The old Virustotal had a file size limit of 20 Megabyte which worked fine for most executables and setups, but not for all. If you encountered a single file that exceeded the 20 Megabyte limit, you could not use the service to scan it at all. The service had other issues that users encountered every now and then, like large queues or pages that were not loading properly.

The developers have recently updated the service website and virus scanning service that improves Virustotal considerably.

When you open the service’s homepage you will notice two of the changes right away.

The first is a new professional feel and look, the second that Virustotal now accepts file sizes of up to 32 Megabytes. That’s a reasonable 60% increase that should resolve the majority of “file size to big” issues that users encountered previously on the site.

Once you upload a file you will notice that the reporting interface has changed as well.

The url scanner is now supporting a total of 19 different scan engines that includes a mix of well known (Google Safebrowsing, Opera, Phishtank) and lesser known services. Some url scanning services provide additional information that are now also displayed in the scan results.

Virustotal has moved to Google’s App Engine Service which, according to the developers, speeds up the analysis significantly. Developers of third party apps now benefit from faster response times thanks to a public API update.

Virustotal has improved significantly thanks to the recent update. Especially the maximum file size increase needs to be mentioned in this regard.

Have you used the new version yet? If so, what is your impression of the service? (via Dottech)

X-Ray, a new portable software by our blog partner Raymond.cc, is a security software for the Windows operating system that combines Virus Total scanning with options to submit files to antivirus companies for manual inspection.

The program asks you to drop one or multiple files into the program interface. You can then start the analysis right away by clicking on Get Recent VirusTotal Report or Send to VirusTotal.

The first computes the hash and submits it to VirusTotal to retrieve previous analysis results (if available). The second sends the file to VirusTotal to run the analysis. The first is faster but results may come up blank if no one submitted the program for analysis before.

Program alternatives are available to submit files to Virustotal. This includes the official Virus Total Uploader among others. Most however do not support retrieving previous reports from the service.

What sets X-Ray apart however is the option to submit suspicious files to antivirus companies for manual review. Before you can use the functionality, you need to setup your email correctly in the program.

The program requires you to enter an email server, port, and username and password. A test button is available to test the settings.

You can configure the preferred submission method for some companies. Available for selection are by email or web form, both of which are processed automatically.

Once you have setup the email provider you can start sending files for analysis. A click on the button in the main interface submits the current file to all companies. Some companies may display captchas as part of the submission process, but that’s the only thing you have to enter before the file is submitted.

The response time depends on may factors, it can take a day, a week or even longer than that. Some companies may not respond at all. But since you are submitting the file to a lot of different antivirus companies, chance is good that you will receive timely responses from some.

X-Ray’s unique approach makes it a must have for Windows users who need to make sure that a file is clean before they run it on their system. And since it is portable, it can be added easily to a troubleshooting tools DVD or USB drive.

Windows users can download the latest version of X-Ray from Raymond’s website.

When you review as much software as I do, you are grateful for every additional tool that you can utilize to make sure a software can be recommended on your site. Nothing’s worse for your site’s reputation than recommending a program that turns out to be malicious in nature. This fortunately has never happened on Ghacks yet.

Threat Expert is one of those services that helps you analyze files. You can use an online form to submit files directly on the website, or download an applet for your Windows operating system to send files directly from your desktop to the service’s server.

You need to add an email address if you use the local application to send a file to Threat Expert, as it may take some time to scan the file. The email contains the link to the report on the website. Scans during tests did not take longer than five minutes to complete. The online submission did not work at all during tests, only the submission applet worked as advertised.

The report displays many useful information, including technical details about files that were created on a system (if the file is an installer), directories that were created, Registry modifications and attempts to connect toremote hosts. Take a look at this sample report for pointers.

A click on a particular file name listed in a report displays additional information about the file. You see the number of cases where the file was analyzed in reports, and the number of incidents when this file was found to be a threat.

You can browse and search all previously generated reports on the site, which may be helpful if you want to quickly look up a file name.

Probably the biggest limitation of the service is the file size limitation. You cannot upload files larger than 5 Megabytes which means that some files cannot be scanned at all.

The ability to display local and remote activities is on the other hand the most valuable feature of the service.

Threat Expert is a handy service that works well in combination with other online scanning services such as Virus Total or No Virus Thanks.

TCPEye basically displays those information in a graphical user interface. The application displays all processes that currently have a connection to a remote address. A remote address can be a device on the same computer network, or the Internet.

Each process is listed with its name, local and remote address, connection state, protocol, remote address country, process path and a handful of additional information about the program and company.

The displayed information can be saved or copied (to the clipboard) at anytime. A right-click on an entry, or the selection of the options menu at the top, lead to additional features. Available options include sending a process directly to the online virus checking service Virus Total, resolving addresses, terminating connections or processes, and the built-in Whois IP and Geo IP tools.

The direct upload option to Virus Total can be used to check any running process for malicious code. The file gets uploaded automatically by the application, providing that it is less than 10 Megabytes in size. The results of the scan are opened directly in the default web browser.

TCPEye is a handy netstat frontend that offers enough extra features to make it more than just an alternative. The application can be downloaded from Cnet.

Jotti is an online malware scanning service that is not as popular as Virustotal even though it is comparable in many aspects. Jotti uses 19 different malware engines to scan a file that gets uploaded to the service. All it takes is to open the website, select a file from the local system and click the submit file button to initiate the transfer.

Jottiq now is a free software that has been created as part of Donation Coder’s NANY 2011 challenge. The application acts as a frontend for Jotti, making the selection process and overall experience of the user more comfortable.

The portable software can upload one or multiple files to Jotti for testing. Results are directly displayed in the application interface which means that it is not necessary to visit the website at all.

Files are added by drag and drop to the queue. They are automatically processed locally and compared to existing results. If they exist the upload is canceled and results are displayed directly. If the file does not exist in the database it is uploaded and processed as usual.

The program options offer some interesting feature additions. It is for instance possible to add Jottiq to the Windows Explorer context menu to improve the file selection process.

JottiQ is a handy software to scan files for malicious contents online. The two outstanding features are the ability to process a queue of files and the display of results directly in the program interface. No other software of its kind offers these options at the moment.

JottiQ can be downloaded from the Donation Coder website.

IObit Cloud is a new service by IObit that users can utilize to scan files for malicious code. The process itself is straightforward. It begins by selecting the file from the local hard drive. The service does not mention file size limitations but it seems to be that only files up to 20 Megabytes can be uploaded.

The online antivirus scanner loads the file and beings to analyse it. The load on the server has been relatively low in the time of testing. All file scans started immediately which could change in the future.

A report is generated in the end that contains a threat assessment, basic file information that include hashes, information about Registry changes and a report link.

IObit Cloud is a new service that the developers need to improve. What’s missing? Frequently asked questions or usage instructions for information like file size or type limitations for instance, or a privacy policy so that users know how the files are handled by the service.

IObit Cloud is an alternative to other online antivirus file checkers, especially those that utilize only one antivirus engine as well.

The better option for most users is a multi-engine service such as Virustotal which offers a safer assessment of a file’s threat potention.

Hitman Pro is making use of eight spyware scanning engines. It’s a mixture of free and trial versions. Among the software programs are popular spyware cleaners like Spybot Search and Destroy, Ad-aware and Webroot Spysweeper. Each application can be selected to be included in the system scan or excluded from it. Besides those eight engines can include the commercial antivirus applications TrendMicro Sysclean and McAfee Virusscan if the user has a license for those applications.

The options contain several additional interesting features that require some explanation. The user can select to use the Browser security plugins that is offered by some of the anti-spyware applications, install security updates and configure least user access levels for his web browser.

The first run takes a bit longer than the future ones because all selected applications will be downloaded from the Internet. Hitman Pro is installing the automatically on the user system with minimal to no user input required. Once the applications have been downloaded the system scan begins. Each application is run after the other and the results are visible in the application itself and in Hitman Pro at the end.

This process can slow down the computer quite a bit and it is probably a good idea to let the scans run automatically and do something different in the meantime. One aspect that is not optimal is the fact that most of these anti-spyware tools run a permanent process even if the main application is not running.

This can create quite some noise in the background and experienced users might prefer to install and uninstall the applications manually instead. The idea itself is great however and it would have been really nice if Hitman would be able to use the scanning engines and definitions without having to install the software programs itself. That’s probably wishful thinking though.