

I did an uninstall of the old version to an install of the new version. The new version was not available via smart update.

I probably should have also noted that I'm using the starter edition of SD, but I've used that in the past and it had the correct number of sigs, so why can't I see the same results here.

This info changes everything ;) I just tested this by downloading the starter version of SD and it looks like only registered users can download the additional refdb upon smart updating. Once registered users download the normal sd and run a su, there is a file which is about 20megs to download, most likley linked to the extra 400,000 signatures. So all in all, invisibleman is correct :)

blec

11-05-2007, 01:21 PM

I am probably a bit late with this post but whenever I download a new version of SD5 it starts with database 5.08490e. Smart update restores the missing signatures.

AChen

11-06-2007, 12:54 AM

I am probably a bit late with this post but whenever I download a new version of SD5 it starts with database 5.08490e. Smart update restores the missing signatures.

This is correct. By downloading the trial version/starter pack of SD, users will receive the evaluation packed signatures. Only subscribers can download the remaining signature database via the Smart Updates.

Loz_Whale

11-06-2007, 02:55 AM

This is correct. By downloading the trial version/starter pack of SD, users will receive the evaluation packed signatures. Only subscribers can download the remaining signature database via the Smart Updates.

Anthony, I am currently using the starter pack version of SD with 182,249 signatures. Can you clarify what the extra signatures registered users receive via smart update, which I am not able to, are used for. Are these extra 400,000 approx signatures used for the anti-virus part of SD or are they used for spyware detection?

Thanks

AChen

11-06-2007, 03:37 AM

Anthony, I am currently using the starter pack version of SD with 182,249 signatures. Can you clarify what the extra signatures registered users receive via smart update, which I am not able to, are used for. Are these extra 400,000 approx signatures used for the anti-virus part of SD or are they used for spyware detection?

Thanks

Hi Loz_Whale,

The extra 400,000 signatures are part of the SD (malware) database and the AV database is separate to this.

Loz_Whale

11-06-2007, 01:53 PM

Hi Loz_Whale,

The extra 400,000 signatures are part of the SD (malware) database and the AV database is separate to this.

Thanks for clarifying that for me :-)

I think it might be to PC Tools benefit if they made it clear to people opting for the free version of SD via google that they are not receiving 100% of the signatures and thus, I assume, wont be able to detect/remove 100% of spyware on their PCs.

My understanding, before you clarification, was that the difference between the paid and free versions was that some on the on guard facilities were not available which didn't overly bother me but I assumed that any spyware that had slipped through would be picked up by my SD hard drive scans.

If my understanding is correct and that spyware may be going undetected on my PC, even after SD hard drive scans, I will seriously consider renewing my previous SD subscription. If you advertise this limitation I'm sure more customers would feel the same way.

AChen

11-08-2007, 04:06 AM

I have raised this issue and will get back to you shortly

Splinter hell

01-10-2008, 11:03 AM

Chippa

01-10-2008, 10:09 PM

I also use spyware doctor starter and I update my signatures using smart updater and I get some updated signatures but the smart updater won't receive the full 400,000 + database signatures.Am I correct.:rolleyes:

Thats correct :) To get the full database access, you'll need purchase a subscription for SD.

I like your avatar :)

jrandall1

03-03-2008, 03:14 AM

Hi Loz_Whale,

The extra 400,000 signatures are part of the SD (malware) database and the AV database is separate to this.

Then I agree with Loz_Whale that the text that describes the limitations of the Trial and Starter versions of SD and SDwAV should in all fairness clearly state that the Malware database is limited and thus the Starter Edition does not detect and clean 100% of malware on the user's computer and that the Trial version does not detect 100% of malware on the user's computer.

This brings up the BIG question -- What exactly has been left out, other than the obvious ~400K fewer malware signatures in the trial/starter editions :) What is the real importance of fewer signatures? What threats, classes of threats, type of threat, risk level of threats, etc., are trial/starter edition users missing? Are we really only 1/3 protected?

Thanks.

AChen

03-04-2008, 05:34 AM

Then I agree with Loz_Whale that the text that describes the limitations of the Trial and Starter versions of SD and SDwAV should in all fairness clearly state that the Malware database is limited and thus the Starter Edition does not detect and clean 100% of malware on the user's computer and that the Trial version does not detect 100% of malware on the user's computer.

This brings up the BIG question -- What exactly has been left out, other than the obvious ~400K fewer malware signatures in the trial/starter editions :) What is the real importance of fewer signatures? What threats, classes of threats, type of threat, risk level of threats, etc., are trial/starter edition users missing? Are we really only 1/3 protected?

Thanks.

There is no specific category of signatures that are excluded from trial users. Trial/Starter users get updated signatures that focus on currently active threats, while registered users get the full set of signatures that detect all threats known to us, some of which may be old threats, or rare threats. A full set of signatures is also important for certifications where they often use very old threats.

So the effectiveness is not a function of the signature count but rather varies by the types of threats a user may come across. We are currently doing some research into optimising this so that we do not have such a large signature count difference.

InvisibleMan

03-04-2008, 07:35 AM

Anthony,

Should I assume your explanation applies to the 226,+++ signatures in SD4.1, too? ...that those 226,+++ sigs are the currently most active ones?

(...for those of us who still use SD4.1 in our well-working older PCs that have related hardware limitations.)

AChen

03-06-2008, 05:21 AM

Yes, That is correct. The signature set for SDv4.1 is essentially the same as that in the trial of SDv5.
BUT remember that SDv5 has many more features and either has signatures that only SDv5 can use, or uses the same signatures more effectively. So even though you may see similar signature counts you will get better detection and removal with SD 5.

Henk1956

03-10-2008, 01:06 AM

There is no specific category of signatures that are excluded from trial users. Trial/Starter users get updated signatures that focus on currently active threats, while registered users get the full set of signatures that detect all threats known to us, some of which may be old threats, or rare threats. A full set of signatures is also important for certifications where they often use very old threats.

So the effectiveness is not a function of the signature count but rather varies by the types of threats a user may come across. We are currently doing some research into optimising this so that we do not have such a large signature count difference.

This made me wonder whether SD could be much faster (i.e. less resources required) if an option was available to scan for only the currently active threads. If so, why not provide this option in the payd version?

Petertron5000

03-10-2008, 04:22 AM

This made me wonder whether SD could be much faster (i.e. less resources required) if an option was available to scan for only the currently active threads. If so, why not provide this option in the payd version?

Any scan in generally will use more resources regardless of the signature database because its still got to check every location. SD also has and intelli-scan and a full scan option located in the start scan tab which you might be interested in.

Henk1956

03-10-2008, 10:54 PM

Don't quite agree.
Of course each location has to be checked, but there is a difference (in CPU time) whether each location has to be checked against 600000 signatures or only 200000. So, it could be beneficial for users which have an older CPU.
One reason I mention this is that at wilderssecurity forum the full SD version is generally consideres as bloated, while the starter pack seems to be more accepted.
So, why not provide the option for the on access scanner to use the 200000 signatures and use the 600000 signatures only for on demand deep scans?