Slashdot Mirror
Test of 16 Anti-Virus Products Says None Rates "Very Good"
An anonymous reader writes "AV-Comparative recently released the results of a malware removal test in which they evaluated 16 anti-virus software solutions. The test focused only on the malware removal/cleaning capabilities, therefore all the samples used were ones that the tested anti-virus products were able to detect. The main question was if the products were able to successfully remove malware from an already infected/compromised system. None of the products performed at a level of 'very good' in malware removal or removal of leftovers, based on those 10 samples."
I've been working in the on-site support field for over a decade. I've seen the viruses get nastier and nastier.
It used to be that the virus got a hold of the system, maybe did a little damage or had a little fun. Sometimes it was pretty funny. Such as screwing with the mouse.
Then things started to get a little more serious. The virus would insinuate itself into the system folder and maybe IE. They stated doing tasks. Thus rose the botnets.
Then it became big business for people. The spreading of spam and fake anti-virus (that wanted you to purchase the "full version" so that you'd get rid of the virus they said you had) was the order of the day. They started blocking access to the run box, the task manager, and sites that might be able to help you (online virus scanners). They started killing the AV programs. They also replaced the explorer.exe and iexplore.exe files. Hell, they even go after Firefox, Chorme, and Opera.
They really get their hooks into in and don't want to let go because it means money. Big money. So I'm not surprised that AV programs are having a tough time getting rid of them. It hasn't been kiddies out for fun for a long time. Now it's all about professional programmers out to make an ill gotten buck.
Here's another analogy for you: don't rely on the police to catch the robbers. Use houses with locks on them and learn how to use it.
It's not a question of being or not being totally effective, you can make that argument from any direction and arrive at the same answer. No product is 100% effective. It looks like this review was just saying that none of the products tested met their expectations.
So that either means that their expectations were unreasonable, or all the tested products stink.
Or a combination of the two. That's where my money is. Regardless of topic, security is best handled from the inside, where your footing is solid and attacks only come from one direction. Problem is, the inside is not secure. At that point you require extraordinary external security, which either means you need to be very good at it yourself, or you have to find someone that's top-notch to make up for the problem. It's no surprise that so many of these products didn't fair well, they're defending the castle while standing outside the walls. And since you're already starting out with a handicap and are going against experts and people motivated by money, if you want the job done right, you're best to do it yourself. The human element of unpredictability along with knowing what's safe and what's not safe is the best defense, not software. If you're a computer noob, there simply isn't a "very good" solution, as this review basically concludes.
I work for the Department of Redundancy Department.
They took 16 flu shots from companies that produce flu products, and used several flu strains that all companies advertise their products for (influenza C, H1N1, H1N2, H3N1, H3N2, and H2N3). The study focused on creating the necessary antibodies and 'cleaning the system' from the flu. Unfortunately, none of them rated 'very good'.
If you have a dark sense of humor, read on.
399234 test subjects were used, and 4735 deaths recorded.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
Most popular operating systems can be analogous to a house with locks and a separate room for "maintenance personnel only" that's locked, and your personal room with a door and lock too (there may be similar rooms of other people with corresponding doors and locks).
The trouble is when you invite a guest into your house, there is no guest room that _you_ can easily use, so you have to invite him into your personal room. The design of the house is such that you cannot usefully interact with the guest while the guest is in a different room from you.
This means he has full access to your personal room. The geeks who don't understand the real world will say "Ah, but OS XYZ is secure because the "maintenance personnel only" room is locked and unaccessible". But who the fuck cares? You keep most of your stuff and valuables in your personal room! Insurance can take care of recreating the maintenance room stuff - not hard since the stuff in there is the same for every house of that model. They'll never be able recreate your personal documents.
This is changing a bit with Vista and Windows 7, but it's still not good enough IMO. As for Linux, I don't see much help with what I'm talking about for the average desktop user yet. Apparmor is not "desktop ready" yet, and SELinux is barely even ready for average admins.
This test of AV products is like inviting a crook/spy into your whole house, closing your eyes and letting him mess it up (plant bugs if he wants etc), and then get someone to try to clean everything up and restore stuff back to what it was.
Yes it can be done in many cases. But it's foolish to expect the clean up to be 100% in all cases.
If you really want to do that, you use a special house. Then you invite the crook into that special house. Then when he's done, you press a button and the house reverts back to its original state.
>If the person doesn't use the tape measure properly, and saws the wood too short, there isn't any magic that can fix the problem.
Use the other end of the piece of wood?
Worked for me many times :o)
"Measure twice, cut once"
Open Source Drum Kit, LPLC deve board - mjhdesigns.com