Slashdot Mirror
Test of 16 Anti-Virus Products Says None Rates "Very Good"
An anonymous reader writes "AV-Comparative recently released the results of a malware removal test in which they evaluated 16 anti-virus software solutions. The test focused only on the malware removal/cleaning capabilities, therefore all the samples used were ones that the tested anti-virus products were able to detect. The main question was if the products were able to successfully remove malware from an already infected/compromised system. None of the products performed at a level of 'very good' in malware removal or removal of leftovers, based on those 10 samples."
BuY H3rB@l V1agaRa t0Day!!!
Security is a process, not a product.
-Myke
Despite this being Slashdot, when I first saw the headline about "anti-virus" products, I immediately thought "stuff like Tamiflu".
I see even classic Slashdot is now pretty much unusable on dial up anymore.
Guess they didn't try:
dd if=/dev/zero of=/dev/sda
Only sane way to remove viruses. Rates an "Excellent".
I guess the equivalent in Windows is to buy a new computer. Also, an "Excellent" method.
I don't think anyone sells common sense.
restore from a known good backup whenever the root account is compromised, be it compromised by a worm or a human, in part because it's impossible to tell the difference between a human pretending to be a worm and a worm, so it is quite difficult (perhaps impossible) to know what the attacker did, and how to undo the damage.
They said AV-Comparative.org in the article. Try going there and see what happens. The correct site is av-comparatives.org.
computer, my browser is completely broken.
How about testing some malware removal programs? Malwarebytes, Adaware, Spybot?
I find Malwarebyte's Anti-malware to work wonders. Paired with Avast home edition, it is a good free combination. I think most system administrators notice the difference between software primarily tailored for virus detection and removal, and ones tailored for malware detection and removal.
They tested these:
Avast Professional Edition 4.8
AVG Anti-Virus 8.5
AVIRA AntiVir Premium 9.0
BitDefender Anti-Virus 2010
eScan Anti-Virus 10.0
ESET NOD32 Antivirus 4.0
F-Secure AntiVirus 2010
G DATA AntiVirus 2010
Kaspersky Anti-Virus 2010
Kingsoft AntiVirus 9
McAfee VirusScan Plus 2009
Microsoft Security Essentials 1.0
Norman Antivirus & Anti-Spyware 7.10
Sophos Anti-Virus 7.6
Symantec Norton Anti-Virus 2010
Trustport Antivirus 2009
Stop recommending products. The tests demonstrate that av products don't perform well. It is right on. 80% of my day is spent cleaning malware. I have written here many times about how you need a combination of products. I've also emphasized the need to do the initial cleaning with the infected drive as the secondary in a second machine.
Until you do this day in and day out please stop with the recommendations, as you are not helping anyone one bit.
You can lead a man with reason but you can't make him think.
I've been working in the on-site support field for over a decade. I've seen the viruses get nastier and nastier.
It used to be that the virus got a hold of the system, maybe did a little damage or had a little fun. Sometimes it was pretty funny. Such as screwing with the mouse.
Then things started to get a little more serious. The virus would insinuate itself into the system folder and maybe IE. They stated doing tasks. Thus rose the botnets.
Then it became big business for people. The spreading of spam and fake anti-virus (that wanted you to purchase the "full version" so that you'd get rid of the virus they said you had) was the order of the day. They started blocking access to the run box, the task manager, and sites that might be able to help you (online virus scanners). They started killing the AV programs. They also replaced the explorer.exe and iexplore.exe files. Hell, they even go after Firefox, Chorme, and Opera.
They really get their hooks into in and don't want to let go because it means money. Big money. So I'm not surprised that AV programs are having a tough time getting rid of them. It hasn't been kiddies out for fun for a long time. Now it's all about professional programmers out to make an ill gotten buck.
Of course, half of the software they tested is not anti-Malware software (Avast, for example, is an AV, not an Anti-Malware).
They also did not test MalwareBytes, probably because it would make all of the others look bad.
He was hardly an "ass", though maybe a troll. Certainly an entertaining post, but your response to it was wrong.
1) There are NO viruses for the Mac. There are trojans though, like any OS.
2) The Mac has long had the marketshare for viruses - pre-OS X there were plenty of Mac viruses. There have been none for OS X because it is more difficult to write them with the way the new OS is designed. Writing one for OS X is like a holy grail for virus writers.
3) Who is the "ass" calling OS X a "precious yuppie OS"?
for the regular user, I can understand wanting the "feeling" that you're protected. however, when even the shittiest and lamest rogue-AV programs like WinAntiSpyware, Antivirus2009, System Protector Pro, Police Pro, and all the other bogus products can't be stopped by even the best of AV software, ya gotta think. these scanning programs don't do shit and make you feel like they have. so, understand how your system works. use Sysinterals Autoruns to see what shit is being loaded on your system. and become familiar with our dear friend combofix provided by Bleeping Computer. It is the only tool worth a damn that can also get rid of severe rootkits. Sometimes for the real bad ones you'll need to use the Windows Recovery Console to delete files hidden from the Windows API as well as disable infected drivers/services. AV will still be a joke since the bottom line is, you can still get infected. especially if you are prone to getting viruses anyway due to your browsing habits.
*plays the Apogee theme song music*
*whispers*
"Shall I?"
(whisperwhisper)
"Why me??"
(whisperwhisper)
"Ok, damnit! I'll do it! But you owe me one!"
*steps forward into the spotlight*
*loud*
"Well, I found a better combination:"
*louder*
"JUST INSTALL GNU/LINUX!"
*normal voice*
"Thank you, thank you! I will be here..." *dodges flying chair and Granny Smith with bite mark* "... all night!"
(P.S.: I use Linux as my main Desktop. And Windows for the games. No hard feelings here. :)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Testing online (meaning running the removal program on a running, infected, system) removal seems kinda silly. You are fighting a war there and the malware has the upper hand being there first. On a compromised system you generally want to work on it offline. You either boot a live CD or take the hard disk to another computer. That way the malware can't be running. You can then use tools to track it down and remove it.
Running a scanner on a live system is more of a preventative measure and a detection measure. You have a realtime scanner looking for threats coming in. If it finds them, it can block them before they have a chance to do anything. This is 99.9% of the good a virus scanner does. It stops them before they ever infect the system. It can then also help in terms of alerting you if a system is infected.
However counting on one to be good at removal on a live system seems silly. Take the system offline, fix it, and bring it back up.
Imaging products have become so good and fast that I no longer bother with 'scrubbing' a computer clean when it gets a virus. I can reimage the machine in less time; 15 minutes from start to finish, and I don't have to worry about viral remnants in the registry or some deeply buried hidden folder with a time bomb inside.
I keep our company's image file up-to-date, and when something goes wrong with a computer (drive crash, corrupt registry, malware, whatever) they are back online in 15 minutes. Screw scouring the web for a utility to remove a particular virus that may or may not work, and screw relying on an all-in-one product to save you from malware.
I have come to terms with the absolute fact that users are stupid and careless and aside from rare individual who bother to be responsible, they will always be stupid and careless, no matter how much I wish they would change.
In a business environment, imaging is the way to go.
(I use a Mac at home and don't have to worry about such things)
"Study your math, kids. Key to the universe." -The Archangel Gabriel
If you had more than a passing familiarity with Microsoft's products and the elaborate pile of stuff on top that makes it even more insecure you would be aware that you need more than that. Large numbers of viruses and worms have spread with no user interaction at all, and others that required intervention have spread via things that appear to be quite innocent to the user (banner advertisement on Australia's Telstra white pages telephone number search page one day for instance). Then of course there is downloading that program that the user assumes is only going to give them an animated purple monkey, a weather report or little images of smiles to decorate their emails. They don't know that they system has no way of protecting them from such things being other than what they appear to be.
Don't fall for the copout of accusing the users of being idiots. Instead it's a long chain of events with stupidity at many steps on the part of some developers which gave us a house of cards which the user can upset so easily.
We can't just say "haha, user is an idiot" when we in the computer software industry can look in the mirror to see part of the real idiocy. Every time I make a user "admin" or "power user" so that they can run badly written software I add to the idiocy and create another potential node for a botnet or another chance at credit card fraud.
At one site I do work for EVERY user has to be "admin" so they can run an internally developed dotnet application that writes it's config file to the root of the system drive simply because that's where the developer wanted to put it. The developer has a string of certifications and years of experience but still carries on with such overtly STUPID actions, not because he is stupid but because a very large chunk of the industry is stupid and stupidity is standard operating procedure. Most of the new security options in Microsoft's products are rendered pointless when the applications on top come from such a culture of stupidity.
The offline approach worked fantastically in the year 2000, but now... the playing field has changed.
We have root kits that embed themselves into alternate data streams, utilize virtualization, employ self-encryption and password protection and randomize what would otherwise be easy-to-detect signatures etc.. Some root kits can *only* be reliably detected if they are actually *running* because they conceal themselves using these techniques. *Even then*, it requires a competent utility with things like stealth detection which look specifically for that behavior of concealing/unconcealing itself. As a result, some of these viruses don't show up in Safe Mode either...
Scanning offline is a good first step if the system is hosed. From my experiences though -- if the system can boot and mostly works -- do whatever scanning you can first while it is online. Use your best judgment as to whether you have mitigated the threat and THEN take it offline for the final clean up.
Fact: Everything I say is fiction.
Pointless? Not exactly. New viruses can appear on your systems before there are any patterns for them. It is then left to to a scan and a clean-up to deal with it.
Mod down people who tell people how to mod in their sigs
It was nice to see how various products did on the simple tests. However, several serious mistakes were made in the test methodology.
First, 10 virus samples for the test cannot give a statistically meaningful result. At least 31 different samples are necessary, as people who have had testing statistics and quality control education would know.
Second, and even worse, the tests were not performed under real world conditions. No system has ever been shown to have only one infection in the real world. The testing should have included detection / removal on systems with all malware installed. This is what real world users see.
Third, the "cleaned" systems should have been retested to see if infection would repeat under supposedly "cleaned" conditions. If the registry entries blocked reinfection (I seriously doubt it), then that would be seen. This would not have been a valid complaint if they had not brought it up in their article. (courtroom trial rules)
Fourth, with the anti-malware product running and protection fully enabled, would any of the malware be blocked from installing, or even downloading? This would not be a valid complaint if they only chose products which have no preventative methods (firewall, sandbox operation). Products which do not ahve adequate protective behavior are worse than worthless to the public, as they would have the idea that they are safe when using the product. That is the whole purpose of these products, to make the user believe he is in some way safe. But he is seriously not safe.
Fifth, using only non-damaging malware samples is also unrealistic. Performance against damaging malware is very important, and was untested. Performance against one small, safe, variety of malware does not indicate anything about the anti-malware product's usefulness to the public.
Sheesh, I could probably go on for a while, but I give up. We have surpassed the three strikes rule quite a bit already. This post is just an advertisement for AV-Comparative. Did someone get paid for this post? They should have.
wake up and hold your nose
Comment removed based on user account deletion