Different anti-malware engines add detection for threats at different times, and it's impossible to tell which engine will be the first to detect the next significant threat. Take for example two of the most publicized complex threats from the past few years: Stuxnetwas first detected by VirusBlokAda, whileKaspersky Lab was the first to detect Flame. After the initial detection, it can still take varying amounts of time before every engine detects a threat.
We looked at Metascan Online to see how early Flame was detected by various antivirus engines. Searching through the scanning results, we found two detections of Flame that provide an example of how multi-scanning leads to earlier detection than a single engine; more than 2 weeks after first detection, not every engine detects a given threat. (Click the images to see expanded results):
 |  | |
A file was uploaded to Metascan Online on June 7th. Nine of the 30 engines detected the Flame malware. Visit theresults page on Metascan Onlineto see additional details. | Two weeks later, 22 out of 30 engines on Metascan Online detected Flame in another uploaded file. Visit theresults page on Metascan Onlineto see additional details. |
