Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Against Unknown Viruses, Avira AntiVir the Winner For Now

timothy posted more than 5 years ago | from the evolving-bleakosystem dept.

Security 170

KingofGnG writes "AV-Comparatives, the Austrian team of experts dedicated to antivirus tests acknowledged as a reference point in the field, has published the second part of the mid-year comparative, an ideal addendum to the one already released last September. This time the aim is to evaluate the antimalware tools' effectiveness against unknown threats in a test scenario meant to prove the heuristic part and the generic markers of the on-demand scanning engines." The best in show (of 16 anti-malware packages evaluated), Avira AntiVir was able to find 71% of the unknown malware it was exposed to in the first week, dropping to 67% after the fourth.

cancel ×

170 comments

Sorry! There are no comments related to the filter you selected.

Ok? (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#25993143)

Ouch, my balls.

mine is better (4, Funny)

SoupGuru (723634) | more than 5 years ago | (#25993229)

My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...

Re:mine is better (3, Insightful)

77Punker (673758) | more than 5 years ago | (#25993299)

I'm really glad the last sentence of that post was a joke instead of "I run Linux."

I can do 100% (3, Funny)

gsgriffin (1195771) | more than 5 years ago | (#25993721)

I don't know, my computer has never had a virus and never will. This TRS-80 Model I Level II runs like a dream. Just have to get the hang of loading and saving programs with the tape cassette player/recorder.

Re:I can do 100% (0)

Anonymous Coward | more than 5 years ago | (#25994391)

If your feeling left out, I could probably dig something infectious out for that which could let you join in with the modern world and enjoy being infected too. (OK, it wouldn't stay resident once you power off and would need a 'bit' of help to get it spread, but a little bit of social engineering too and who knows)

More seriously - I know of one 'infectious' agent which was coded for a BBC micro which stayed resident in sideways ram over a soft reboot and would infect other disks. It needed the user to be suckered in to running it in the first place, so was more of a trojan than a virus or worm, but don't think that "old" means "secure"

I just want to also comment how ironic it is that the capatch I need to type for this post is "parasite" - honest!

Re:mine is better (1)

Mad Merlin (837387) | more than 5 years ago | (#25993337)

My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...

Turning off and unplugging your computer?

Re:mine is better (-1, Redundant)

Abstrackt (609015) | more than 5 years ago | (#25993529)

Well, I guess I'll be the one to kill the joke... His (or possibly her) custom anti-virus solution blocks everything, hence the part about not asking what the false positive rate is.

Re:mine is better (-1, Troll)

Anonymous Coward | more than 5 years ago | (#25994205)

Well, I guess I'll be the one to kill the joke... His (or possibly her) custom anti-virus solution blocks everything, hence the part about not asking what the false positive rate is.

Does it block lame, predictable jokes that weren't funny to begin with? Does it then block asshats like you who feel a need to explain the lame, predictable jokes that weren't funny to begin with? Come up with something like that and you'll be a success in this industry.

Re:mine is better (0)

Anonymous Coward | more than 5 years ago | (#25994223)

-1 Unfunny.

Re:mine is better (5, Funny)

Anonymous Coward | more than 5 years ago | (#25993363)

My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...

Sounds like my sex life: My anti-STD solution is great. It blocks 100% of all known and unknown STD's. Just don't ask what my human-to-human sexual encounter rate is... :(

Re:mine is better (4, Funny)

Smidge207 (1278042) | more than 5 years ago | (#25993757)

Just don't ask what my human-to-human sexual encounter rate is...

Fair enough, but I am curious as to what your human-to-dog sexual encounter rate is?

What? It's a fair question, he left it wide open to interpretation.

=Smidge=

Re:mine is better (3, Funny)

sveard (1076275) | more than 5 years ago | (#25993859)

human-to-dog sexual encounter [...] Had that happen to me in Canada at a balmy -30 Celsius.

Yikes!

Re:mine is better (1)

elrous0 (869638) | more than 5 years ago | (#25994963)

That's no way to treat man's best friend. Now, cats on the other hand...well they're just asking for it. At least, that's what I told the jury anyway.

Re:mine is better (0)

Anonymous Coward | more than 5 years ago | (#25994001)

Just don't ask what my human-to-human sexual encounter rate is...

I have more of those encounters than I can count... in a web browser. =P

Re:mine is better (3, Insightful)

davester666 (731373) | more than 5 years ago | (#25994169)

Ah, good old duct tape. Is there any problem it can't fix?

Re:mine is better (0)

Anonymous Coward | more than 5 years ago | (#25994209)

Oh, I see your married too.

Your married... (4, Informative)

Hurricane78 (562437) | more than 5 years ago | (#25994377)

What about my married?

Because I can't see your married. Where did you hide it?

-- A formed babby

Re:mine is better (0)

Anonymous Coward | more than 5 years ago | (#25994563)

If your by yourself I think it still counts as a human-to-human sexual encounter..:)

Re:mine is better (0)

Anonymous Coward | more than 5 years ago | (#25994925)

OMG, I think my liver has a virus! ::cuts out liver::

-Californication

Re:mine is better (1, Insightful)

Lord Ender (156273) | more than 5 years ago | (#25993413)

This one comment demonstrates why the entire article is bogus. Thanks.

Re:mine is better (1, Informative)

Anonymous Coward | more than 5 years ago | (#25993729)

This one comment demonstrates why your entire life is bogus.

The tests *do* take into account the false positive rates. I gained this information by reading the article. Maybe you could give this a whirl...? It's novel, I know, but it would stop you looking like a pompus jackass.

And hey - thanks.

Re:mine is better (2, Insightful)

Lord Ender (156273) | more than 5 years ago | (#25993815)

You must be new here.

Re:mine is better (5, Informative)

Thelasko (1196535) | more than 5 years ago | (#25993799)

This one comment demonstrates why the entire article is bogus. Thanks.

If you actually read the fine article it goes on to note Avira's high rate of false positives and recommends NOD32 instead.

Re:mine is better (2, Interesting)

Fozzyuw (950608) | more than 5 years ago | (#25994777)

Is there a free version of NOD32? Antivir is still free (albeit with occasional ad pop-ups) for the home version. It also have a very small footprint. How's NOD32's footprint?

Re:mine is better (0)

Anonymous Coward | more than 5 years ago | (#25995783)

Set execute permissions for avnotify.exe to disallow. Occasional pop-ups go away.

Re:mine is better (2, Informative)

ushering05401 (1086795) | more than 5 years ago | (#25995863)

There is no free version so far as I know.

I have only been using NOD for a few weeks... so far so good.

I was stuck with a Panda solution at work for a couple of years, NOD feels far advanced of that suite.

The nicest thing I have noticed so far is the NOD interface and presentation of options, so my opinion basically boils down to YMMV.

As far as footprints go, I rebooted this machine 29 hours ago according to task manager. The NOD kernel has utilized 28 seconds of processor time.

I just spawned an on-demand scan, and popped back into VS2008.. minor speed hit on standard tasks. Much less that Panda from the feel of it. Nod32.exe (scanning process) is currently topping out at 13% CPU usage, and it doesn't do that annoying throttling garbage that some other AV systems do, NOD stays light on the flops.

Barely noticeable really. Of course, I don't really know how good a job it is doing.

Re:mine is better (1)

ACMENEWSLLC (940904) | more than 5 years ago | (#25996009)

NOD32 is the best imo. If you haven't tried it before, give the demo a shot. Be aware that by default some advanced heuristics are turned off, while leaving normal heuristics on. If you turn some of those advanced heuristics on in realtime, you will see performance issues. Bare in mind these are heuristic checks not typically done by most AV and are there for the truly paranoid.

Re:mine is better (0)

Anonymous Coward | more than 5 years ago | (#25993705)

the av-comparatives report (and the full article of Kingofgng mentions it) contains also a false alarm test, which is why AVIRA did at the end not came out first

Re:mine is better (2, Interesting)

adisakp (705706) | more than 5 years ago | (#25993749)

Komodo firewall has technology to only allow white-listed EXE's to run in a "paranoid" mode. It means you have to manually "approve" newly installed programs and updates (or go into installation mode during the update) but it works pretty well.

I can't believe you chuckleheads didn't notice (0)

Anonymous Coward | more than 5 years ago | (#25993795)

The best in show (of 16 anti-malware packages evaluated), Avira AntiVir was able to find 71% of the unkown malware it was exposed to in the first week, dropping to 67% after the fourth.

So yeah, they couldn't even bother to run a spellcheck this time. Usually it's a grammatical error that a spellcheck would not have fixed anyway, but this time, they couldn't even be bothered to use a spell checker. What a bunch of goofs.

Re:mine is better (3, Interesting)

ClosedEyesSeeing (1278938) | more than 5 years ago | (#25994235)

Mine is better - remove the cat5 (or phone) cable. I'd like to see the chances of something getting in then! (from the Web, stupid users with viruses on portable media excluded from test results)

Re:mine is better (1)

Hordeking (1237940) | more than 5 years ago | (#25994577)

My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...

Your solution is a condom on the network interface?

yay (1)

circletimessquare (444983) | more than 5 years ago | (#25993265)

i've been using antivir for the past 2 years on vista and xp. solid, good antivirus

Re:yay (1)

Erbo (384) | more than 5 years ago | (#25993687)

Agreed. I've been using it about that long as well, having been introduced to it by my ex-wife, who learned about it from her friends in Finland (including the guy she's now married to). It's free, it works well, and I haven't had it "get in my way" the way McAfee sometimes would for some reason. I wouldn't spend another dime on McAfee at this point. Of course, I do have to contend with AntiVir's ad popup when it updates itself once a day, but oh well. Recommended.

Re:yay (1)

SpaceLifeForm (228190) | more than 5 years ago | (#25994487)

I consider the ad pop-up a feature. It let's you know it is stilling running.

Re:yay (1)

clone53421 (1310749) | more than 5 years ago | (#25994513)

Most antivirus packages have a nice systray icon for that. It even usually changes colour if something needs attention.

MalwareBytes? (4, Informative)

oahazmatt (868057) | more than 5 years ago | (#25993275)

I'm surprised MalwareBytes isn't on the list. We've come to depend on it for removing zlob from problematic PCs.

Re:MalwareBytes? (1)

penguin_dance (536599) | more than 5 years ago | (#25994781)

Yes, that's the only one I was able to use to help get rid of the pesky Recycled\boot.com virus a couple of weeks back. (It adds a folder called resycled and an autorun.inf, which you can delete, but will recreate itself until you totally clean it out.) That and Crap Cleaner finally got rid of it before it went crazy on my network.

Unknown? (4, Insightful)

girlintraining (1395911) | more than 5 years ago | (#25993289)

Okay, how does it detect something that's unknown? I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested." But perhaps that's too techie and we should go with "zomg! finds viruses and kills zem dead! nom nom nom." :)

In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner. But it sure does slow the machine down, as I'm sure many techies out there reading this from work will know by the curse word "Norton." And if I were a virus writer, I would have every antivirus product in my lab running to test against before releasing it as a matter of course. Could it be this thing is only effective because most virus writers haven't heard of it?

Re:Unknown? (1)

geminidomino (614729) | more than 5 years ago | (#25993501)

In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner.

I have. Any "packed" EXE apparently triggers a shitfit in AVG and Antivir. even known good ones (written myself, compiled and packed myself) throw up a warning about whatever the AV in question calls a "packed trojan"

Still, gotta use SOMETHING on windows (Ventrilo doesn't work on linux yet...). But when AVG rapes performance and Antivir launches popups with every update... it's easy to get disheartened.

Re:Unknown? (1)

girlintraining (1395911) | more than 5 years ago | (#25993593)

I have. Any "packed" EXE apparently triggers a shitfit in AVG and Antivir. even known good ones (written myself, compiled and packed myself) throw up a warning about whatever the AV in question calls a "packed trojan"

Okay, sorry -- you are correct. It does throw a hissy-fit over every day things like that. So does my Comodo firewall ("oh noes! You've updated firefox! Are you SURE it isn't a virus?"), and a lot of other products. But I've never had any of these "alerts" home in on a bona fide threat.

More evidence for a white list. (3, Insightful)

khasim (1285) | more than 5 years ago | (#25993669)

I'm still waiting for one of the anti-virus vendors to just start implementing a white list to cut down on the false positives.

It's not really a "virus detector" if it hits more often on non-viruses on your system. It's a "new software is being installed" detector.

Re:Unknown? (1)

Psychotria (953670) | more than 5 years ago | (#25993779)

ClamAV also marks malformed .exe and encrypted compressed files (archives) as potential malware. I am not sure if this is a good thing or a bad thing. I run clamav on my linux box and use it to scan my XP box (that I use for games). Some of the things are legitimate system (or service pack) files. Fortunately I know this and don't delete them. I can envisage a situation though where I don't know whether the file is OK or not, and in this case the agressive "hueristics" will do nothing but plant FUD.

In regards to firewalls, I think that is the opposite situation. Firewalls (IMO) *should* be paranoid. I don't want a firewall that "knows" what firefox is and what a firefox update is -- why should a firewall need to know this anyway. Keep them simple and err on the side of caution.

Re:Unknown? (1)

girlintraining (1395911) | more than 5 years ago | (#25993831)

In regards to firewalls, I think that is the opposite situation. Firewalls (IMO) *should* be paranoid. I don't want a firewall that "knows" what firefox is and what a firefox update is -- why should a firewall need to know this anyway. Keep them simple and err on the side of caution.

Sure, but as a user... I get sick of both. I just want something that detects "bad stuff", and doesn't tell me when it finds "good stuff", or at least doesn't remind me every day how sad it is that I need all this crap bolted onto my system just so I can browse fanfics.

Re:Unknown? (1)

Psychotria (953670) | more than 5 years ago | (#25993901)

Sure, but as a user... I get sick of both. I just want something that detects "bad stuff", and doesn't tell me when it finds "good stuff", or at least doesn't remind me every day how sad it is that I need all this crap bolted onto my system just so I can browse fanfics.

Yeah I agree. But my firewall doesn't do that, so I think I misunderstood what you were getting at. Alerting the user about "good stuff" is a bit silly. Obviously when I first set up a firewall lots of good stuff gets queried and logged, but after a few days this should go away (after "training" the firewall).

Re:Unknown? (5, Informative)

spinkham (56603) | more than 5 years ago | (#25993661)

Try NOD32. The scanner that actually got top ratings in this test, for finding the highest number of viri without ungodly number of false positives. I've used it for a few years, and it's fast and has a good track record on virus tests. Can't recommend enough.

Re:Unknown? (1)

tbcpp (797625) | more than 5 years ago | (#25994085)

+1 for NOD32 it rocks

Re:Unknown? (1)

b0bby (201198) | more than 5 years ago | (#25994851)

Yeah, I switched to NOD32 a few years ago after first seeing someone on /. mention it. Been happy with it ever since. My biggest praise for it is that a lot of the users don't even know we're running an antivirus program, despite the little tray icon. We scan our email externally and run squidguard, so there isn't really much for it to do, but it catches stuff once in a while.

Re:Unknown? (0)

Anonymous Coward | more than 5 years ago | (#25995865)

71% vs 54%.
17 vs. 7 false positives, in absolute values...

Great tests, lousy ranking.

Go ahead, use NOD lol

Re:Unknown? (1)

LingNoi (1066278) | more than 5 years ago | (#25994403)

s (Ventrilo doesn't work on linux yet...).

yes it does [winehq.org]

Re:Unknown? (1)

moderatorrater (1095745) | more than 5 years ago | (#25993621)

Okay, how does it detect something that's unknown?

If the program doesn't know about the virus beforehand, saying that the virus was unknown to it makes complete sense.

I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested."

That's just a rewrite of the current headline. Heuristic algorithms are there to match the viruses that aren't specifically known about and scanned for.

Re:Unknown? (0)

Anonymous Coward | more than 5 years ago | (#25993785)

www.eucardsharing.com. Join us there and we can all help each other.

Re:Unknown? (1)

MMC Monster (602931) | more than 5 years ago | (#25994073)

A good test would be to take the AV package, update it to the latest version, disconnect it from the internet for 6 months, and then reconnect to the internet and run the test without letting it update again.

Direct Link to results (1, Informative)

phantomcircuit (938963) | more than 5 years ago | (#25993315)

http://www.av-comparatives.org/seiten/ergebnisse_2008_08.php [av-comparatives.org]
http://www.av-comparatives.org/seiten/ergebnisse_2008_11.php [av-comparatives.org]

The tables are in a horrible colors for some reason.

Re:Direct Link to results (0)

Anonymous Coward | more than 5 years ago | (#25993409)

The site seems to block direct linking...and gives you a 404. Now that's fucking stupid.

Re:Direct Link to results (2, Funny)

girlintraining (1395911) | more than 5 years ago | (#25993467)

The site seems to block direct linking...and gives you a 404. Now that's fucking stupid.

I second that motion. Let bombing begin in 10 minutes.

Re:Direct Link to results (1)

clone53421 (1310749) | more than 5 years ago | (#25993675)

I visited both pages via copy-paste. Who's with me?

firewall (0, Troll)

amclay (1356377) | more than 5 years ago | (#25993373)

I use a firewall. Thats about it. It blocks unknown incoming traffic. Only stupid people get viruses anymore.

Re:firewall (0)

Anonymous Coward | more than 5 years ago | (#25993445)

thats what i thought until i downloaded avg free (which is free btw). evidently trainers downloaded from gamecopyworld can have malware in them along with crackz from the same source. and word/excel documents sent by respectable businesses in the fortune 500 list. even inventory control systems from the same sources. and flash drives (blank). whodathunkit ?

Re:firewall (1)

floodo1 (246910) | more than 5 years ago | (#25993607)

Yeah, because no file you ever download could have a virus in it. Seriously, firewalls are for protecting network connections and AV is for protecting files.

Re:firewall (1)

mini me (132455) | more than 5 years ago | (#25994367)

He claims his firewall blocks all unknown incoming traffic. It would be impossible for him to download a file with a virus as that would be considered unknown incoming traffic.

Re:firewall (1)

Psychotria (953670) | more than 5 years ago | (#25995169)

He claims his firewall blocks all unknown incoming traffic. It would be impossible for him to download a file with a virus as that would be considered unknown incoming traffic.

No offence, but what are you talking about? The incoming file is known traffic, yes. Whether or not that file is a virus or contains a trojan is not known at all by the firewall (and nor should it know or care). It would be perfectly possible to download a file with a virus in it because it's not the virus that the firewall is letting through... it's the file.

Missing some market leaders (3, Insightful)

nicolaiplum (169077) | more than 5 years ago | (#25993443)

This is an interesting test, but some market leaders are missing, notably Trend (El Reg quotes Gartner saying Trend has 13.8% market share, third after Symantec and McAfree [theregister.co.uk] ). If I am to use this research to pick a solution or to pick a better solution, the chances are high that someone in the management is going to "suggest" (try to make me use...) "Trend" because they've heard of it; if they suggest "McAfee" I can use this research to shoot that down, but not Trend.
Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried, and I consider it worth testing because of its different development methodology with undoubtedly different strengths and weaknesses compared to the big commercial AV vendors.
So it's all very interesting but not entirely useful to me.

Re:Missing some market leaders (3, Interesting)

girlintraining (1395911) | more than 5 years ago | (#25993647)

It could be because Trend Microsystems has gone after people who have tried to benchmark their software in the past, claimed to have exclusive patents to the very concept of antivirus scanning, etc. They don't exactly have a great reputation for supporting fair marketing and being open about how their product works... Witness how many legitimate products get flagged as "hacker tools" (like Angry IP Scanner), while their commercial counterparts are ignored (ostensibly after paying them off to get off their little black list).

I say, it could be.

Re:Missing some market leaders (1)

nametaken (610866) | more than 5 years ago | (#25994049)

My symantec corporate edition flags Angry IP Scanner as well.

Re:Missing some market leaders (2, Insightful)

Psychotria (953670) | more than 5 years ago | (#25994107)

Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried...

I also like ClamAV (see my post above). I use it from my linux machines to scan my Windows machines when they're "offline". Had to write a script to get it to work how I wanted... but that's the beauty of the command line.

I believe that there's a GUI front-end for ClamAV as well (klamav I think it's called). I haven't tried it and I think it's still in early development, but I guess I'll check it out one day just for interests sake.

Re:Missing some market leaders (1)

Phroggy (441) | more than 5 years ago | (#25995019)

ClamWin doesn't support on-access scanning [clamwin.com] , so it's currently a non-option for a lot of people.

Of course if you're not supporting Windows desktops, you're free to use whatever you like.

Now If only . . . (3, Interesting)

Cyberllama (113628) | more than 5 years ago | (#25993457)

. . . someone could find a way to get rid of its horrible "zomg hackers are after you, give us some monies" pop-up that comes up at 10:30 every tonight and alt-tabs me out of anything else I might be doing. I realize the free version is free, and apparently that pop-up ad justifies, but *must* it also alt-tab me out of games? That's pretty obnoxious.

Re:Now If only . . . (2, Interesting)

clone53421 (1310749) | more than 5 years ago | (#25993701)

That's enough to ensure that I will never install it.

Re:Now If only . . . (0)

Anonymous Coward | more than 5 years ago | (#25995029)

You can disable the popups. http://www.elitekiller.com/files/disable_antivir_nag.htm explains how pretty well.

Re:Now If only . . . (1)

jacob.lcl (1424135) | more than 5 years ago | (#25994975)

Create a software restriction policy path rule to deny C:/..../avnotify.exe. Problem solved.

Why so low? (0)

Anonymous Coward | more than 5 years ago | (#25993495)

Why are these numbers so low? 67%? 30%?

If these malware are "known", why haven't the anti-virus/malware companies jumped all over them? I get a database update on my AV at least once a week (often daily), and an engine upgrade every month or two - shouldn't these be included on one of them? I would have expected the differences to be 99% coverage vs 95% or similar.

Something seems fishy to me; I have a hard time believing that AV-Comparatives somehow have access to hundreds of malware which the AV companies don't have/can't detect.

Re:Why so low? (1)

kneemoe (1042818) | more than 5 years ago | (#25993531)

Because we aren't talking about 'known' we're talking about *unknown* threats.......

Re:Why so low? (0)

Anonymous Coward | more than 5 years ago | (#25994159)

Something seems fishy to me; I have a hard time believing that you somehow have access to millions of braincells which don't know how to read.

TFA paints a more complete picture (5, Informative)

floodo1 (246910) | more than 5 years ago | (#25993539)

It's worth pointing out that when you take false positives into account Eset Nod32 becomes the only AV solution to achieve the "Advanced+" rating. Apparently it detects 20% fewer "unknown" threats but had only 7 false positives, compared with 17 for AntiVir. This places AntiVir in the same category ("Advanced") as Kaspersky, Mircosoft, Symantec, McAfee, and GData. Hopefully people bother to read the TFA, and not just this /. article

Re:TFA paints a more complete picture (4, Funny)

street struttin' (1249972) | more than 5 years ago | (#25994067)

Why read the article? You just told us what we'd miss if we didn't.

Re:TFA paints a more complete picture (1)

jinx_ (88343) | more than 5 years ago | (#25994285)

It's worth pointing out that when you take false positives into account Eset Nod32 becomes the only AV solution to achieve the "Advanced+" rating.

it's also worth pointing out that avira's 17 false positives when looking at 46,000 files is pretty damn small. i think i'll take the 17 false positives over the 7 false positives knowing that it caught 20% more of the REAL threats any day.

so what if you miss out on that "legit" ecard.exe your grammy mailed you because avira thought it was fishy...? nod32 has a higher chance of letting the real malware through while avira is more likely to stop it.

i wonder which company is employing real researchers and which company is riding on the output of virustotal.com.

Re:TFA paints a more complete picture (1)

b0bby (201198) | more than 5 years ago | (#25994943)

It also says that with default settings Avira would have less false positives but still detect over 50%. So I'm guessing you can tune the aggressiveness of Avira. I'm still happy with NOD32; these tests can never be comprehensive, and no program will ever be perfect.

Free Stuff (1)

FuturePastNow (836765) | more than 5 years ago | (#25993639)

I've been switching between the different free AV software to see which I liked, and I have mixed feelings about Avira Antivir.

On the one hand, it found a trojan on my computer that AVG and Clamwin had both missed. On the other hand, it seems to have really limited options. For example, I can't get it to scan only my PC's internal drives, without also scanning my terabyte external drive, which takes forever. Avira also pops up a window advertising the pro version periodically.

AVG 8 sucks system resources and ClamWin couldn't detect a virus if it punched it in the face. I guess I'll try Avast next.

Re:Free Stuff (1)

VJ42 (860241) | more than 5 years ago | (#25993993)

I've been switching between the different free AV software to see which I liked, and I have mixed feelings about Avira Antivir.

On the one hand, it found a trojan on my computer that AVG and Clamwin had both missed. On the other hand, it seems to have really limited options. For example, I can't get it to scan only my PC's internal drives, without also scanning my terabyte external drive, which takes forever. Avira also pops up a window advertising the pro version periodically.

AVG 8 sucks system resources and ClamWin couldn't detect a virus if it punched it in the face. I guess I'll try Avast next.

I recently switched from Antivir to avast! after getting annoyed with it; I can't say that I've noticed a huge difference in system performance, I've not had any viruses and I' finally rid of that damn popup that Antivir kept shoving in my face after every update. I personally like it better, and though I've never tried it the settings seem indicate that you can choose which discs to scan like you want.

Re:Free Stuff (1)

sh33333p (1186531) | more than 5 years ago | (#25994695)

Actually, if you go to Local Protection->Scanner->Manual Selection, you can select individual drives to scan. If you only want to scan specific directories, right click on them in windows explorer. Avira uses avnotify.exe to display a pop-up ad only when it updates virus defs, which should be once a day. If you have XP pro, you can software restriction policies to block this program from ever running, without impacting the definition updates. I've tested Avast, and it's less efficient than Avira with system resources, while providing (from what I have seen from AVcomparitives) a worse detection rate. My advise is to stick with Avira if you want a free AV, until something better comes along. If I was to buy an AV, it would be Eset Nod32, hands down. Much lighter than anything else I tested while often delivering better protection than any of the bigger brand name products.

False positives (3, Informative)

Thelasko (1196535) | more than 5 years ago | (#25993681)

The summary left out some important information. From TFA:

...the samples detection rates are only one of the two elements evaluated for the antivirus final classification, being the number of false positives the other. Rising a false alarm about a malware on a legit software can cause as much troubles like a real infection, the report states, and it is for this reason that AVIRA, Kaspersky and other products, even if they have obtained very good results in identifying samples, have been penalized with a lower classification.

So the certification level ADVANCED+ has been achieved by ESET NOD32 only, that has detected 20% less of the samples that AVIRA AntiVir has discovered but has triggered only 7 false alarms.

SELinux... (1)

V!NCENT (1105021) | more than 5 years ago | (#25993691)

Best against unknown viruses...

And you Windows users know it but oh... the pain... the pain...

Re:SELinux... (0)

Anonymous Coward | more than 5 years ago | (#25993919)

As we speak, sealert on F10 just generated these. The log is full of them. Am I hacked? Nope, just annoyed.

SELinux is preventing npviewer.bin (nsplugin_t) "write" to ./.fontconfig (unlabeled_t).
SELinux is preventing evince (nsplugin_t) "getattr" to /home/dwb/.gnome2 (unlabeled_t).

Also, sealert is showing 19MB of _resident_ memory in top. It is often one of the real piggies on my Gnome desktop, and that's saying something. Question is: WHY?

Re:SELinux... (1)

V!NCENT (1105021) | more than 5 years ago | (#25994311)

Why? F10 (I am using Fedora for the first time in my life, but haven't ran into problems yet although I am using the KDE4 spin) has a stricter SEL policy then F9.

My antivirus research for my IT department (2, Informative)

Khopesh (112447) | more than 5 years ago | (#25993783)

We use Kaspersky for Windows systems at work (and ClamAV on Linux for mail, though that might change to Kaspersky as I believe we have a license for it). When employees ask if they can use our licenses for their personal machines, I point them at Avira AntiVir because it's about as good and it's FREE FOR PERSONAL USE (although the free version has less spyware detection). It blows AVG out of the water.

Here are some useful links from my research, which included the above site:

From the Wikipedia links and other research that I didn't bother to note to my colleagues (who were also doing this research), I determined that Kaspersky's software was among the most efficient and CPU-friendly. It's only downside was a less-than-optimal user interface, especially on the administrative side for the corporate product. We didn't mind its UI flaws in the free trial period, so we purchased it. We're still happy with it several months later.

The main arguments for our switching from Trend Micro were that it was slow, had poor performance, missed several viruses, we wanted to boycott [slashdot.org] it, and we were tied to a very old version (since it out-performs the newer ones in reviews). Arguments for switching to Kaspersky included: it doesn't feel bloated (remember when that was the norm?), great performance, well received across the board in reviews, dirt cheap (new licenses are 70% the current renewal cost of Trend Micro, which is an ever-growing target), we liked the UI that prevented reviewers from giving it a perfect score, and it's the de-facto number one scanner in Russia and surrounding area (you know, where all the viruses come from?). Kaspersky is also growing rapidly in deployments; you can now get computers installed with it.

Re:My antivirus research for my IT department (3, Interesting)

St. Alfonzo (1393181) | more than 5 years ago | (#25993885)

"[...]it's the de-facto number one scanner in Russia and surrounding area (you know, where all the viruses come from?)."

Ignoring the assumption that all viruses come from Russia, wouldn't that make it more likely that the virus developers would make sure their viruses can evade detection under it?

Re:My antivirus research for my IT department (1)

Khopesh (112447) | more than 5 years ago | (#25994573)

Ignoring the assumption that all viruses come from Russia, wouldn't that make it more likely that the virus developers would make sure their viruses can evade detection under it?

First, that assumption was a joke. My humblest apologies if that offended anybody. Second, it's a common practice to not "pee in your own pool," which is to say that viruses are written for a target, which should not include the writers' personal systems (since they know better). The assumption that I am making is that this target is more likely to be one or more of the top three anti-virus solutions (McAfee, Symantec, Trend Micro).

Furthermore, the areas Kaspersky is developed and popular in could be viewed as having a larger number of people who may have had sophomoric experience writing viruses but who have since reformed. That means that their personal background might make them quite qualified to choose an anti-virus solution. It also means that Kaspersky has a better pool of applicants when hiring developers than the competition.

I can also attest to the results of Soviet education helping here; my company's offshore developers in ex-Soviet regions are very well prepared for software development. I have friends and I've had (on-shore) co-workers who also fit this bill.

Re:My antivirus research for my IT department (2, Interesting)

Khopesh (112447) | more than 5 years ago | (#25995125)

I got so entangled in defending my joke assumption that I forgot one of the real reasons I liked Kaspersky's headquartering in Russia: It's not in America or any of its corporation-friendly, overprotective, terrorist-fearing peers, and it's not in a nation that is easily bullied by America, its peers, or corporations.

This means it doesn't need some "Homeland Security" back-door, it doesn't need to turn a blind eye to corporate root-kits and other DRM-enforcers, and it can be harsh on corporate spyware.

Re:My antivirus research for my IT department (2, Interesting)

swb (14022) | more than 5 years ago | (#25994883)

Ha! I work for Kaspersky reseller, and while I find it to be much more effective than other products, it still has problems.

The default settings want to do CriticalArea and StartupItem scans when you boot your machine, and this makes the icky Windows-is-slow-at-startup even worse. We've also had a couple of problems with updates crippling the client, and worse, the Exchange product.

The first couple of client problems were with older 6.x clients not taking updates, we updated them to newer application versions and it fixed the updating problem. This summer there was an update that literally crippled the client; Kaspersky came out with a fix, but by that time I'd already just removed and reinstalled.

The Exchange AV product has had bad updates that cause it to shut down store.exe. This is a huge show stopper, naturally, and its happened more than once.

The AdminKit is a hot mess, too.

I'd like to see us do some NOD32 installs, I seem to hear good things about it.

Re:My antivirus research for my IT department (1)

Khopesh (112447) | more than 5 years ago | (#25995055)

You'll find crap in any of the vendors. Hell, the whole industry is a con; this is one of the few items that actually SHOULD be bundled into the operating system (IMHO), and the fact that Windows Update doesn't have it built-in is a comedic result of the anti-trust issues Microsoft has earned from its abuse of that concept in other areas.

Yes, Kaspersky's defaults on those two areas are stupid. Fortunately for my company, I can change that on the server so that new installs never need to worry about it. The fact that AdminKit uses MMC rather than its own UI is also host to a ton of issues, and I'm still waiting for a web-based administration option (like with Trend Micro, but hopefully without requiring ActiveX).

I never did understand hosting mail on a Windows server... Exchange may be nice, but I don't intend to ever find out.

NOD32, BitDefender, and Avira all look just as viable as Kaspersky. I'm sure each one has its own baggage. Good luck.

Re:My antivirus research for my IT department (1)

duplicate-nickname (87112) | more than 5 years ago | (#25995583)

We when through the same process as the parent post (replacing Trendmicro Officescan as it has gone to crap). I ended up deciding on NOD32 over Kaspersky, but they were two we liked best. NOD32 has had a few minor problems, and the initial configuration can be time consuming, but overall it is a huge improvement over Trend at a considerably better price.

With Trend, it frequently missed malware and viruses but NOD32 has been great (our infection rate is probably 10% of what it used to be).

fir5t (-1, Troll)

Anonymous Coward | more than 5 years ago | (#25993899)

locating #GnAA, [goat.cx]

Bogus rehash - don't bother. (2, Interesting)

lancejjj (924211) | more than 5 years ago | (#25994041)

Do we really need yet another analysis that talks about the same exact products on the same exact platforms?

Instead of a focus on complete information security, this kind of analysis, once again, ignores BlackBerry and Macintosh and Linux - some very common platforms that are growing in both the enterprise and home markets. How a repeated focus on the most commonly discussed platform helps anyone is a mystery. It just continues to say "all these products are different, we rank them according to our exclusive analysis." Are you going to switch AV vendor given their unconvincing analysis? Not likely.

In the end, the analysis sounds hollow; "My AV software isn't on the top of their list". Given their strategy, who cares?

The self-declared "security experts" completely miss the point by completely ignoring platforms other than Windows. Sure, perhaps the BlackBerry is only found in 70% of corporate environments, and the Mac only has 7% market penetration, and Linux is perhaps only 20% of back-end servers - but I'd fathom that nearly 95% of the businesses out there use one of these platforms and need them to be SECURE - in order to keep their corporate (or personal) data and networks safe.

All these "security experts" are failing their potential customers by rehashing the same discussion, instead of analyzing products and methods that address the mostly unhandled attack vectors of other mission-critical platforms.

What about the free versions? (1)

gelfling (6534) | more than 5 years ago | (#25994115)

Avira, Bitdefender, Avast and others have free and fee versions. What are the material differences?

The truly paranoid windows user... (0)

Anonymous Coward | more than 5 years ago | (#25994139)

...will take the system offline every so often and scan with multiple antivirus programs in a different OS environment, like linux.

How does scanning a running operating system for viruses even cause a dent? Most viruses that I've ever seen have a tendency to hide and/or protect itself from antivirus software. The software is usually completely helpless on an already infected system.

I recommend an offline scanning solution like TRK [trinityhome.org] for an already infected system.

Yay for uber-dorks (1)

cavemanf16 (303184) | more than 5 years ago | (#25994147)

I downloaded one of the reports from this AV testing company/lab. Yeah, their report used Courier New throughout. Seriously, it's not that hard to just use the default Times New Roman or Arial fonts for reports. I don't expect perfection in presentation, but to intentionally choose a difficult-to-read font because it's what programmers use on the command line reeks of annoying.

What about the other types of malware? (1)

BoogieChile (517082) | more than 5 years ago | (#25995127)

Are there any similar types of reports for the other types of malware?

A comparison of products that protect against the types of malware targetted by the like of MalwareBytes, AdAware and Spybot would be really handy.

Conflict of Interest? (0)

Anonymous Coward | more than 5 years ago | (#25995381)

I wonder if there is a conflict of interest in AV-Comparatives' reporting.

They are an Austrian company that has recommended a German company with Austrian subsidiary.

Probably nothing but a coincidence that matters not.

+1 for NOD32 is you have to use a Microscrap Windows product.

+1 for just using a flavor of Linux.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>