Against Unknown Viruses, Avira AntiVir the Winner For Now

KingofGnG writes "AV-Comparatives, the Austrian team of experts dedicated to antivirus tests acknowledged as a reference point in the field, has published the second part of the mid-year comparative, an ideal addendum to the one already released last September. This time the aim is to evaluate the antimalware tools' effectiveness against unknown threats in a test scenario meant to prove the heuristic part and the generic markers of the on-demand scanning engines." The best in show (of 16 anti-malware packages evaluated), Avira AntiVir was able to find 71% of the unknown malware it was exposed to in the first week, dropping to 67% after the fourth.

mine is better

My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...

Re:mine is better

I'm really glad the last sentence of that post was a joke instead of "I run Linux."

I can do 100%

I don't know, my computer has never had a virus and never will. This TRS-80 Model I Level II runs like a dream. Just have to get the hang of loading and saving programs with the tape cassette player/recorder.

Re:mine is better

My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...

Sounds like my sex life: My anti-STD solution is great. It blocks 100% of all known and unknown STD's. Just don't ask what my human-to-human sexual encounter rate is... :(

Re:

Just don't ask what my human-to-human sexual encounter rate is...

Fair enough, but I am curious as to what your human-to-dog sexual encounter rate is?

What? It's a fair question, he left it wide open to interpretation.

=Smidge=

Re:mine is better

human-to-dog sexual encounter [...] Had that happen to me in Canada at a balmy -30 Celsius.

Yikes!

Your married...

What about my married?

Because I can't see your married. Where did you hide it?

-- A formed babby

Re:

Komodo firewall has technology to only allow white-listed EXE's to run in a "paranoid" mode. It means you have to manually "approve" newly installed programs and updates (or go into installation mode during the update) but it works pretty well.

Re:mine is better

This one comment demonstrates why the entire article is bogus. Thanks.

If you actually read the fine article it goes on to note Avira's high rate of false positives and recommends NOD32 instead.

Re:

You must be new here.

Re:mine is better

still, i think a better (more useful) test would be conducted by:

1. enlisting a 100 or so test subjects from various non-technical (in terms of computer knowledge) backgrounds.
2. give each one of the 9 best-selling anti-virus solutions to 10 different volunteers.
3. give the last 10 volunteers a 2-week course on basic computer security and malware-prevention.
4. subject all 100 subjects to the same gauntlet of viruses/trojans/malware over a 6-month period. (perhaps 4-5 viruses a week, for a total of around 120 threats tested)
5. note how many infections per person each group averaged, how many false-positives each group reported, and how much time/productivity was lost due to the threats & false-positives--for instance, time spent on reboots, reformats, dealing with virus alerts, waiting for anti-virus updates, etc.
6. lastly, measure the cost-effectiveness of the anti-virus solution used in each of the 10 groups.

i suspect that preventative education/training is probably the most effective method of combating viruses & malware. and though it might not be cost-effective in the short-term, it might be cheaper to train long-term employees how to avoid viruses/malware than to pay for yearly-subscriptions and still suffer down-time and loss of productivity from infections.

MalwareBytes?

I'm surprised MalwareBytes isn't on the list. We've come to depend on it for removing zlob from problematic PCs.

Unknown?

Okay, how does it detect something that's unknown? I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested." But perhaps that's too techie and we should go with "zomg! finds viruses and kills zem dead! nom nom nom." :)

In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner. But it sure does slow the machine down, as I'm sure many techies out there reading this from work will know by the curse word "Norton." And if I were a virus writer, I would have every antivirus product in my lab running to test against before releasing it as a matter of course. Could it be this thing is only effective because most virus writers haven't heard of it?

Re:Unknown?

Try NOD32. The scanner that actually got top ratings in this test, for finding the highest number of viri without ungodly number of false positives. I've used it for a few years, and it's fast and has a good track record on virus tests. Can't recommend enough.

More evidence for a white list.

I'm still waiting for one of the anti-virus vendors to just start implementing a white list to cut down on the false positives.

It's not really a "virus detector" if it hits more often on non-viruses on your system. It's a "new software is being installed" detector.

Missing some market leaders

This is an interesting test, but some market leaders are missing, notably Trend (El Reg quotes Gartner saying Trend has 13.8% market share, third after Symantec and McAfree [theregister.co.uk]). If I am to use this research to pick a solution or to pick a better solution, the chances are high that someone in the management is going to "suggest" (try to make me use...) "Trend" because they've heard of it; if they suggest "McAfee" I can use this research to shoot that down, but not Trend.
Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried, and I consider it worth testing because of its different development methodology with undoubtedly different strengths and weaknesses compared to the big commercial AV vendors.
So it's all very interesting but not entirely useful to me.

Re:

It could be because Trend Microsystems has gone after people who have tried to benchmark their software in the past, claimed to have exclusive patents to the very concept of antivirus scanning, etc. They don't exactly have a great reputation for supporting fair marketing and being open about how their product works... Witness how many legitimate products get flagged as "hacker tools" (like Angry IP Scanner), while their commercial counterparts are ignored (ostensibly after paying them off to get off their l

Now If only . . .

. . . someone could find a way to get rid of its horrible "zomg hackers are after you, give us some monies" pop-up that comes up at 10:30 every tonight and alt-tabs me out of anything else I might be doing. I realize the free version is free, and apparently that pop-up ad justifies, but *must* it also alt-tab me out of games? That's pretty obnoxious.

Re:

That's enough to ensure that I will never install it.

Re:

How about this? http://www.tipsfor.us/2007/08/15/make-avira-antivir-free-edition-more-usable/ [tipsfor.us]

TFA paints a more complete picture

It's worth pointing out that when you take false positives into account Eset Nod32 becomes the only AV solution to achieve the "Advanced+" rating. Apparently it detects 20% fewer "unknown" threats but had only 7 false positives, compared with 17 for AntiVir. This places AntiVir in the same category ("Advanced") as Kaspersky, Mircosoft, Symantec, McAfee, and GData. Hopefully people bother to read the TFA, and not just this /. article

Re:TFA paints a more complete picture

Why read the article? You just told us what we'd miss if we didn't.

False positives

The summary left out some important information. From TFA:

...the samples detection rates are only one of the two elements evaluated for the antivirus final classification, being the number of false positives the other. Rising a false alarm about a malware on a legit software can cause as much troubles like a real infection, the report states, and it is for this reason that AVIRA, Kaspersky and other products, even if they have obtained very good results in identifying samples, have been penalized with a lower classification.

So the certification level ADVANCED+ has been achieved by ESET NOD32 only, that has detected 20% less of the samples that AVIRA AntiVir has discovered but has triggered only 7 false alarms.

My antivirus research for my IT department

We use Kaspersky for Windows systems at work (and ClamAV on Linux for mail, though that might change to Kaspersky as I believe we have a license for it). When employees ask if they can use our licenses for their personal machines, I point them at Avira AntiVir because it's about as good and it's FREE FOR PERSONAL USE (although the free version has less spyware detection). It blows AVG out of the water.

Here are some useful links from my research, which included the above site:

• Wikipedia:Antivirus software [wikipedia.org]'s external links are very useful.
• Top 9 Windows Antivirus [about.com], a review at About.com, ranking Avira, Kaspersky, BitDefender, and McAfee as #1, 2, 3, and 4 respectively.
• Virus.gr measured detection rates of tweaked settings [virus.gr], ranking in order: G DATA, F-Secure, TrustPort, then Kaspersky.
• AntiVirus Software Review 2009 - TopTenREVIEWS [toptenreviews.com], ranking in order: BitDefender, Kaspersky, ESET, then AVG.
• Virus Bulletin [virusbtn.com]'s latest test results (no direct ranking).

From the Wikipedia links and other research that I didn't bother to note to my colleagues (who were also doing this research), I determined that Kaspersky's software was among the most efficient and CPU-friendly. It's only downside was a less-than-optimal user interface, especially on the administrative side for the corporate product. We didn't mind its UI flaws in the free trial period, so we purchased it. We're still happy with it several months later.

The main arguments for our switching from Trend Micro were that it was slow, had poor performance, missed several viruses, we wanted to boycott [slashdot.org] it, and we were tied to a very old version (since it out-performs the newer ones in reviews). Arguments for switching to Kaspersky included: it doesn't feel bloated (remember when that was the norm?), great performance, well received across the board in reviews, dirt cheap (new licenses are 70% the current renewal cost of Trend Micro, which is an ever-growing target), we liked the UI that prevented reviewers from giving it a perfect score, and it's the de-facto number one scanner in Russia and surrounding area (you know, where all the viruses come from?). Kaspersky is also growing rapidly in deployments; you can now get computers installed with it.

Re:

"[...]it's the de-facto number one scanner in Russia and surrounding area (you know, where all the viruses come from?)."

Ignoring the assumption that all viruses come from Russia, wouldn't that make it more likely that the virus developers would make sure their viruses can evade detection under it?