DAILY DAT FAQ Frequently Asked Questions on the Release of Daily DATs Why is AVERT now releasing Daily DAT files? In 2004, we had an unprecedented rise in the number, propagation rate and prevalence of new malware.Through the year, AVERT saw a ten-fold increase in the number of virus submissions (from both virus-generated and from actual customers), a 250% increase in the rate of new malware development, and a 75+% increase in the number of emergency DAT releases.25 or more new Gaobot/Spybot/SDBot variants were received each DAY in 2004.In addition the growing amount of adware and Spyware require more consistent and available detection and removal. AVERT believes that the current schedule of weekly and emergency DAT releases are becoming less effective in providing adequate protection for our customers. At the same time, customer acceptance of the beta hourly DATs has been lower than expected, largely due to legitimate concerns over versioning and the level of testing they receive.In an effort to protect our customers in a less-risky, more-predictable way, we feel that releasing a fully-tested DAT file on a daily basis is the most cost-effective solution for both McAfee and our customers. This will have additional benefits such as the following: Approximately 40% of the outbreaks in 2004 would not have required a new DAT release if we had been on a daily release cycle We will be able to provide much faster turnaround time on performance problems and minor incorrect identifications than was possible in a weekly cycle What is the difference between the current weekly DAT files and the new daily DAT files? There is no difference in the detections, packages, download locations or testing between the current fully-QAd “weekly” DATs and these fully-QAd daily DATs.All products that can use the currently-released DATs can use daily DATs with no changes whatsoever. Does "daily DATs" mean one release every day? Yes and No. AVERT is planning to release at least one DAT file per day, Monday-through-Friday, including holidays, except December 25th and January 1st (or the nearest weekday). We will NOT release on Saturday or Sunday unless an outbreak scenario occurs where we assess the risk to a threat to be medium or higher. Will you still be releasing weekly DAT files? With Daily DAT files there is no need for a specific Weekly DAT file. If you will not be adopting the Daily DAT files for your environment, you may continue to update every Wednesday as you do now. Currently for the Weekly DAT Files, 15 incremental DAT files are created with each released, will this be changing? At this point there is no plan to change how many incremental files are made available with each DAT release. What is the difference between the new Daily DATs and the Beta DATs (formerly also known as “daily DATs”)? The new fully-QAd daily DATs will be released once per day, and go through a full QA cycle.The Beta DATs have been produced hourly for several months now, and receive only limited false positive testing.AVERT continues to recommend the released DATs for desktop deployment, and the Beta DATs for high-risk machines, as well as our perimeter products, such as GroupShield and WebShield. Do I have to change anything to take advantage of Daily DATs? The only changes required would be to modify the configuration of your product to update on a daily basis instead of weekly.Products currently configured to update on a daily basis need no changes to continue updating daily. At what time during the day will the Daily DATs be made available? We expect the Daily Dats to ship at approximately 6pm GMT every day, but may be released earlier or later in the day if a new threat warrants this. Do I have to take Daily DATs? No, though you may have to reduce the frequency of update checks to avoid picking up additional DATs, depending on the product involved. I use ePO in my environment, what kind of impact will Daily DAT files have on that as far as the repository and reporting? As there are varied implementations of ePO and varied environments that ePO is installed in, please contact your Support representative who can work with you to get the right answer for your environment. Will emergency DAT releases still happen, and under what circumstances? Naturally, outbreaks will still occur at awkward times and require emergency releases.We expect daily releases to ship at approximately the same time every day (about 6 PM GMT), but may be released earlier or later in the day if a new threat warrants this. When a daily DAT is released early, to pre-empt a potential outbreak, there will be no second DAT release that day at the normally scheduled time, unless another emergency situation warrants one. Will extra.dat files still be available? Yes, extra.dat files will still be available from AVERT.Extra.dat files will still be made available for download for threats that reach a Medium risk assessment or higher.Additionally, you will still receive extra.dat files for any new samples submitted to AVERT. When will Daily DAT releases start? Daily DAT release will commence on February 24th, the Thursday following the last weekly DAT release on February 23rd. Where can I send feedback about the Daily DATs If you have questions or concerns about Daily DATs, please email daily_dat@avertlabs.com . If your question is how Daily DATs will impact a specific product or environment, please contact your Support representative. |