Slashdot Log In
Against Unknown Viruses, Avira AntiVir the Winner For Now
Posted by
timothy
on Thu Dec 04, 2008 02:37 PM
from the evolving-bleakosystem dept.
from the evolving-bleakosystem dept.
KingofGnG writes "AV-Comparatives, the Austrian team of experts dedicated to antivirus tests acknowledged as a reference point in the field, has published the second part of the mid-year comparative, an ideal addendum to the one already released last September. This time the aim is to evaluate the antimalware tools' effectiveness against unknown threats in a test scenario meant to prove the heuristic part and the generic markers of the on-demand scanning engines." The best in show (of 16 anti-malware packages evaluated), Avira AntiVir was able to find 71% of the unknown malware it was exposed to in the first week, dropping to 67% after the fourth.
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
mine is better (Score:5, Funny)
My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...
Re:mine is better (Score:4, Insightful)
I'm really glad the last sentence of that post was a joke instead of "I run Linux."
Parent
I can do 100% (Score:3, Funny)
Re: (Score:2)
Turning off and unplugging your computer?
Re:mine is better (Score:5, Funny)
My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...
Sounds like my sex life: My anti-STD solution is great. It blocks 100% of all known and unknown STD's. Just don't ask what my human-to-human sexual encounter rate is... :(
Parent
Re: (Score:3, Funny)
Just don't ask what my human-to-human sexual encounter rate is...
Fair enough, but I am curious as to what your human-to-dog sexual encounter rate is?
What? It's a fair question, he left it wide open to interpretation.
=Smidge=
Re:mine is better (Score:4, Funny)
human-to-dog sexual encounter [...] Had that happen to me in Canada at a balmy -30 Celsius.
Yikes!
Parent
Re: (Score:3, Insightful)
Ah, good old duct tape. Is there any problem it can't fix?
Your married... (Score:5, Informative)
What about my married?
Because I can't see your married. Where did you hide it?
-- A formed babby
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Re:mine is better (Score:5, Informative)
This one comment demonstrates why the entire article is bogus. Thanks.
If you actually read the fine article it goes on to note Avira's high rate of false positives and recommends NOD32 instead.
Parent
Re: (Score:3, Interesting)
Is there a free version of NOD32? Antivir is still free (albeit with occasional ad pop-ups) for the home version. It also have a very small footprint. How's NOD32's footprint?
Re: (Score:3, Informative)
There is no free version so far as I know.
I have only been using NOD for a few weeks... so far so good.
I was stuck with a Panda solution at work for a couple of years, NOD feels far advanced of that suite.
The nicest thing I have noticed so far is the NOD interface and presentation of options, so my opinion basically boils down to YMMV.
As far as footprints go, I rebooted this machine 29 hours ago according to task manager. The NOD kernel has utilized 28 seconds of processor time.
I just spawned an on-demand
Re: (Score:3, Insightful)
You must be new here.
Re:mine is better (Score:5, Interesting)
still, i think a better (more useful) test would be conducted by:
i suspect that preventative education/training is probably the most effective method of combating viruses & malware. and though it might not be cost-effective in the short-term, it might be cheaper to train long-term employees how to avoid viruses/malware than to pay for yearly-subscriptions and still suffer down-time and loss of productivity from infections.
Parent
yay (Score:2)
i've been using antivir for the past 2 years on vista and xp. solid, good antivirus
Re: (Score:2)
MalwareBytes? (Score:5, Informative)
Unknown? (Score:5, Insightful)
Okay, how does it detect something that's unknown? I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested." But perhaps that's too techie and we should go with "zomg! finds viruses and kills zem dead! nom nom nom." :)
In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner. But it sure does slow the machine down, as I'm sure many techies out there reading this from work will know by the curse word "Norton." And if I were a virus writer, I would have every antivirus product in my lab running to test against before releasing it as a matter of course. Could it be this thing is only effective because most virus writers haven't heard of it?
Re: (Score:2)
In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner.
I have. Any "packed" EXE apparently triggers a shitfit in AVG and Antivir. even known good ones (written myself, compiled and packed myself) throw up a warning about whatever the AV in question calls a "packed trojan"
Still, gotta use SOMETHING on windows (Ventrilo doesn't work on linux yet...). But when AVG rapes performance and Antivir launches popups with every update... it's easy to get disheartened.
Re:Unknown? (Score:5, Informative)
Parent
More evidence for a white list. (Score:4, Insightful)
I'm still waiting for one of the anti-virus vendors to just start implementing a white list to cut down on the false positives.
It's not really a "virus detector" if it hits more often on non-viruses on your system. It's a "new software is being installed" detector.
Parent
Re: (Score:2)
ClamAV also marks malformed .exe and encrypted compressed files (archives) as potential malware. I am not sure if this is a good thing or a bad thing. I run clamav on my linux box and use it to scan my XP box (that I use for games). Some of the things are legitimate system (or service pack) files. Fortunately I know this and don't delete them. I can envisage a situation though where I don't know whether the file is OK or not, and in this case the agressive "hueristics" will do nothing but plant FUD.
In regar
Re: (Score:2)
Sure, but as a user... I get sick of both. I just want something that detects "bad stuff", and doesn't tell me when it finds "good stuff", or at least doesn't remind me every day how sad it is that I need all this crap bolted onto my system just so I can browse fanfics.
Yeah I agree. But my firewall doesn't do that, so I think I misunderstood what you were getting at. Alerting the user about "good stuff" is a bit silly. Obviously when I first set up a firewall lots of good stuff gets queried and logged, but after a few days this should go away (after "training" the firewall).
Re: (Score:2)
Okay, how does it detect something that's unknown?
If the program doesn't know about the virus beforehand, saying that the virus was unknown to it makes complete sense.
I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested."
That's just a rewrite of the current headline. Heuristic algorithms are there to match the viruses that aren't specifically known about and scanned for.
Re: (Score:2)
A good test would be to take the AV package, update it to the latest version, disconnect it from the internet for 6 months, and then reconnect to the internet and run the test without letting it update again.
Direct Link to results (Score:2, Informative)
http://www.av-comparatives.org/seiten/ergebnisse_2008_08.php [av-comparatives.org]
http://www.av-comparatives.org/seiten/ergebnisse_2008_11.php [av-comparatives.org]
The tables are in a horrible colors for some reason.
Re: (Score:2, Funny)
The site seems to block direct linking...and gives you a 404. Now that's fucking stupid.
I second that motion. Let bombing begin in 10 minutes.
Re: (Score:2)
I visited both pages via copy-paste. Who's with me?
Missing some market leaders (Score:4, Insightful)
This is an interesting test, but some market leaders are missing, notably Trend (El Reg quotes Gartner saying Trend has 13.8% market share, third after Symantec and McAfree [theregister.co.uk]). If I am to use this research to pick a solution or to pick a better solution, the chances are high that someone in the management is going to "suggest" (try to make me use...) "Trend" because they've heard of it; if they suggest "McAfee" I can use this research to shoot that down, but not Trend.
Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried, and I consider it worth testing because of its different development methodology with undoubtedly different strengths and weaknesses compared to the big commercial AV vendors.
So it's all very interesting but not entirely useful to me.
Re: (Score:3, Interesting)
It could be because Trend Microsystems has gone after people who have tried to benchmark their software in the past, claimed to have exclusive patents to the very concept of antivirus scanning, etc. They don't exactly have a great reputation for supporting fair marketing and being open about how their product works... Witness how many legitimate products get flagged as "hacker tools" (like Angry IP Scanner), while their commercial counterparts are ignored (ostensibly after paying them off to get off their l
Re: (Score:2)
My symantec corporate edition flags Angry IP Scanner as well.
Re: (Score:3, Insightful)
Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried...
I also like ClamAV (see my post above). I use it from my linux machines to scan my Windows machines when they're "offline". Had to write a script to get it to work how I wanted... but that's the beauty of the command line.
I believe that there's a GUI front-end for ClamAV as well (klamav I think it's called). I haven't tried it and I think it's still in early development, but I guess I'll check it out one day just for interests sake.
Now If only . . . (Score:4, Interesting)
. . . someone could find a way to get rid of its horrible "zomg hackers are after you, give us some monies" pop-up that comes up at 10:30 every tonight and alt-tabs me out of anything else I might be doing. I realize the free version is free, and apparently that pop-up ad justifies, but *must* it also alt-tab me out of games? That's pretty obnoxious.
Re: (Score:3, Interesting)
That's enough to ensure that I will never install it.
Re: (Score:3, Informative)
TFA paints a more complete picture (Score:5, Informative)
Re:TFA paints a more complete picture (Score:5, Funny)
Parent
Free Stuff (Score:2)
I've been switching between the different free AV software to see which I liked, and I have mixed feelings about Avira Antivir.
On the one hand, it found a trojan on my computer that AVG and Clamwin had both missed. On the other hand, it seems to have really limited options. For example, I can't get it to scan only my PC's internal drives, without also scanning my terabyte external drive, which takes forever. Avira also pops up a window advertising the pro version periodically.
AVG 8 sucks system resources an
Re: (Score:2)
I've been switching between the different free AV software to see which I liked, and I have mixed feelings about Avira Antivir.
On the one hand, it found a trojan on my computer that AVG and Clamwin had both missed. On the other hand, it seems to have really limited options. For example, I can't get it to scan only my PC's internal drives, without also scanning my terabyte external drive, which takes forever. Avira also pops up a window advertising the pro version periodically.
AVG 8 sucks system resources and ClamWin couldn't detect a virus if it punched it in the face. I guess I'll try Avast next.
I recently switched from Antivir to avast! after getting annoyed with it; I can't say that I've noticed a huge difference in system performance, I've not had any viruses and I' finally rid of that damn popup that Antivir kept shoving in my face after every update. I personally like it better, and though I've never tried it the settings seem indicate that you can choose which discs to scan like you want.
False positives (Score:4, Informative)
My antivirus research for my IT department (Score:3, Informative)
We use Kaspersky for Windows systems at work (and ClamAV on Linux for mail, though that might change to Kaspersky as I believe we have a license for it). When employees ask if they can use our licenses for their personal machines, I point them at Avira AntiVir because it's about as good and it's FREE FOR PERSONAL USE (although the free version has less spyware detection). It blows AVG out of the water.
Here are some useful links from my research, which included the above site:
From the Wikipedia links and other research that I didn't bother to note to my colleagues (who were also doing this research), I determined that Kaspersky's software was among the most efficient and CPU-friendly. It's only downside was a less-than-optimal user interface, especially on the administrative side for the corporate product. We didn't mind its UI flaws in the free trial period, so we purchased it. We're still happy with it several months later.
The main arguments for our switching from Trend Micro were that it was slow, had poor performance, missed several viruses, we wanted to boycott [slashdot.org] it, and we were tied to a very old version (since it out-performs the newer ones in reviews). Arguments for switching to Kaspersky included: it doesn't feel bloated (remember when that was the norm?), great performance, well received across the board in reviews, dirt cheap (new licenses are 70% the current renewal cost of Trend Micro, which is an ever-growing target), we liked the UI that prevented reviewers from giving it a perfect score, and it's the de-facto number one scanner in Russia and surrounding area (you know, where all the viruses come from?). Kaspersky is also growing rapidly in deployments; you can now get computers installed with it.
Re: (Score:3, Interesting)
Ignoring the assumption that all viruses come from Russia, wouldn't that make it more likely that the virus developers would make sure their viruses can evade detection under it?
Re: (Score:3, Interesting)
This means it doesn't need some "Homeland Security" back-door, it doesn't need to turn a blind eye to corporate root-kits and other DRM-enforcers, and it can be harsh on corporate spyware.
Re: (Score:3, Interesting)
Ha! I work for Kaspersky reseller, and while I find it to be much more effective than other products, it still has problems.
The default settings want to do CriticalArea and StartupItem scans when you boot your machine, and this makes the icky Windows-is-slow-at-startup even worse. We've also had a couple of problems with updates crippling the client, and worse, the Exchange product.
The first couple of client problems were with older 6.x clients not taking updates, we updated them to newer application vers
Bogus rehash - don't bother. (Score:3, Interesting)
Do we really need yet another analysis that talks about the same exact products on the same exact platforms?
Instead of a focus on complete information security, this kind of analysis, once again, ignores BlackBerry and Macintosh and Linux - some very common platforms that are growing in both the enterprise and home markets. How a repeated focus on the most commonly discussed platform helps anyone is a mystery. It just continues to say "all these products are different, we rank them according to our exclusive analysis." Are you going to switch AV vendor given their unconvincing analysis? Not likely.
In the end, the analysis sounds hollow; "My AV software isn't on the top of their list". Given their strategy, who cares?
The self-declared "security experts" completely miss the point by completely ignoring platforms other than Windows. Sure, perhaps the BlackBerry is only found in 70% of corporate environments, and the Mac only has 7% market penetration, and Linux is perhaps only 20% of back-end servers - but I'd fathom that nearly 95% of the businesses out there use one of these platforms and need them to be SECURE - in order to keep their corporate (or personal) data and networks safe.
All these "security experts" are failing their potential customers by rehashing the same discussion, instead of analyzing products and methods that address the mostly unhandled attack vectors of other mission-critical platforms.
What about the free versions? (Score:2)
Avira, Bitdefender, Avast and others have free and fee versions. What are the material differences?
Re: (Score:2)
He claims his firewall blocks all unknown incoming traffic. It would be impossible for him to download a file with a virus as that would be considered unknown incoming traffic.
Re: (Score:3, Interesting)
Okey, I will take the time to explain it to you.
1. Set up a honeypot. Catch any number of relatively new viruses with these.
2. Use an AV product with signature files from a date before you started to capture the new viruses.
3. Tadaaa...
4. Of course... profit!
Now, was that so hard to come up with by yourself?