Against Unknown Viruses, Avira AntiVir the Winner For Now

KingofGnG writes "AV-Comparatives, the Austrian team of experts dedicated to antivirus tests acknowledged as a reference point in the field, has published the second part of the mid-year comparative, an ideal addendum to the one already released last September. This time the aim is to evaluate the antimalware tools' effectiveness against unknown threats in a test scenario meant to prove the heuristic part and the generic markers of the on-demand scanning engines." The best in show (of 16 anti-malware packages evaluated), Avira AntiVir was able to find 71% of the unknown malware it was exposed to in the first week, dropping to 67% after the fourth.

Comments

mine is better

[SoupGuru]

My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...

Re:mine is better

[77Punker]

I'm really glad the last sentence of that post was a joke instead of "I run Linux."

Re:mine is better

[Anonymous Coward]

My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...

Sounds like my sex life: My anti-STD solution is great. It blocks 100% of all known and unknown STD's. Just don't ask what my human-to-human sexual encounter rate is... :(

Re:mine is better

[Smidge207]

Just don't ask what my human-to-human sexual encounter rate is...

Fair enough, but I am curious as to what your human-to-dog sexual encounter rate is?

What? It's a fair question, he left it wide open to interpretation.

=Smidge=

Re:mine is better

[Thelasko]

This one comment demonstrates why the entire article is bogus. Thanks.

If you actually read the fine article it goes on to note Avira's high rate of false positives and recommends NOD32 instead.

Re:mine is better

[sveard]

human-to-dog sexual encounter [...] Had that happen to me in Canada at a balmy -30 Celsius.

Yikes!

Re:mine is better

[davester666]

Ah, good old duct tape. Is there any problem it can't fix?

Re:mine is better

[ClosedEyesSeeing]

Mine is better - remove the cat5 (or phone) cable. I'd like to see the chances of something getting in then! (from the Web, stupid users with viruses on portable media excluded from test results)

Re:mine is better

[lysergic.acid]

still, i think a better (more useful) test would be conducted by:

1. enlisting a 100 or so test subjects from various non-technical (in terms of computer knowledge) backgrounds.
2. give each one of the 9 best-selling anti-virus solutions to 10 different volunteers.
3. give the last 10 volunteers a 2-week course on basic computer security and malware-prevention.
4. subject all 100 subjects to the same gauntlet of viruses/trojans/malware over a 6-month period. (perhaps 4-5 viruses a week, for a total of around 120 threats tested)
5. note how many infections per person each group averaged, how many false-positives each group reported, and how much time/productivity was lost due to the threats & false-positives--for instance, time spent on reboots, reformats, dealing with virus alerts, waiting for anti-virus updates, etc.
6. lastly, measure the cost-effectiveness of the anti-virus solution used in each of the 10 groups.

i suspect that preventative education/training is probably the most effective method of combating viruses & malware. and though it might not be cost-effective in the short-term, it might be cheaper to train long-term employees how to avoid viruses/malware than to pay for yearly-subscriptions and still suffer down-time and loss of productivity from infections.

MalwareBytes?

[oahazmatt]

I'm surprised MalwareBytes isn't on the list. We've come to depend on it for removing zlob from problematic PCs.

Unknown?

[girlintraining]

Okay, how does it detect something that's unknown? I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested." But perhaps that's too techie and we should go with "zomg! finds viruses and kills zem dead! nom nom nom." :)

In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner. But it sure does slow the machine down, as I'm sure many techies out there reading this from work will know by the curse word "Norton." And if I were a virus writer, I would have every antivirus product in my lab running to test against before releasing it as a matter of course. Could it be this thing is only effective because most virus writers haven't heard of it?

Re:Unknown?

[spinkham]

Try NOD32. The scanner that actually got top ratings in this test, for finding the highest number of viri without ungodly number of false positives. I've used it for a few years, and it's fast and has a good track record on virus tests. Can't recommend enough.

Missing some market leaders

[nicolaiplum]

This is an interesting test, but some market leaders are missing, notably Trend (El Reg quotes Gartner saying Trend has 13.8% market share, third after Symantec and McAfree). If I am to use this research to pick a solution or to pick a better solution, the chances are high that someone in the management is going to "suggest" (try to make me use...) "Trend" because they've heard of it; if they suggest "McAfee" I can use this research to shoot that down, but not Trend.
Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried, and I consider it worth testing because of its different development methodology with undoubtedly different strengths and weaknesses compared to the big commercial AV vendors.
So it's all very interesting but not entirely useful to me.

Re:Missing some market leaders

[girlintraining]

It could be because Trend Microsystems has gone after people who have tried to benchmark their software in the past, claimed to have exclusive patents to the very concept of antivirus scanning, etc. They don't exactly have a great reputation for supporting fair marketing and being open about how their product works... Witness how many legitimate products get flagged as "hacker tools" (like Angry IP Scanner), while their commercial counterparts are ignored (ostensibly after paying them off to get off their little black list).

I say, it could be.

Now If only . . .

[Cyberllama]

. . . someone could find a way to get rid of its horrible "zomg hackers are after you, give us some monies" pop-up that comes up at 10:30 every tonight and alt-tabs me out of anything else I might be doing. I realize the free version is free, and apparently that pop-up ad justifies, but *must* it also alt-tab me out of games? That's pretty obnoxious.

Re:Now If only . . .

[monkeyfromx]

How about this? http://www.tipsfor.us/2007/08/15/make-avira-antivir-free-edition-more-usable/

TFA paints a more complete picture

[floodo1]

It's worth pointing out that when you take false positives into account Eset Nod32 becomes the only AV solution to achieve the "Advanced+" rating. Apparently it detects 20% fewer "unknown" threats but had only 7 false positives, compared with 17 for AntiVir. This places AntiVir in the same category ("Advanced") as Kaspersky, Mircosoft, Symantec, McAfee, and GData. Hopefully people bother to read the TFA, and not just this /. article

Re:TFA paints a more complete picture

[street struttin']

Why read the article? You just told us what we'd miss if we didn't.

More evidence for a white list.

[khasim]

I'm still waiting for one of the anti-virus vendors to just start implementing a white list to cut down on the false positives.

It's not really a "virus detector" if it hits more often on non-viruses on your system. It's a "new software is being installed" detector.

False positives

[Thelasko]

The summary left out some important information. From TFA:

...the samples detection rates are only one of the two elements evaluated for the antivirus final classification, being the number of false positives the other. Rising a false alarm about a malware on a legit software can cause as much troubles like a real infection, the report states, and it is for this reason that AVIRA, Kaspersky and other products, even if they have obtained very good results in identifying samples, have been penalized with a lower classification.

So the certification level ADVANCED+ has been achieved by ESET NOD32 only, that has detected 20% less of the samples that AVIRA AntiVir has discovered but has triggered only 7 false alarms.

I can do 100%

[gsgriffin]

I don't know, my computer has never had a virus and never will. This TRS-80 Model I Level II runs like a dream. Just have to get the hang of loading and saving programs with the tape cassette player/recorder.

Re:My antivirus research for my IT department

[St. Alfonzo]

"[...]it's the de-facto number one scanner in Russia and surrounding area (you know, where all the viruses come from?)."

Ignoring the assumption that all viruses come from Russia, wouldn't that make it more likely that the virus developers would make sure their viruses can evade detection under it?

Your married...

[Hurricane78]

What about my married?

Because I can't see your married. Where did you hide it?

-- A formed babby