Against Unknown Viruses, Avira AntiVir the Winner For Now 170
KingofGnG writes "AV-Comparatives, the Austrian team of experts dedicated to antivirus tests acknowledged as a reference point in the field, has published the second part of the mid-year comparative, an ideal addendum to the one already released last September. This time the aim is to evaluate the antimalware tools' effectiveness against unknown threats in a test scenario meant to prove the heuristic part and the generic markers of the on-demand scanning engines." The best in show (of 16 anti-malware packages evaluated), Avira AntiVir was able to find 71% of the unknown malware it was exposed to in the first week, dropping to 67% after the fourth.
mine is better (Score:5, Funny)
My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...
Re:mine is better (Score:4, Insightful)
I'm really glad the last sentence of that post was a joke instead of "I run Linux."
I can do 100% (Score:3, Funny)
Re: (Score:2)
Turning off and unplugging your computer?
Re:mine is better (Score:5, Funny)
My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...
Sounds like my sex life: My anti-STD solution is great. It blocks 100% of all known and unknown STD's. Just don't ask what my human-to-human sexual encounter rate is... :(
Re: (Score:3, Funny)
Just don't ask what my human-to-human sexual encounter rate is...
Fair enough, but I am curious as to what your human-to-dog sexual encounter rate is?
What? It's a fair question, he left it wide open to interpretation.
=Smidge=
Re:mine is better (Score:4, Funny)
human-to-dog sexual encounter [...] Had that happen to me in Canada at a balmy -30 Celsius.
Yikes!
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Ah, good old duct tape. Is there any problem it can't fix?
Re: (Score:2)
Sounds like my sex life: My anti-STD solution is great. It blocks 100% of all known and unknown STD's. Just don't ask what my human-to-human sexual encounter rate is... :(
I just hope you realize STDs can cross species.
Your married... (Score:5, Informative)
What about my married?
Because I can't see your married. Where did you hide it?
-- A formed babby
Re: (Score:1, Insightful)
This one comment demonstrates why the entire article is bogus. Thanks.
Re: (Score:1, Informative)
This one comment demonstrates why your entire life is bogus.
The tests *do* take into account the false positive rates. I gained this information by reading the article. Maybe you could give this a whirl...? It's novel, I know, but it would stop you looking like a pompus jackass.
And hey - thanks.
Re: (Score:3, Insightful)
You must be new here.
Re:mine is better (Score:5, Informative)
This one comment demonstrates why the entire article is bogus. Thanks.
If you actually read the fine article it goes on to note Avira's high rate of false positives and recommends NOD32 instead.
Re: (Score:3, Interesting)
Is there a free version of NOD32? Antivir is still free (albeit with occasional ad pop-ups) for the home version. It also have a very small footprint. How's NOD32's footprint?
Re: (Score:3, Informative)
There is no free version so far as I know.
I have only been using NOD for a few weeks... so far so good.
I was stuck with a Panda solution at work for a couple of years, NOD feels far advanced of that suite.
The nicest thing I have noticed so far is the NOD interface and presentation of options, so my opinion basically boils down to YMMV.
As far as footprints go, I rebooted this machine 29 hours ago according to task manager. The NOD kernel has utilized 28 seconds of processor time.
I just spawned an on-demand
Re: (Score:2)
NOD32 is the best imo. If you haven't tried it before, give the demo a shot. Be aware that by default some advanced heuristics are turned off, while leaving normal heuristics on. If you turn some of those advanced heuristics on in realtime, you will see performance issues. Bare in mind these are heuristic checks not typically done by most AV and are there for the truly paranoid.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Re: (Score:1)
My custom anti-virus solution is better. It blocks 100% of all known and unknown viruses. Just don't ask what its false positive rate is...
Your solution is a condom on the network interface?
Re:mine is better (Score:5, Interesting)
still, i think a better (more useful) test would be conducted by:
i suspect that preventative education/training is probably the most effective method of combating viruses & malware. and though it might not be cost-effective in the short-term, it might be cheaper to train long-term employees how to avoid viruses/malware than to pay for yearly-subscriptions and still suffer down-time and loss of productivity from infections.
yay (Score:2)
i've been using antivir for the past 2 years on vista and xp. solid, good antivirus
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Most antivirus packages have a nice systray icon for that. It even usually changes colour if something needs attention.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Yep, and of course that ad window goes away completely when you buy it. Avira is one of the less verbose suites out there; I'm not sure what the GP is talking about. He might have it confused with AVG...now that is a pop up happy Antivirus.
Re: (Score:2)
Hmm, a notifier saying "don't worry, all's well!" that appears every stinking day vs. a notifier saying "whoops, I couldn't update!" that appears only when appropriate. Shouldn't the choice be really obvious?
Oh, and as other people have already said... any notifier that appears unbidden and steals focus from full-screen applications is just plain wrong.
Re: (Score:2)
Re: (Score:2)
Yes, manually disabling the annoying behaviour is possible. However, it shouldn't be necessary to cripple software to get it to behave nicely, and once you've killed the automatic reminder, you no longer have the assurance that the automatic update succeeded.
If the stupid reminder was done away with and replaced with an alert that informed you if and only if the update failed, you'd not only not be bothered by the alert, but you'd be assured that the update succeeded because if something was wrong it would
Re: (Score:2)
You can easily change the update notifier so that it just runs minimized.
Re: (Score:2)
Norton is the industry standard for most of the companies I've worked for. I recall when Norton's update caused the dir00001 issue and filled up hard drives. My main gripe with Norton is how many processes it runs and how difficult it is to remove it.
I preferred McAfe
MalwareBytes? (Score:5, Informative)
Re: (Score:2)
Yes, that's the only one I was able to use to help get rid of the pesky Recycled\boot.com virus a couple of weeks back. (It adds a folder called resycled and an autorun.inf, which you can delete, but will recreate itself until you totally clean it out.) That and Crap Cleaner finally got rid of it before it went crazy on my network.
Re: (Score:2)
Unknown? (Score:5, Insightful)
Okay, how does it detect something that's unknown? I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested." But perhaps that's too techie and we should go with "zomg! finds viruses and kills zem dead! nom nom nom." :)
In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner. But it sure does slow the machine down, as I'm sure many techies out there reading this from work will know by the curse word "Norton." And if I were a virus writer, I would have every antivirus product in my lab running to test against before releasing it as a matter of course. Could it be this thing is only effective because most virus writers haven't heard of it?
Re: (Score:2)
In either event, I have yet to have any antivirus product I use detect anything using its built-in heuristic scanner.
I have. Any "packed" EXE apparently triggers a shitfit in AVG and Antivir. even known good ones (written myself, compiled and packed myself) throw up a warning about whatever the AV in question calls a "packed trojan"
Still, gotta use SOMETHING on windows (Ventrilo doesn't work on linux yet...). But when AVG rapes performance and Antivir launches popups with every update... it's easy to get disheartened.
Re: (Score:1)
I have. Any "packed" EXE apparently triggers a shitfit in AVG and Antivir. even known good ones (written myself, compiled and packed myself) throw up a warning about whatever the AV in question calls a "packed trojan"
Okay, sorry -- you are correct. It does throw a hissy-fit over every day things like that. So does my Comodo firewall ("oh noes! You've updated firefox! Are you SURE it isn't a virus?"), and a lot of other products. But I've never had any of these "alerts" home in on a bona fide threat.
More evidence for a white list. (Score:4, Insightful)
I'm still waiting for one of the anti-virus vendors to just start implementing a white list to cut down on the false positives.
It's not really a "virus detector" if it hits more often on non-viruses on your system. It's a "new software is being installed" detector.
Re: (Score:2)
ClamAV also marks malformed .exe and encrypted compressed files (archives) as potential malware. I am not sure if this is a good thing or a bad thing. I run clamav on my linux box and use it to scan my XP box (that I use for games). Some of the things are legitimate system (or service pack) files. Fortunately I know this and don't delete them. I can envisage a situation though where I don't know whether the file is OK or not, and in this case the agressive "hueristics" will do nothing but plant FUD.
In regar
Re: (Score:1)
In regards to firewalls, I think that is the opposite situation. Firewalls (IMO) *should* be paranoid. I don't want a firewall that "knows" what firefox is and what a firefox update is -- why should a firewall need to know this anyway. Keep them simple and err on the side of caution.
Sure, but as a user... I get sick of both. I just want something that detects "bad stuff", and doesn't tell me when it finds "good stuff", or at least doesn't remind me every day how sad it is that I need all this crap bolted onto my system just so I can browse fanfics.
Re: (Score:2)
Sure, but as a user... I get sick of both. I just want something that detects "bad stuff", and doesn't tell me when it finds "good stuff", or at least doesn't remind me every day how sad it is that I need all this crap bolted onto my system just so I can browse fanfics.
Yeah I agree. But my firewall doesn't do that, so I think I misunderstood what you were getting at. Alerting the user about "good stuff" is a bit silly. Obviously when I first set up a firewall lots of good stuff gets queried and logged, but after a few days this should go away (after "training" the firewall).
Re:Unknown? (Score:5, Informative)
Re: (Score:1)
Re: (Score:2)
Yeah, I switched to NOD32 a few years ago after first seeing someone on /. mention it. Been happy with it ever since. My biggest praise for it is that a lot of the users don't even know we're running an antivirus program, despite the little tray icon. We scan our email externally and run squidguard, so there isn't really much for it to do, but it catches stuff once in a while.
Re: (Score:2)
yes it does [winehq.org]
Re: (Score:2)
Wine =! Linux
Re: (Score:2)
WINE is an implementation of the windows libraries to make it work on Linux. You said it doesn't work on Linux, it does work on Linux through WINE.
Re: (Score:2)
It wasn't me who said that WINE != Linux. I'm a big fan of WINE.
That said, the winehq page you linked to rates it bronze, at best. In my experience, that means "Works... barely, if the stars are aligned and the great emulation god Huffi-Muffi-Guffi is pleased with your offerings of beer and virgin goats"
Re: (Score:2)
Okay, how does it detect something that's unknown?
If the program doesn't know about the virus beforehand, saying that the virus was unknown to it makes complete sense.
I think it would be better phrasing to say "this scanning engine has the best heuristic pattern matching algorithms amongst those products tested."
That's just a rewrite of the current headline. Heuristic algorithms are there to match the viruses that aren't specifically known about and scanned for.
Re: (Score:2)
A good test would be to take the AV package, update it to the latest version, disconnect it from the internet for 6 months, and then reconnect to the internet and run the test without letting it update again.
Re: (Score:2)
That's exactly what AV-Comparitives does. The term for the technique is "retrospective testing".
Direct Link to results (Score:2, Informative)
http://www.av-comparatives.org/seiten/ergebnisse_2008_08.php [av-comparatives.org]
http://www.av-comparatives.org/seiten/ergebnisse_2008_11.php [av-comparatives.org]
The tables are in a horrible colors for some reason.
Re: (Score:2, Funny)
The site seems to block direct linking...and gives you a 404. Now that's fucking stupid.
I second that motion. Let bombing begin in 10 minutes.
Re: (Score:2)
I visited both pages via copy-paste. Who's with me?
Missing some market leaders (Score:4, Insightful)
This is an interesting test, but some market leaders are missing, notably Trend (El Reg quotes Gartner saying Trend has 13.8% market share, third after Symantec and McAfree [theregister.co.uk]). If I am to use this research to pick a solution or to pick a better solution, the chances are high that someone in the management is going to "suggest" (try to make me use...) "Trend" because they've heard of it; if they suggest "McAfee" I can use this research to shoot that down, but not Trend.
Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried, and I consider it worth testing because of its different development methodology with undoubtedly different strengths and weaknesses compared to the big commercial AV vendors.
So it's all very interesting but not entirely useful to me.
Re: (Score:3, Interesting)
It could be because Trend Microsystems has gone after people who have tried to benchmark their software in the past, claimed to have exclusive patents to the very concept of antivirus scanning, etc. They don't exactly have a great reputation for supporting fair marketing and being open about how their product works... Witness how many legitimate products get flagged as "hacker tools" (like Angry IP Scanner), while their commercial counterparts are ignored (ostensibly after paying them off to get off their l
Re: (Score:2)
My symantec corporate edition flags Angry IP Scanner as well.
Wrong (Score:2)
Witness how many legitimate products get flagged as "hacker tools" (like Angry IP Scanner)
A port scanner is [computerhope.com] a hacker tool. Of course you can use it for legitimate purposes as you can with many other tools. I can even use a malicious virus as a tool for testing my AV engines. But it is still a virus. If you are in the position to legitimately use a port scanner you obviously should also be in the position to get this program on your machine from being excluded by the corporate antivirus.
Apart from that, if I would discover some of my users to use such a tool without entitlement and the AV engin
Re: (Score:2)
Are you stupid or something? A virus is a virus, and an anti-virus product should find viruses, not everything else that could be objectionable. Why not scan for .MP3 files too and flag those as viruses as long as we're on "corporate"-think.
Re: (Score:3, Insightful)
Meanwhile, to bang the open source drum, they also didn't test Clam AV. I don't know Clam's market share, but I have to say I like it a lot for its ease of integration into my UNIXy infrastructure compared to the commercial ones I've tried...
I also like ClamAV (see my post above). I use it from my linux machines to scan my Windows machines when they're "offline". Had to write a script to get it to work how I wanted... but that's the beauty of the command line.
I believe that there's a GUI front-end for ClamAV as well (klamav I think it's called). I haven't tried it and I think it's still in early development, but I guess I'll check it out one day just for interests sake.
Re: (Score:2)
ClamWin doesn't support on-access scanning [clamwin.com], so it's currently a non-option for a lot of people.
Of course if you're not supporting Windows desktops, you're free to use whatever you like.
Re: (Score:2)
ClamWin is an open source antivirus for Windows that can not scan files in real time, unfortunately. With Winpooch, just associate ClamWin and it will be possible to detect virus in a program before it runs.
http://winpooch.free.fr/page/home.php?lang=en&page=home [winpooch.free.fr]
Re: (Score:2)
According to Wikipedia [wikipedia.org]:
In 2008-06-13, The author has announced he quit developing the program, leaving v0.6.6 incompatible with Windows XP Service Pack 3.
And various other things that suggest it's probably not suitable for corporate use.
Re: (Score:2)
As much as I want to toot the horn for ClamAV, the fact is, it just isn't 'good' compared to the other Windows AV players. I've used it at least a few dozen times over the span of a few years and it just doesn't find as much (harmful) stuff as the other big AVs. (Scanning infected client systems).
Sorry Clam.
Now If only . . . (Score:4, Interesting)
. . . someone could find a way to get rid of its horrible "zomg hackers are after you, give us some monies" pop-up that comes up at 10:30 every tonight and alt-tabs me out of anything else I might be doing. I realize the free version is free, and apparently that pop-up ad justifies, but *must* it also alt-tab me out of games? That's pretty obnoxious.
Re: (Score:3, Interesting)
That's enough to ensure that I will never install it.
Re: (Score:3, Informative)
TFA paints a more complete picture (Score:5, Informative)
Re:TFA paints a more complete picture (Score:5, Funny)
Re: (Score:1)
It's worth pointing out that when you take false positives into account Eset Nod32 becomes the only AV solution to achieve the "Advanced+" rating.
it's also worth pointing out that avira's 17 false positives when looking at 46,000 files is pretty damn small. i think i'll take the 17 false positives over the 7 false positives knowing that it caught 20% more of the REAL threats any day.
so what if you miss out on that "legit" ecard.exe your grammy mailed you because avira thought it was fishy...? nod32 has a higher chance of letting the real malware through while avira is more likely to stop it.
i wonder which company is employing real researchers and w
Re: (Score:2)
It also says that with default settings Avira would have less false positives but still detect over 50%. So I'm guessing you can tune the aggressiveness of Avira. I'm still happy with NOD32; these tests can never be comprehensive, and no program will ever be perfect.
Re: (Score:2)
Yes, but where AV-Comparatives clearly fails, IMHO, is on the point of speed:
They do not take into account, how fast an AV vendor is updating their signature after the release of a new malware specimen. In this category in my experience, some AV vendors are much better then others. E.g. Kaspersky and F-Secure are way better than Symantec in this respective. And for me (and the security of the infrastructure I protect) this is a very important criteria.
Re: (Score:2)
"in this perspective" of course. Grammer Nazis, go away, I know, I know. Mea culpa, mea maxime culpa.
Re: (Score:2)
"in this respect". Two can play this game. ;p
Free Stuff (Score:2)
I've been switching between the different free AV software to see which I liked, and I have mixed feelings about Avira Antivir.
On the one hand, it found a trojan on my computer that AVG and Clamwin had both missed. On the other hand, it seems to have really limited options. For example, I can't get it to scan only my PC's internal drives, without also scanning my terabyte external drive, which takes forever. Avira also pops up a window advertising the pro version periodically.
AVG 8 sucks system resources an
Re: (Score:2)
I've been switching between the different free AV software to see which I liked, and I have mixed feelings about Avira Antivir.
On the one hand, it found a trojan on my computer that AVG and Clamwin had both missed. On the other hand, it seems to have really limited options. For example, I can't get it to scan only my PC's internal drives, without also scanning my terabyte external drive, which takes forever. Avira also pops up a window advertising the pro version periodically.
AVG 8 sucks system resources and ClamWin couldn't detect a virus if it punched it in the face. I guess I'll try Avast next.
I recently switched from Antivir to avast! after getting annoyed with it; I can't say that I've noticed a huge difference in system performance, I've not had any viruses and I' finally rid of that damn popup that Antivir kept shoving in my face after every update. I personally like it better, and though I've never tried it the settings seem indicate that you can choose which discs to scan like you want.
Re: (Score:1)
False positives (Score:4, Informative)
SELinux... (Score:1)
Best against unknown viruses...
And you Windows users know it but oh... the pain... the pain...
Re: (Score:1)
My antivirus research for my IT department (Score:3, Informative)
We use Kaspersky for Windows systems at work (and ClamAV on Linux for mail, though that might change to Kaspersky as I believe we have a license for it). When employees ask if they can use our licenses for their personal machines, I point them at Avira AntiVir because it's about as good and it's FREE FOR PERSONAL USE (although the free version has less spyware detection). It blows AVG out of the water.
Here are some useful links from my research, which included the above site:
From the Wikipedia links and other research that I didn't bother to note to my colleagues (who were also doing this research), I determined that Kaspersky's software was among the most efficient and CPU-friendly. It's only downside was a less-than-optimal user interface, especially on the administrative side for the corporate product. We didn't mind its UI flaws in the free trial period, so we purchased it. We're still happy with it several months later.
The main arguments for our switching from Trend Micro were that it was slow, had poor performance, missed several viruses, we wanted to boycott [slashdot.org] it, and we were tied to a very old version (since it out-performs the newer ones in reviews). Arguments for switching to Kaspersky included: it doesn't feel bloated (remember when that was the norm?), great performance, well received across the board in reviews, dirt cheap (new licenses are 70% the current renewal cost of Trend Micro, which is an ever-growing target), we liked the UI that prevented reviewers from giving it a perfect score, and it's the de-facto number one scanner in Russia and surrounding area (you know, where all the viruses come from?). Kaspersky is also growing rapidly in deployments; you can now get computers installed with it.
Re: (Score:3, Interesting)
Ignoring the assumption that all viruses come from Russia, wouldn't that make it more likely that the virus developers would make sure their viruses can evade detection under it?
Re: (Score:2)
Ignoring the assumption that all viruses come from Russia, wouldn't that make it more likely that the virus developers would make sure their viruses can evade detection under it?
First, that assumption was a joke. My humblest apologies if that offended anybody. Second, it's a common practice to not "pee in your own pool," which is to say that viruses are written for a target, which should not include the writers' personal systems (since they know better). The assumption that I am making is that this target is more likely to be one or more of the top three anti-virus solutions (McAfee, Symantec, Trend Micro).
Furthermore, the areas Kaspersky is developed and popular in could be vie
Re: (Score:3, Interesting)
This means it doesn't need some "Homeland Security" back-door, it doesn't need to turn a blind eye to corporate root-kits and other DRM-enforcers, and it can be harsh on corporate spyware.
Re: (Score:3, Interesting)
Ha! I work for Kaspersky reseller, and while I find it to be much more effective than other products, it still has problems.
The default settings want to do CriticalArea and StartupItem scans when you boot your machine, and this makes the icky Windows-is-slow-at-startup even worse. We've also had a couple of problems with updates crippling the client, and worse, the Exchange product.
The first couple of client problems were with older 6.x clients not taking updates, we updated them to newer application vers
Re: (Score:2)
You'll find crap in any of the vendors. Hell, the whole industry is a con; this is one of the few items that actually SHOULD be bundled into the operating system (IMHO), and the fact that Windows Update doesn't have it built-in is a comedic result of the anti-trust issues Microsoft has earned from its abuse of that concept in other areas.
Yes, Kaspersky's defaults on those two areas are stupid. Fortunately for my company, I can change that on the server so that new installs never need to worry about it. T
Re: (Score:2)
We when through the same process as the parent post (replacing Trendmicro Officescan as it has gone to crap). I ended up deciding on NOD32 over Kaspersky, but they were two we liked best. NOD32 has had a few minor problems, and the initial configuration can be time consuming, but overall it is a huge improvement over Trend at a considerably better price.
With Trend, it frequently missed malware and viruses but NOD32 has been great (our infection rate is probably 10% of what it used to be).
Bogus rehash - don't bother. (Score:3, Interesting)
Do we really need yet another analysis that talks about the same exact products on the same exact platforms?
Instead of a focus on complete information security, this kind of analysis, once again, ignores BlackBerry and Macintosh and Linux - some very common platforms that are growing in both the enterprise and home markets. How a repeated focus on the most commonly discussed platform helps anyone is a mystery. It just continues to say "all these products are different, we rank them according to our exclusive analysis." Are you going to switch AV vendor given their unconvincing analysis? Not likely.
In the end, the analysis sounds hollow; "My AV software isn't on the top of their list". Given their strategy, who cares?
The self-declared "security experts" completely miss the point by completely ignoring platforms other than Windows. Sure, perhaps the BlackBerry is only found in 70% of corporate environments, and the Mac only has 7% market penetration, and Linux is perhaps only 20% of back-end servers - but I'd fathom that nearly 95% of the businesses out there use one of these platforms and need them to be SECURE - in order to keep their corporate (or personal) data and networks safe.
All these "security experts" are failing their potential customers by rehashing the same discussion, instead of analyzing products and methods that address the mostly unhandled attack vectors of other mission-critical platforms.
Re: (Score:2)
It's talking about computer virusus and similar malware so of course they are talking about the home computer Microsoft platform. Other things have completely different problems and other solutions.
Live with it, this garbage is only MS Windows compatable on badly managed systems of that type so that is what is being talked about. The point has not been missed by any of the expe
What about the free versions? (Score:2)
Avira, Bitdefender, Avast and others have free and fee versions. What are the material differences?
Yay for uber-dorks (Score:1)
I downloaded one of the reports from this AV testing company/lab. Yeah, their report used Courier New throughout. Seriously, it's not that hard to just use the default Times New Roman or Arial fonts for reports. I don't expect perfection in presentation, but to intentionally choose a difficult-to-read font because it's what programmers use on the command line reeks of annoying.
best defence against unknown malware is .. (Score:2)
The best defence against unknown malware is to make an Operating System that don't get compromised by clicking on an URL or opening an email attachment ..
Re: (Score:1)
Re: (Score:3, Interesting)
Okey, I will take the time to explain it to you.
1. Set up a honeypot. Catch any number of relatively new viruses with these.
2. Use an AV product with signature files from a date before you started to capture the new viruses.
3. Tadaaa...
4. Of course... profit!
Now, was that so hard to come up with by yourself?
Re: (Score:2)
He claims his firewall blocks all unknown incoming traffic. It would be impossible for him to download a file with a virus as that would be considered unknown incoming traffic.
Re: (Score:2)
He claims his firewall blocks all unknown incoming traffic. It would be impossible for him to download a file with a virus as that would be considered unknown incoming traffic.
No offence, but what are you talking about? The incoming file is known traffic, yes. Whether or not that file is a virus or contains a trojan is not known at all by the firewall (and nor should it know or care). It would be perfectly possible to download a file with a virus in it because it's not the virus that the firewall is letting through... it's the file.