The article as written seems to assume a working knowledge of malware practices and definitions, so the impact of this may not be clear to everyone.

The “no distribute” scanners are not tools that ordinary folks would use to see if a suspicious file is safe.  They’re meant to be used by malware authors to scan their latest “creations” to make sure that they are not detectable, so that there will be some time that their malware flies under the radar before any of the anti-malware programs are able to detect it.

The vendors of anti-malware software have an agreement that any malware that is known to one will be distributed to all, so there is no such thing as hoarding samples that only any one malware scanner can find (because its author never told anyone else about the sample).  If you submit a sample to McAfee, and they verify that it is malware, they will send it to the other antimalware companies too.

Multi-scanners like VirusTotal don’t use just one anti-malware engine to scan a sample… they use lots of them.  As the article mentioned, if any one of the many engines it uses detects malware in a sample, it sends that sample to the authors of all the other scanners too.  Note that this does not automatically mean that a given file contains new malware.  It could be a false positive, which would soon be evident to the authors of the erroneous scanner when all the other antimalware engine authors can’t find any malware in the sample.

It could also be a piece of malware that all of the other scanners are supposed to be able to detect, but for some reason, not all of them did.  By receiving the sample that was able to fool their scanner, the authors of the ones that did not detect the known malware can figure out what went wrong.

Of course, it could be that it is, in fact, a new malware, in which case all of the antimalware engines would be updated very soon to reflect the new malware.

Obviously, multiscanning engines would be of great value to the bad guys as well as the good.  They want to be certain their malware is not detected by any of the scanning engines.  But they can’t risk submitting it to a legit one like VirusTotal; if it is detected as bad, they’ve just shot themselves in the foot, ensuring that every other malware scanner out there knows about it.

As such, some of the bad guys make their own version of VirusTotal that doesn’t report the detection to all the other scanner authors.  The one scanner that detected malware thinks this is just a regular malware detection; they happen all the time.  They have no way of knowing that the other scanners didn’t catch it, or that this particular sample is somehow different from any other garden-variety malware that every scanner can detect.

The other scanners, which got the sample with the malware in it but didn’t detect anything, don’t have any reason to pay any special attention to that one file.  It’s got malware inside, but they don’t know that.  It already passed their scan, so to them it looks like any one of the millions of “safe” files they are asked to scan every day.  They can’t possibly study every one of them in detail to see if they really are malware… that is time and labor intensive, and even the biggest antimalware companies in the world don’t have the resources to do that with every file they scan.

Thus, this article is interesting, but it doesn’t really tell us anything we didn’t already know.  75% of the malware submitted to the no-distribute scanners is unknown malware.  Sounds scary, but consider the target audience of the no-distribute scanners: malware authors, and for the purpose of testing new malware to make sure it’s (un)safe.  One in four of these new malwares ends up being flagged as malware even though it’s new, which may mean that some code that was reused from a previous version of malware (they don’t rewrite from scratch every time; other than the fact that they’re the bad guys, it’s just like legitimate software development in many ways) was the basis of the “signature” used by the virus scanner that caught it.  For the malware author, it means he needs to make some changes and try again.