Slashdot Mirror

Have their been any improvements since the scathing November 2011 report [PDF] stating that mobile AV is next to useless?

I went to the AV-Test Web site at http://www.av-test.org/en/home/. First of all, there is indeed a Norman Security Suite at http://safeground.norman.com/us/home_and_small_office. AV-Test listed Norton under Symantec. Yes, AV-Test evaluated both Norton and Norman.

For home users of Windows XP, Microsoft's Security Essentials has a AV-Test certified seal with a test date in August 2012. For corporate users of Windows XP, Microsoft's Forefront Endpoint Protection has a AV-Test certified seal with a test date also in August 2012. Neither product has the certified seal for Windows 8. But then how many corporate users have actually adopted Windows 8?

Besides AV-Test, there is also ICSA Labs at https://www.icsalabs.com/. ICSA Labs also reports on Norman.

ICSA Labs certifies Microsoft Security Essentials for home users of Windows XP and Microsoft Forefront Endpoint Protection for Windows 7 without any dates indicated. Apparently, ICSA has not certified any anti-virus applications for Windows 8.

I use AVG 2013 Free, which is certified by AV-Test but has not been evaluated by ICSA Labs since 2005 (many versions ago). I also prefer to go to the original sources of information on software -- AV-Test and ICSA Labs in this case -- not to news reports often written by reporters who might not understand the subject.

AV-Test’s review looks at three key areas of security software, including protection, reparability, and usability of the whole computer based on the software’s impact. Across those three areas, Microsoft Security Essentials scored a 1.5 out of 6 on protection against viruses and worms, a 3.0 out of 6 on a reparability scale, and a 5.5 out of 6 on the usability scale, where “lower values indicate better results.” This is incorrect, higher values indicate better results, otherwise this article would be about how great MSE is at detecting viruses and worms, but how no one uses it because the usability is awful.

From the AV-TEST test results, it appears the issue with MSE doing poorly in this test is a poor score in protection against 0-day malware attacks (~70% vs an average of ~90% protected) and in detecting relatively newer malware "Detection of a representative set of malware discovered in the last 2-3 months" (~90% vs an average of ~97% detected). Although things like "representative sets" could potentially be used in a biased manner...

Well based on clicking the 31 producers on http://www.av-test.org/en/tests/home-user/
Reading the 2012/2013 results for Protection only:
BitDefender
F-Secure
Trend Micro
Get 6 out of 6.

I bullshit you not, there's a Norman: Security Suite Pro 9.0. I seriously doubt that's what they meant to type though, given the context.

Actually both Norman (it's real) and Norton passed. http://www.av-test.org/en/tests/home-user/windows-7/novdec-2012/

I've been recommending MSE for ages now as it seems to work fine for me. In a corporate environment, I have also long recommended the equivalent System Center Endpoint Protection (SCEP formerly Forefront Endpoint Protection). However, recent AV tests show that SCEP/FEP (and MSE which uses the same AV engine) are significantly worse than any of the competition.

Take a look at http://dennistechnologylabs.com/reports/s/a-m/2012/ which puts SCEP at the bottom of the heap (although Trend doesn't fare much better to be honest)

Then look at the slightly older comparison at http://www.av-test.org/en/tests/corporate-user/julaug-2012/ (FEP gets 2/6 for protection - lower than the next nearest - McAfee and Trend - both of which get 3.5/6

I'd recommend looking around to see what other anti-virus products there are. There are a few good review sites out there for antivirus:

http://www.av-test.org/en/tests/test-reports/
http://www.av-comparatives.org/en/comparativesreviews/summary-reports

BitDefender, Kasperskey, Norton, and F-Secure all seem to be putting out good products.

Another vote for Avira here.

You may wish to have a look at these sites to help you decide:

http://www.av-comparatives.org/

http://www.av-test.org/

A list here
Some Required Reading
The Wiki Entry with everything

Now Those are just some places to start, however:
if you look here you'll get an idea
Finding a good vendor independent list that does not use adjectives, you know something with metrics on how many viri in the database, how fast does is scan files? How much Memory does it take up? all of these are becoming more and more difficult to find. AV software is supposed to do one thing, scan files, match them to heuristics and if they match the sig, move it to a sandbox or blow it away. Security is an evolving battlefield, polymorphisms brought way to new methods of infection and a few worms bounced about, then heuristics got better, now they rely on stupidity of which there will always be an ample supply.

Mod parent down. The fine article about the test specifically states that only one of the solutions that tested 6/6 provided a large number of false positives, and flagged the infected files as such simply by deciding that all packed executables are suspect. The other, is actually commended for having a low false positives rate.

Not at all!

The test is actually quite useful, it's the article that's not.

If you look at the av test publication data you'll see all sorts of great information.

The information I find of particular interest is in the column that's sorted by response time, especially the programs that didn't proactively react such as: ClamAV, F-Secure, Sophos, McAfee, Symantec... ie all the big guys.

The interesting thing about this (and these are the guys that don't give so many false positives as you are right -- you definitely need to avoid this).

The interesting thing is that out of all the big guys, Symantec comes up basically last!

The difference between say 3 minutes, or even 45 minutes and Symantec's 3 hours is huge! Depending on the virus 3-5 minutes may be all it needs to propagate through an entire company's network. But some are much slower, taking several hours.

Either way, the lower the response time the better!

At first glance this looks like a clever variation on "important document attached" e-mails we all get every day...