Slashdot Mirror
Test of 16 Anti-Virus Products Says None Rates "Very Good"
An anonymous reader writes "AV-Comparative recently released the results of a malware removal test in which they evaluated 16 anti-virus software solutions. The test focused only on the malware removal/cleaning capabilities, therefore all the samples used were ones that the tested anti-virus products were able to detect. The main question was if the products were able to successfully remove malware from an already infected/compromised system. None of the products performed at a level of 'very good' in malware removal or removal of leftovers, based on those 10 samples."
BuY H3rB@l V1agaRa t0Day!!!
Security is a process, not a product.
-Myke
I don't think anyone sells common sense.
They said AV-Comparative.org in the article. Try going there and see what happens. The correct site is av-comparatives.org.
How about testing some malware removal programs? Malwarebytes, Adaware, Spybot?
I find Malwarebyte's Anti-malware to work wonders. Paired with Avast home edition, it is a good free combination. I think most system administrators notice the difference between software primarily tailored for virus detection and removal, and ones tailored for malware detection and removal.
They tested these:
Avast Professional Edition 4.8
AVG Anti-Virus 8.5
AVIRA AntiVir Premium 9.0
BitDefender Anti-Virus 2010
eScan Anti-Virus 10.0
ESET NOD32 Antivirus 4.0
F-Secure AntiVirus 2010
G DATA AntiVirus 2010
Kaspersky Anti-Virus 2010
Kingsoft AntiVirus 9
McAfee VirusScan Plus 2009
Microsoft Security Essentials 1.0
Norman Antivirus & Anti-Spyware 7.10
Sophos Anti-Virus 7.6
Symantec Norton Anti-Virus 2010
Trustport Antivirus 2009
Stop recommending products. The tests demonstrate that av products don't perform well. It is right on. 80% of my day is spent cleaning malware. I have written here many times about how you need a combination of products. I've also emphasized the need to do the initial cleaning with the infected drive as the secondary in a second machine.
Until you do this day in and day out please stop with the recommendations, as you are not helping anyone one bit.
You can lead a man with reason but you can't make him think.
I've been working in the on-site support field for over a decade. I've seen the viruses get nastier and nastier.
It used to be that the virus got a hold of the system, maybe did a little damage or had a little fun. Sometimes it was pretty funny. Such as screwing with the mouse.
Then things started to get a little more serious. The virus would insinuate itself into the system folder and maybe IE. They stated doing tasks. Thus rose the botnets.
Then it became big business for people. The spreading of spam and fake anti-virus (that wanted you to purchase the "full version" so that you'd get rid of the virus they said you had) was the order of the day. They started blocking access to the run box, the task manager, and sites that might be able to help you (online virus scanners). They started killing the AV programs. They also replaced the explorer.exe and iexplore.exe files. Hell, they even go after Firefox, Chorme, and Opera.
They really get their hooks into in and don't want to let go because it means money. Big money. So I'm not surprised that AV programs are having a tough time getting rid of them. It hasn't been kiddies out for fun for a long time. Now it's all about professional programmers out to make an ill gotten buck.
Of course, half of the software they tested is not anti-Malware software (Avast, for example, is an AV, not an Anti-Malware).
They also did not test MalwareBytes, probably because it would make all of the others look bad.
for the regular user, I can understand wanting the "feeling" that you're protected. however, when even the shittiest and lamest rogue-AV programs like WinAntiSpyware, Antivirus2009, System Protector Pro, Police Pro, and all the other bogus products can't be stopped by even the best of AV software, ya gotta think. these scanning programs don't do shit and make you feel like they have. so, understand how your system works. use Sysinterals Autoruns to see what shit is being loaded on your system. and become familiar with our dear friend combofix provided by Bleeping Computer. It is the only tool worth a damn that can also get rid of severe rootkits. Sometimes for the real bad ones you'll need to use the Windows Recovery Console to delete files hidden from the Windows API as well as disable infected drivers/services. AV will still be a joke since the bottom line is, you can still get infected. especially if you are prone to getting viruses anyway due to your browsing habits.
*plays the Apogee theme song music*
Testing online (meaning running the removal program on a running, infected, system) removal seems kinda silly. You are fighting a war there and the malware has the upper hand being there first. On a compromised system you generally want to work on it offline. You either boot a live CD or take the hard disk to another computer. That way the malware can't be running. You can then use tools to track it down and remove it.
Running a scanner on a live system is more of a preventative measure and a detection measure. You have a realtime scanner looking for threats coming in. If it finds them, it can block them before they have a chance to do anything. This is 99.9% of the good a virus scanner does. It stops them before they ever infect the system. It can then also help in terms of alerting you if a system is infected.
However counting on one to be good at removal on a live system seems silly. Take the system offline, fix it, and bring it back up.
They took 16 flu shots from companies that produce flu products, and used several flu strains that all companies advertise their products for (influenza C, H1N1, H1N2, H3N1, H3N2, and H2N3). The study focused on creating the necessary antibodies and 'cleaning the system' from the flu. Unfortunately, none of them rated 'very good'.
If you have a dark sense of humor, read on.
399234 test subjects were used, and 4735 deaths recorded.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
Imaging products have become so good and fast that I no longer bother with 'scrubbing' a computer clean when it gets a virus. I can reimage the machine in less time; 15 minutes from start to finish, and I don't have to worry about viral remnants in the registry or some deeply buried hidden folder with a time bomb inside.
I keep our company's image file up-to-date, and when something goes wrong with a computer (drive crash, corrupt registry, malware, whatever) they are back online in 15 minutes. Screw scouring the web for a utility to remove a particular virus that may or may not work, and screw relying on an all-in-one product to save you from malware.
I have come to terms with the absolute fact that users are stupid and careless and aside from rare individual who bother to be responsible, they will always be stupid and careless, no matter how much I wish they would change.
In a business environment, imaging is the way to go.
(I use a Mac at home and don't have to worry about such things)
"Study your math, kids. Key to the universe." -The Archangel Gabriel
If you had more than a passing familiarity with Microsoft's products and the elaborate pile of stuff on top that makes it even more insecure you would be aware that you need more than that. Large numbers of viruses and worms have spread with no user interaction at all, and others that required intervention have spread via things that appear to be quite innocent to the user (banner advertisement on Australia's Telstra white pages telephone number search page one day for instance). Then of course there is downloading that program that the user assumes is only going to give them an animated purple monkey, a weather report or little images of smiles to decorate their emails. They don't know that they system has no way of protecting them from such things being other than what they appear to be.
Don't fall for the copout of accusing the users of being idiots. Instead it's a long chain of events with stupidity at many steps on the part of some developers which gave us a house of cards which the user can upset so easily.
We can't just say "haha, user is an idiot" when we in the computer software industry can look in the mirror to see part of the real idiocy. Every time I make a user "admin" or "power user" so that they can run badly written software I add to the idiocy and create another potential node for a botnet or another chance at credit card fraud.
At one site I do work for EVERY user has to be "admin" so they can run an internally developed dotnet application that writes it's config file to the root of the system drive simply because that's where the developer wanted to put it. The developer has a string of certifications and years of experience but still carries on with such overtly STUPID actions, not because he is stupid but because a very large chunk of the industry is stupid and stupidity is standard operating procedure. Most of the new security options in Microsoft's products are rendered pointless when the applications on top come from such a culture of stupidity.
I can't provide citations to stuff I just made up
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.