14 DAY TRIAL // VirusTotal, the most popular online file scanner, has introduced new features, which include URL scanning, a public API, a community service, as well as a Firefox extension for checking Internet resources directly from the browser.
The submitted URLs are currently check against several services and blacklist including Google SafeBrowsing, Firefox, although it also uses Google's SafeBrowsing protocol, Opera, which makes use of malicious URL data from AVG, Phishtank, a community-maintained phishing site list, IE's Smartscreen filter and TRUSTe, a directory of trusted websites.
The service also normalizes the submitted URL, calculates its MD5 and determines its Content-Type. Users with a registered account in the new VT Community can also post comments and tag the resource as malicious, benign, spam, browser exploit, malware download or phishing site.
Hispasec Sistemas, the company running VirusTotal describes the new VT Community as "a space where the antivirus industry and malware researchers can meet end-users in an effort to make internet a safer place."
"VT Community allows you to rate and place comments on files and web sites. Comments can be of any nature: disinfection instructions, in-the-wild locations, reverse engineering reports, etc.," it explains.
A feature that has been requested for a long time, a public API (application programming interface), has also been made available for people who want to submit files or URLs, post comments or access reports without visiting the website.
Regular VT users might also be familiar with the "VT Uploader" program, which integrates in the Windows context menu and allows submitting files directly from the desktop.
The same principle has been applied to the browser environment, for which a VirusTotal Firefox extension called VTzilla is now available.
The add-on adds an option on the Firefox download prompt, allowing for files to be scanned on VT before being stored permanently on the hard disk.
A toolbar is also added, which can be used to scan for file names, MD5, SHA1, SHA256 hashes, URLs, reports, comment tags or VT Community usernames directly from the browser.
The new features are very valuable and needed additions to a service that's used by thousands of users daily and has already become part of every malware researcher's arsenal.
We hope that the URL scanning will have the same impact on the industry as the file scanner did, fueling sample exchange between antivirus vendors and decreasing their response times.
You can follow the editor on Twitter @lconstantin