Slashdot Mirror
Against Unknown Viruses, Avira AntiVir the Winner For Now
KingofGnG writes "AV-Comparatives, the Austrian team of experts dedicated to antivirus tests acknowledged as a reference point in the field, has published the second part of the mid-year comparative, an ideal addendum to the one already released last September. This time the aim is to evaluate the antimalware tools' effectiveness against unknown threats in a test scenario meant to prove the heuristic part and the generic markers of the on-demand scanning engines." The best in show (of 16 anti-malware packages evaluated), Avira AntiVir was able to find 71% of the unknown malware it was exposed to in the first week, dropping to 67% after the fourth.
My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...
What doesn't kill you only delays the inevitable
i've been using antivir for the past 2 years on vista and xp. solid, good antivirus
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I'm surprised MalwareBytes isn't on the list. We've come to depend on it for removing zlob from problematic PCs.
Those who believe the Internet is private,
find their privates are on the Internet.
Okay, how does it detect something that's unknown? I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested." But perhaps that's too techie and we should go with "zomg! finds viruses and kills zem dead! nom nom nom." :)
In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner. But it sure does slow the machine down, as I'm sure many techies out there reading this from work will know by the curse word "Norton." And if I were a virus writer, I would have every antivirus product in my lab running to test against before releasing it as a matter of course. Could it be this thing is only effective because most virus writers haven't heard of it?
#fuckbeta #iamslashdot #dicemustdie
http://www.av-comparatives.org/seiten/ergebnisse_2008_08.php
http://www.av-comparatives.org/seiten/ergebnisse_2008_11.php
The tables are in a horrible colors for some reason.
I use a firewall. Thats about it. It blocks unknown incoming traffic. Only stupid people get viruses anymore.
It's all fun and games till someone divides by 0. Then it's hilarious.
This is an interesting test, but some market leaders are missing, notably Trend (El Reg quotes Gartner saying Trend has 13.8% market share, third after Symantec and McAfree). If I am to use this research to pick a solution or to pick a better solution, the chances are high that someone in the management is going to "suggest" (try to make me use...) "Trend" because they've heard of it; if they suggest "McAfee" I can use this research to shoot that down, but not Trend.
Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried, and I consider it worth testing because of its different development methodology with undoubtedly different strengths and weaknesses compared to the big commercial AV vendors.
So it's all very interesting but not entirely useful to me.
"For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled"
. . . someone could find a way to get rid of its horrible "zomg hackers are after you, give us some monies" pop-up that comes up at 10:30 every tonight and alt-tabs me out of anything else I might be doing. I realize the free version is free, and apparently that pop-up ad justifies, but *must* it also alt-tab me out of games? That's pretty obnoxious.
Why are these numbers so low? 67%? 30%?
If these malware are "known", why haven't the anti-virus/malware companies jumped all over them? I get a database update on my AV at least once a week (often daily), and an engine upgrade every month or two - shouldn't these be included on one of them? I would have expected the differences to be 99% coverage vs 95% or similar.
Something seems fishy to me; I have a hard time believing that AV-Comparatives somehow have access to hundreds of malware which the AV companies don't have/can't detect.
It's worth pointing out that when you take false positives into account Eset Nod32 becomes the only AV solution to achieve the "Advanced+" rating. Apparently it detects 20% fewer "unknown" threats but had only 7 false positives, compared with 17 for AntiVir. This places AntiVir in the same category ("Advanced") as Kaspersky, Mircosoft, Symantec, McAfee, and GData. Hopefully people bother to read the TFA, and not just this /. article
I KUT J00 M4NG!!!
I've been switching between the different free AV software to see which I liked, and I have mixed feelings about Avira Antivir.
On the one hand, it found a trojan on my computer that AVG and Clamwin had both missed. On the other hand, it seems to have really limited options. For example, I can't get it to scan only my PC's internal drives, without also scanning my terabyte external drive, which takes forever. Avira also pops up a window advertising the pro version periodically.
AVG 8 sucks system resources and ClamWin couldn't detect a virus if it punched it in the face. I guess I'll try Avast next.
Give a man fire, and you warm him for the night. Set a man on fire, and you warm him for the rest of his life.
I'm still waiting for one of the anti-virus vendors to just start implementing a white list to cut down on the false positives.
It's not really a "virus detector" if it hits more often on non-viruses on your system. It's a "new software is being installed" detector.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Best against unknown viruses...
And you Windows users know it but oh... the pain... the pain...
Here be signatures
I don't know, my computer has never had a virus and never will. This TRS-80 Model I Level II runs like a dream. Just have to get the hang of loading and saving programs with the tape cassette player/recorder.
jsut athnoer menagiensls ltitle psrhae for you to dcoede. Why do we wtsae our tmie dnoig tihs?
We use Kaspersky for Windows systems at work (and ClamAV on Linux for mail, though that might change to Kaspersky as I believe we have a license for it). When employees ask if they can use our licenses for their personal machines, I point them at Avira AntiVir because it's about as good and it's FREE FOR PERSONAL USE (although the free version has less spyware detection). It blows AVG out of the water.
Here are some useful links from my research, which included the above site:
From the Wikipedia links and other research that I didn't bother to note to my colleagues (who were also doing this research), I determined that Kaspersky's software was among the most efficient and CPU-friendly. It's only downside was a less-than-optimal user interface, especially on the administrative side for the corporate product. We didn't mind its UI flaws in the free trial period, so we purchased it. We're still happy with it several months later.
The main arguments for our switching from Trend Micro were that it was slow, had poor performance, missed several viruses, we wanted to boycott it, and we were tied to a very old version (since it out-performs the newer ones in reviews). Arguments for switching to Kaspersky included: it doesn't feel bloated (remember when that was the norm?), great performance, well received across the board in reviews, dirt cheap (new licenses are 70% the current renewal cost of Trend Micro, which is an ever-growing target), we liked the UI that prevented reviewers from giving it a perfect score, and it's the de-facto number one scanner in Russia and surrounding area (you know, where all the viruses come from?). Kaspersky is also growing rapidly in deployments; you can now get computers installed with it.
Use my userscript to add story images to Slashdot. There's no going back.
So yeah, they couldn't even bother to run a spellcheck this time. Usually it's a grammatical error that a spellcheck would not have fixed anyway, but this time, they couldn't even be bothered to use a spell checker. What a bunch of goofs.
Do we really need yet another analysis that talks about the same exact products on the same exact platforms?
Instead of a focus on complete information security, this kind of analysis, once again, ignores BlackBerry and Macintosh and Linux - some very common platforms that are growing in both the enterprise and home markets. How a repeated focus on the most commonly discussed platform helps anyone is a mystery. It just continues to say "all these products are different, we rank them according to our exclusive analysis." Are you going to switch AV vendor given their unconvincing analysis? Not likely.
In the end, the analysis sounds hollow; "My AV software isn't on the top of their list". Given their strategy, who cares?
The self-declared "security experts" completely miss the point by completely ignoring platforms other than Windows. Sure, perhaps the BlackBerry is only found in 70% of corporate environments, and the Mac only has 7% market penetration, and Linux is perhaps only 20% of back-end servers - but I'd fathom that nearly 95% of the businesses out there use one of these platforms and need them to be SECURE - in order to keep their corporate (or personal) data and networks safe.
All these "security experts" are failing their potential customers by rehashing the same discussion, instead of analyzing products and methods that address the mostly unhandled attack vectors of other mission-critical platforms.
Avira, Bitdefender, Avast and others have free and fee versions. What are the material differences?
...will take the system offline every so often and scan with multiple antivirus programs in a different OS environment, like linux.
How does scanning a running operating system for viruses even cause a dent? Most viruses that I've ever seen have a tendency to hide and/or protect itself from antivirus software. The software is usually completely helpless on an already infected system.
I recommend an offline scanning solution like TRK for an already infected system.
I downloaded one of the reports from this AV testing company/lab. Yeah, their report used Courier New throughout. Seriously, it's not that hard to just use the default Times New Roman or Arial fonts for reports. I don't expect perfection in presentation, but to intentionally choose a difficult-to-read font because it's what programmers use on the command line reeks of annoying.
What about my married?
Because I can't see your married. Where did you hide it?
-- A formed babby
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Are there any similar types of reports for the other types of malware?
A comparison of products that protect against the types of malware targetted by the like of MalwareBytes, AdAware and Spybot would be really handy.
They are an Austrian company that has recommended a German company with Austrian subsidiary.
Probably nothing but a coincidence that matters not.
+1 for NOD32 is you have to use a Microscrap Windows product.
+1 for just using a flavor of Linux.
This reminds me of the timeless Adam Sandler love ballad...
If an egg fits in there,
why can't I?
Imagination drew in bold strokes, instantly serving hopes and fears, while knowledge advanced by slow increments...
Isn't free, so Antivir wins there. NOD32's footprint used to be incredibly small (25MBytes installed), though as they're trying to go more mainstream they have beefed up a bit. The antivirus is somewhere in the ballpark of 45-55MBytes installed, and their kitchen sink "Smart Security" suite is a little over 100MBytes installed. In their defense, the newer interface (which likely accounts for the majority of size balloon) is much more user friendly. It more closely mimics the de facto standardized UI of Norton/McAffee/TrendMicro/Panda, making it alot more palatable for new users. Compared to the aforementioned security suites, it is still MUCH less taxing than most of the big-name suites.
As far as system resources, I've yet to have a friend, family member, or client who *hasn't* noticed a performance boost after ditching their old virus scanner in lieu of NOD32. Granted none of them were coming from Antivir, but I would still say that they are very good as far as detection rate and removal rate, in addition to having an impressively small system footprint (although again it is bigger than it used to be).
Joey
Witness how many legitimate products get flagged as "hacker tools" (like Angry IP Scanner)
A port scanner is a hacker tool. Of course you can use it for legitimate purposes as you can with many other tools. I can even use a malicious virus as a tool for testing my AV engines. But it is still a virus. If you are in the position to legitimately use a port scanner you obviously should also be in the position to get this program on your machine from being excluded by the corporate antivirus.
Apart from that, if I would discover some of my users to use such a tool without entitlement and the AV engine would not detect it, I would demand for a signature to be added by the AV vendor.
Apart from that the last time I checked they mentioned that not every AV vendor is used for comparison because they have to fullfill certain minimal requirements. But as a matter of fact I just checked again and concerning Trend they say:
TrendMicro may be tested separatly in 2008 and will be included in future
Oh, and:
[...]while their commercial counterparts are ignored (ostensibly after paying them off to get off their little black list).
Do you notice how I am much less likely to submit potential evil software for inclusion in the next signature update if it is commercial sw, as my users (and supposedly many hackers) are more likely to use the freely available software to piss me off?
A "farmer" here. And no diskdrive jokes please!
My last ewe died this year. Of old-age.
And it was convenient, just as my tumescence was failing due to old age. /.ers?)
(sound familiar,
I mean.. she was really starting to look good! Those big blue trusting eyes...add a little lipstick, and...
Well, are you guys with the dog/STD jokes... ummm, really joking after all?
And no rubber-boot jokes please!
.
-
.
- aqk
F U
Oh, I see your married too
You see my married?
Whar's mah shotgun? Damn prevert peepin' toms!
Some o' these /. boys been spendin' too much time in Mom's basement!
A condom?
No... It's a plastic bag. .... And WAY TOO SMALL for the PC!
Condoms are too small.
OMG! This reminds me of My greasy old Bell Boutique bag!
How embarrassing!
. ..
.
- aqk
F U
From the article: "So the certification level ADVANCED+ has been achieved by ESET NOD32 only, that has detected 20% less of the samples that AVIRA AntiVir has discovered but has triggered only 7 false alarms. AntiVir, on the contrary, with its 17 false positives hasn't gone beyond the ADVANCED certification level, which also includes Kaspersky, Microsoft, Symantec, McAfee and GDATA." So the subject of this Slashdot article is obviously wrong and misleading.
This is all good and well, but tests do not reflect the true enviroment and never will. I'd rather follow something like http://www.shadowserver.org/wiki/pmwiki.php?n=Stats.Virus90-DayStats
The reason I link to the 90 days stats is that it shows consistency. Judging a product using limited dataset is illogical.
The best defence against unknown malware is to make an Operating System that don't get compromised by clicking on an URL or opening an email attachment ..
davecb5620@gmail.com
Interesting that they are recommending AntiVir as an antispyware/antivirus utility. Strange when I run spybot/malwarebytes on infected machines, it cites Antivir as an infection. Now whether or not this is the same AntiVir that I've seen on machines in the past remains to be seen, but I do find it suspect that they would chose such a well known name of a spyware program... I guess if they didn't use the classic "AntiVir" spelling, I might feel less inclined to think this.
"A cat is fine, too..."
Whitelisting is the latest technology which gives 100% protection from existing or future virus/malware.
Run only what you trust..