A cool new program

Rod · **Joined:** May 16, 2010 **Posts:** 16169

Probably should put this in other graphic programs area, but it is art sooo =)
Sadly it is only available for windows right now.I tried to find another version but couldn't.Sorry guys. =\

The image was created in Gimp, but the reflection was made with this FREE software program.
Squirls website: (try the other freebies also)
http://www.xiberpix.net/SqirlzReflect.html

Software download site:
http://www.tucows.com/preview/382027

PhotoComix · **Joined:** Apr 12, 2010 **Posts:** 5870

nice image and cool sw

Demen · **Joined:** Aug 31, 2010 **Posts:** 93

Cool effect.

molly · **Joined:** Apr 07, 2010 **Posts:** 14182

Wow Rod, what a find. I just downloaded it and tried it. It is great.......

lylejk · **Joined:** Sep 24, 2010 **Posts:** 12840

Definitely looks cool. Thanks for sharing Rod.

PhotoMaster · **Posted:** Mon Oct 11, 2010 1:23 pm **(#6)**

I had to try it and it is awesome. I will recommend, however, that you load the gif into gimp and optimize and resave it. My test image from the program was 7.7Mb and after optimizing it in Gimp it was 3.3Mb and that was without rescaling it!

This is a resized image for less than 2Mb.

Rod · **Joined:** May 16, 2010 **Posts:** 16169

Yeah i agree PhotoMaster, mine was around 1.6 mb.
Did you try the morph program yet? That's free also. =)

PhotoComix · **Joined:** Apr 12, 2010 **Posts:** 5870

and the other works for 30 days (or 30 times..not sure )...

Rod · **Joined:** May 16, 2010 **Posts:** 16169

Yeah there is one called just "Squirls". I think that is shareware.
I think it probably does everything that the freeware does all in one program.
Except the perspective tool is also added to the program.

Demen · **Joined:** Aug 31, 2010 **Posts:** 93

Virus.
http://www.virustotal.com/file-scan/rep ... 1286174313

PhotoComix · **Joined:** Apr 12, 2010 **Posts:** 5870

maybe on virustotal are a bit paranoid ? it seems they detect virus everywhere

PhotoComix · **Joined:** Apr 12, 2010 **Posts:** 5870

virustotal obviously give a LOT of false positive:
that for the method they use,they scan the files with ALL possible antivirus (almost 40 )

so the chance of false positive that each antivirus has, should be multiplicated 40 times

I don't blame the service is good just the result must be read in a different way :

on 40 test done
37 found the file clean
3 detect something suspicious

so is almost sure that the file is clean

Rod · **Joined:** May 16, 2010 **Posts:** 16169

yeah 1 out of 40 tells me this is some great clean free software. =)

Demen · **Joined:** Aug 31, 2010 **Posts:** 93

I use VirusTotal to scan almost everything I download. It only ever finds things in (maybe) 15% of things I check. If you're finding viruses so frequently that you can say that, I think you need to consider revising your Internet download policies.

Also, no anti-virus finds everything. None. So just because a few scanners picked up something that the others didn't does not mean it's necessarily a false positive. I'd rather not download that file then take the chance it's a deadly-yet-uncommon trojan horse that steals my credit card numbers and deletes my C: drive.

One more "also":
Also, it's not being paranoid when I want to check to make sure that the random file I download from some unknown server in some unknown country, written by some unknown coder on some unknown date is clean. It's called being safe. There are viruses out there that can wipe your computer, download other viruses, record -everything- you do on your computer, and turn your machine into a digital zombie that can be used in DDOS attacks against corporate and government mainframes. I'd rather make sure that some GIF animator I find on an obscure site doesn't royally screw me over before I install it. Just saying.

Be safe friends, or you -will- be sorry.

PhotoMaster · **Posted:** Tue Oct 12, 2010 6:06 pm **(#15)**

I am glad I got rid of Norton's on my machine! It deleted Gimp saying it was a virus. Then it wouldn't let me re-download it. It also pegged Greycstoration and Open Office as viruses. Until I replaced it, I was Gimpless and Officeless. False positives run rampant!

If only 15% of your attempted downloads are testing positive, it probably isn't scanning your downloads at all, since the IT pros I know say that site shows false positives at a 60+ percentage rate. (the statement of it not scanning came from 2 IT pro's I asked about it)

Demen · **Joined:** Aug 31, 2010 **Posts:** 93

No, it's scans them. It only skips scanning if someone else has already scanned that file, but you can reupload and rescan at any time.

But a 60% false positive rate? That's amazing. How did they calculate that? Did they count the results from every scanner separately, or all of them in bulk? I'd guess 30% at most for false positives, so that's just, wow.

Of course it all depends on what files they used. If they purposely used files that knowingly got lots of false positives, then that would falsely inflate the false positive ratio. Did they use random files? And when was this? Most antivirus programs fix false positives as they find them. I wouldn't be surprised if they rescanned those same test files and got a much lower false positive rate.

I guess what I'm saying is: That's a very high error rate. While I suppose it's possible, I'd like some kind of citation or report on what they did and how they did it. I'm not saying you're wrong; I just wanna know more about this.

60%
...wow, that's high.

Well, anyway, I'd rather not use a program based on a false positive then install a trojan horse because I didn't know it was infected. Why take a chance?

PhotoMaster · **Posted:** Tue Oct 12, 2010 6:40 pm **(#17)**

The VirusTotal site also recommends against using it to test files as you are doing. Here is their quote.

VirusTotal Website wrote:

Why using VirusTotal for antivirus testing is a bad idea?
Hispasec is rather tired of repeating that VirusTotal was not designed as a tool to perform AV comparative analyses, but as a tool that checks suspicious samples with several AV programs and helps AV labs by forwarding them the malware they failed to detect. Those who use VirusTotal to perform AV comparative analyses should know that they are making many implicit errors in the methodology, the most obvious being:

•VirusTotal AV engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioral analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc.
•In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups.
These are just two examples illustrating why using VirusTotal for antivirus testing is a bad idea, you can read more about this issue in our blog. The Prevx team also made an entry in its blog discussing the matter.

Demen · **Joined:** Aug 31, 2010 **Posts:** 93

Okay, so you peaked my curiosity. I found the original blog post here ( http://blog.hispasec.com/virustotal/22 ).

One thing jumps out at me. They keep repeating that VirusTotal is not for "AV comparative analyses". I wasn't entirely sure what they mean by this, but judging from the context of the article, it seems to me that they aren't saying you shouldn't use VirusTotal to scan suspicious files. If fact, it appears that they admit VirusTotal is indeed to be used for scanning files in the way I do. I use it as a "tool that checks suspicious samples with several AV programs". ( http://www.virustotal.com/about.html )
No random file off the Internet shouldn't be trusted unless you have a good reason; thus it is, by default, to be looked at with suspicion.

They even say so in your quote. "VirusTotal was not designed as a tool to perform AV comparative analyses, but as a tool that checks suspicious samples with several AV programs". Again, I'm not using VirusTotal to compare the efficacy of various antivirus software, I'm using it to scan suspicious files that I find on the Internet.

Your quote from VirusTotal's "about" page links to the blog post where that quote was originally taken from (the first link in my post). That blog post is in response to another article. http://www.israel21c.org/technology/isr ... on-private
If you read it, it's clear that no one is talking about simply scanning files for viruses, but rather about using VirusTotal as a comparative agent to determine which antivirus is 'best'. I feel this is further evidenced by the fact that they constantly use the phrase "AV comparative analyses".

If you read the Prevx blog entry, they say "Where I totally disagree, is the use of VirusTotal online scanner as the primary tool to check effectiveness of antivirus solutions. VirusTotal is a great and useful service and it can give users some statistics about detection rates, it can't be used as the tool that allow testers to write comparatives and judge antivirus's effectiveness."

Another thing to notice is that in the Prevx blog, they say "This is because many new heuristic techniques that we use can't be included inside the on-demand scanner, which will simply check if the plain file signature is present inside the community database. ".
And in your quote there is "VirusTotal AV engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioral analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc.".
This obviously means that some scanners use things like firewalls, user habits, etc. to help detect and protect from viruses. It means that some of the antivirus engines used in the VirusTotal service may not work as good as they do when normally installed on a user's computer because they are only checking for the virus's signature, nothing else. Why you brought this up, I don't know.

So it's clear. An article was made in which it was claimed that some company's antivirus was better because it found an infection where no others did (by using VirusTotal). They make a blog post about it that gets quoted on VirusTotal's website.

VirusTotal allows you to scan a file or archive with multiple scanners. But everyone involved is saying that you shouldn't use the scanner results to compare the antivirus software themselves.

But none of this has anything to do with my original post.

I scanned the file with VirusTotal and they reported an infection. Being concerned about everyone's privacy and computers' health, I tried to inform you all. End of story.

PhotoMaster · **Posted:** Wed Oct 13, 2010 4:30 pm **(#19)**

I appreciate the information and understand your side of the issue.

It's just that the biggest problem with antivirus programs in general, that occurs more than missed infections, is false positives. Antivirus software companies (I used to work with one) will knowingly allow for false positives. The reason is that, the "crackers" (the bad hackers) will write viruses using know good scan strings. This technique has a tendency to fool some AV scanners. In an effort to protect themselves from law suits, they will allow the software to flag files that they don't know about. There is no real liability, any more, in false positives and there is limitted liability in missed viruses.

My advice, if using this method, is to make note of the location of the supposedly infected file and inform the AV companies. Since it can take many months before some of the smaller companies fix their false positives, if at all, you'll wan't to recheck the file periodically.

I would also notify the company that wrote the file that is being marked as infected. A company that I had worked for, for years, had a problem with our software being tagged as infected, when it was not. Since the AV company was not addressing our concerns/complaints, and those of our customers, a lawsuit ensued and the AV company in question doesn't exist anymore (for several reasons). In addition, new legislation limits an AV companies liability, when informed of false positives. I think there should be more liability on false positives, as it can hurt software authors.

All I am saying is that the cited site, is not even close to 100%. There is a significant issue with false positives and unless threatened to fix it, most won't address the issue.

I can't give more information than this for legal reasons.

Demen · **Joined:** Aug 31, 2010 **Posts:** 93

Which brings us back to what I said earlier: I would rather miss out on a program that was falsely flagged as infected then take the chance it just an uncommon trojan that's not in every antivirus database. I say this because all it takes is accidentally installing a virus for your entire digital world to be sold to the highest bidder, destroyed, or both.