Interview with Jan Valky & Lubos Vrtik
Interviewed by foxz/Januari'98

Well Jan Valky and Lubos Vrtik is the first AV guys that Interviewed by NoMercy, Thanks for your replay guy:)

Introduce exactly who are Ya!, Ur job, hobbies, sex, friend etc..etc..etc

Jan: I am 18 year old. I'm still student. After graduation in may I'm going to university. My hobbies are similar to hobbies of other boys of my age. I like to get an opportunity to work for few weeks abroad for some top AV company or I want to be invited for station.

Lubos: I am very old and tired :). I'm working for nuclear power plant research institute for 10 years. I'm very busy all the time.

How long Ya Start in AV, and tell Us the story behind

It happened about eight year ago, when Vrtik met person who was developing an AV program called NOD. About one year later Vrtik started to work for company which one of company owner was mentioned person. Contacts to NOD developers make Vrtik to be interested in AV stuff. In year 1994 was the beginning of developing of new generation of NOD AV. In that time we both started to cooperate on NOD. At first our work was to do simple analysis and mainly we were concentrated in virus detection with help of special tools.

When come the idea to make HMVS?

In 1996. When first macro viruses appeared it took a long time to collect a reasonable number of samples. Companies without good collection of macro viruses weren't able to stand in competition with a good result. That time NOD-iCE developers had a huge experience with heuristic and neural methods of virus detection. There was only one way how to eliminate the lack of macro viruses and low hit-rate on a big macro virus collections - to make a heuristic detection. The idea to do heuristics for macro viruses was initiated by NOD-iCE developers, but they hadn't enough time and experiences with macro viruses to do it. So we decided to do it. When we realized how macros are stored in file and understood meaning of tokens we managed to do heuristics. It took months to understand complex structure of OLE2 format and find out the way to scan and clean macro viruses. In fact whole analysis of file format was done without any documenation and was done in shorter time and with less people than in other AV companies with support of Microsoft. Don't forget that we work on HMVS like on our hobby and it is not our full time job.

We are sure that Jan is maybe the best analyst and programmer concerning macro viruses with enormous knowledges of OLE2 format, OLE2 scanning/cleaning and finally is the only one expert for neural networks on macro viruses. Every AV company would like to have such innovative programmer. He himself is able to do work that there are teams of programmers in others companies working on. So AV companies don't waste time and money with uneffective programmers and ask contact Jan for job or station.

Why Ya don't have HomePage like Other?, why only available ftp?? bcoz we to lazy to find Ur HomePage :)

We haven't our WWW page because there is not enough time to create and maintain it. Besides we couldn't imagine what we have to put there.

Where did Ya get the viruses for Ur HMVS? (are Ya member of CARO??)

Almost all viruses we have in collection we download from free internet sources. And some viruses we got from our suppliers or our users. We aren't members of CARO. We weren't invited.

Tell Us description of the best AV

The best AV should have the following features:

- 100% hit rate ItW

- excellent code emulator

- very good heuristic analyser

- brilliant cleaning capabilities

- almost no false alarms

At least AVP and Dr. Solomon belong to the best. We prefer AVP.

How Ya named the viruses?? Are Ya use CARO system or what??

In fact we try to follow F-MACRO/W like naming, but there are some exceptions. We don't care of CARO system.

How Ur view about F-WIN, AVP, F-MACROW, SCAN (All MacroScanner)? who the best and who the Lame! what Ur reason?

Probably F-MACROW has the best hit-rate. Perforin has been very good too, but my full version expired and they didn't send me newest ;( We use NOD-iCE, AVP, F-MACROW, Dr. WEB and HMVS of course.

Are Ya think Ur HMVS one of the best MacroScanner?? reason please?

No, we don't think so. If we had bigger macro virus collection it would be one of the absolutely top macro scanners. But we believe that HMVS is one of the best available macro virus toolkit dedicated for experienced user. Besides there are some features which you can hardly find in other AV scanners:

- Word 97 heuristics (see HMVS ver 2.50 and later)

- ultimate Word 6, 7, Excel97 and Word97 dissector

- neural network driven scanner

so HMVS is the tools which allow you to discover any macro (viral or nonviral) and give you opportunity to inspect it or to remove it.

Why Ya decide to join in AV community, we look Ur HMVS was 'Armored' so why Ya don't join to Packer community like Ur friend Rose, P Warezak?

We have good cooperation with NOD developers so we are joined to AV community. We are enough competent to make a good packer, but there is no time for it. We don't like to be in competition with Warezak - he is our very good friend.

How many new virus(es) Ya analize per day?

Almost any incoming macro viruses are still very trivial so analysis of such a virus don't take more that 2-3 minutes. There is only very few number of viruses which we need to pay more attention. For the moment all macro viruses are analysed in day (or day before) of HMVS release. We have special tools to do analysis and detection for *ANY* virus (not only macro virus) and we are able to handle hundreds of macro viruses a day.

Talk about shit, what Ur comment about my Volcano.Shit?? Tell Us! :P

Author of this "virus" was big amateur and had minimal knowledge about tokenization. Only lamer thinks that italian wordbasic statements will be translated under english word to tokens. Volcano.A isn't virus (like many other it can't replicate) but also other AV scanners reports it as a virus (intended - it means that would never work) because they don't want to be penalized in AV scanner tests.

<~> Truely I sad to hear this :) but "I was learn from you thank's Vrtik!"

On HMVS 2x Ya use new Tech (NeuralNetWork) tell Us how it work?? and are Ya challange VX to make an AntiNeural?? (sound kindy Kewl) :P

Neural network used in HMVS evaluate a number of characteristics gathered from each macro virus. As we know HMVS is the only one antivirus using neural network for macro viruses detection. Techique of neural networks is known for many years and at least NOD-iCE antivirus used it for computing of weight coefficients of heuristic flags few years ago. Good programmed neural network teached on sufficient big collection of viral but also clean files too leads to very good results. We thaught our network on about 1800 different viruses and 200 legitimate macros so it is able to decide which macro isn't virus, so it is used to eliminate false positive alarms caused by heuristics (/HLO parameter). At the moment our neural network doesn't have enough information about legitimated macros so it may lead to uncertain results. AntiNeural? It is impossible to write antineural macro virus because well thaught neural network is able to hit such virus (if such a virus was handled in the process of teaching)

We had intention to do it but we gave up. Use NOD-iCE for Windows instead !

About Virus(es) Generator, what Ur view about 'em

It is dangerous weapon. Mostly polymorphic macro viruses generated by such a generator may cause troubles for all scanners. Well written macro viruses as well as macro virus generators are engine of consecutive AV scanners improvement.

About competition between VX and AV any comment?

In our opinion VX make AV to be better :) And vice versa. It is never ending battle.

We (VX) spread Our knowledge to other (by make E-Zine), did AV do the same thing?, where we can get that E-Zine??

We hadn't seen any AV zine yet, but there is a lot of AV magazines.

In Our Opinion the 'real' war is AV vs AV, what do Ya think?

We don't have any attitude to this. Try to ask known AV companies.

What Ur view about Word97 (VBA Viruses)?

VBA viruses spreads more difficult than WordBasic viruses because there is a joke called virus protection :). From the AV point of view format of Word97 and Excel97 files is more complicated than Word6 files. In most cases exact identification of VBA viruses is not possible.

Okay Vrtik this is Good for Ur HMVS, where exactly the Newest HVMS can download? and where Ya can reach out?

The newest version of HMVS you can download from SAC FTP or WEB server and all SAC's mirrors. It is also available on ftp.cdrom.com You can reach us by mail, phone or fax.

The Last is Ur, Just write what Ya want no space limit!

Don't miss the windows version of NOD-iCE antivirus, it will be available in february. Dos version of the world best heuristic scanner NOD-iCE is available on SAC FTP.

Jan Valky and Lubos Vrtik