Virus Bulletin August 2011 comparative anti-virus test

[King Grub]

Results listed here:

http://www.virusbtn.com/vb100/archive/test?recent=1

And the RAP results for feb-aug 2011 in the usual graph form:

http://www.virusbtn.com/vb100/latest_comparative/index

[Noob]

Nice!
Couldn't find Emsisoft on that list LOL (I mean in the image)

[sg09]

OMG!!! BKIS highest in proactive and 2nd highest in reactive...:o

[Kernelwars]

-{ Quote: "OMG!!! BKIS highest in proactive and 2nd highest in reactive...:o" }-
what is BKIS sg?:-\

[sg09]

-{ Quote: "what is BKIS sg?:-\" }-

http://www.virusbtn.com/vb100/archive/vendor?id=88

http://www.bkis.com/index.aspx

It is a front-line Vietnamese antivirus. It used to be below average. But from the last few months it is showing outstanding improvement in VB. I am wondering if they have licensed any top notch engine. It already has a dedicated cloud.

[King Grub]

-{ Quote: "what is BKIS sg?:-\" }-

It is security software from Vietnam. http://bkis.com/index.aspx

[SweX]

I am happy that ESET is stuck on the same place as usual ;D

And also as usual Trustport is at the top.

But it's great to see that Avast, Avira, and GFI did well too. Though Webroot needs to improve a little.
And BitDefender should have done better.

[SweX]

-{ Quote: "I am wondering if they have licensed any top notch engine. It already has a dedicated cloud." }-
BD of course ;D Or maybe Avira. :-\

[shadek]

Is BKIS light?
If it's BitDefender engine, then I'm afraid I'll pass. I'm hoping it's a true cloud product like Prevx is/was. Then it'd be darn light. :D

[SweX]

FYI. BKIS is on sale atm. http://www.bkis.com/home/BuyOnline.aspx

Feature list: http://www.bkis.com/home/default.aspx?content=BkavPro

[shadek]

-{ Quote: "FYI. BKIS is on sale atm. http://www.bkis.com/home/BuyOnline.aspx" }-

Yeah, I noticed that. Even on sale, it's still quite average priced and it's only for one user.

[The Hammer]

-{ Quote: "Is BKIS light?
If it's BitDefender engine, then I'm afraid I'll pass. I'm hoping it's a true cloud product like Prevx is/was. Then it'd be darn light. :D" }-
It's pretty hard to avoid Bit Defender's engine these days as it is extensively licensed.

[carat]

16 FP for PC Tools - well done :-\

[toxinon12345]

The following vendors have secured their VB100 awards in latest 5 tests:

Sophos, ESET, QuickHeal, Central Command, BitDefender, Avira, Avast.

[eBBox]

Why this big difference between F-Secure IS and F-Secure Client Security?

And Bitdefender doing way worse than the licensed engines in F-Secure, G-Data, and Bullguard etc.

[NAMOR]

-{ Quote: "Why this big difference between F-Secure IS and F-Secure Client Security?

And Bitdefender doing way worse than the licensed engines in F-Secure, G-Data, and Bullguard etc." }-


Can't answer the first one but, F-Secure has other engines other than bitdfender, same with G-Data. And I believe that Bullguard adds their own spyware definitions to their product, so they have those as well as the bitdefender ones.

[shadek]

-{ Quote: "Can't answer the first one but, F-Secure has other engines other than bitdfender, same with G-Data. And I believe that Bullguard adds their own spyware definitions to their product, so they have those as well as the bitdefender ones." }-

That's right. Many suites have BitDefender in them, but other in-house protection mechanisms like BB, anti-spyware etc in place!

[Brandonn2010]

Wow, AVG actually FAILED the VB certification because of 2 false positives.

[shadek]

-{ Quote: "Wow, AVG actually FAILED the VB certification because of 2 false positives." }-

Comodo is failing, as per usual. I do think their suite provides an excellent overall protection... but all this Comodo AV evangelism provided by its users needs to stop.

[GrammatonCleric]

-{ Quote: "Comodo is failing, as per usual. I do think their suite provides an excellent overall protection... but all this Comodo AV evangelism provided by its users needs to stop." }-


You crazy??!!! Comodo failed because this test is biased and has not shown any real life experience. Also because Reason !, Reason 2, Reason 3. Fumming capitalized reason 4. And Besides any moron would see that positive comment regarding COMODO 1, comment 2 and comment 3.
Followed by "Only educated users use comodo".

Sorry about that, I was channeling Melih.

[shadek]

-{ Quote: "You crazy??!!! Comodo failed because this test is biased and has not shown any real life experience. Also because Reason !, Reason 2, Reason 3. Fumming capitalized reason 4. And Besides any moron would see that positive comment regarding COMODO 1, comment 2 and comment 3.
Followed by "Only educated users use comodo".

Sorry about that, I was channeling Melih." }-

Haha! That was hilarious! I thought after the first sentence that; HERE WE GO AGAIN! ANOTHER COMODO EVANGELIST! But not! :D

[kjdemuth]

Straight from BKis web page
"Bkav Pro is particularly equipped with Safe Run, a breakthrough technology. In Safe Run mode, the system stays safe even when user unconsciously opens a virus file or a malicious website."
Hmm doesn't kaspersky also have safe run. Hmmmm

[shadek]

-{ Quote: "Straight from BKis web page
"Bkav Pro is particularly equipped with Safe Run, a breakthrough technology. In Safe Run mode, the system stays safe even when user unconsciously opens a virus file or a malicious website."
Hmm doesn't kaspersky also have safe run. Hmmmm" }-

I can't find anywhere that 'Safe run' is compatible with x64 systems. Usually, those 'Safe Runs' and 'Sandboxes' are based on 32-bit systems.

[toxinon12345]

-{ Quote: "all this Comodo AV evangelism provided by its users needs to stop." }-
COMODO is outstanding in the firewall side, not anti-malware.:thumbd:

[shadek]

-{ Quote: "COMODO is outstanding in the firewall side, not anti-malware.:thumbd:" }-

I never said their firewall wasn't good. :) I just pointed out their AV. :D

[toxinon12345]

-{ Quote: "I never said their firewall wasn't good. :) I just pointed out their AV. :D" }-
-{ Quote: "all this Comodo AV evangelism provided by its users needs to stop." }-
i never saw comodo scoring good in two independent test organisations, at least.
Their users claim such tests are not real world or these tests are easy, whats the results? They failed the tests :D

[kjdemuth]

-{ Quote: "I can't find anywhere that 'Safe run' is compatible with x64 systems. Usually, those 'Safe Runs' and 'Sandboxes' are based on 32-bit systems." }-
It clearly says in the features section that it has safe run. Kaspersky as well, which runs on 64 bit systems, has safe run.

[shadek]

-{ Quote: "It clearly says in the features section that it has safe run. Kaspersky as well, which runs on 64 bit systems, has safe run." }-

It does state it has 'Safe run'. But there's no system requirements for the software... so we cannot be sure it's x64 compatible.

[shadek]

-{ Quote: "Their users claim such tests are not real world or these tests are easy, whats the results? They failed the tests :D" }-

I suppose we can rest our case now! :argh:

[paolo]

Good result for Fortinet :)

[trjam]

Eset and Avira :thumb:

Always my 2 favorite products.;D

[zfactor]

wow they dont even test dr web any more.. agreed on commodo great firewall but i would not use it in full suite form... glad to see the normal doing well and still dont really care for these tests because they fail a product for even one fp... every product will at some point have fp's no way around that but of course some more than others.

[Kernelwars]

after incorporating prevx I thought webroot would do better..:dry:

[SweX]

-{ Quote: "after incorporating prevx I thought webroot would do better..:dry:" }-
I don't think it is WSA that's tested, it's just in BETA.

[EraserHW]

-{ Quote: "after incorporating prevx I thought webroot would do better..:dry:" }-

That's not the new product which has been tested actually ;)

[Ibrad]

-{ Quote: "after incorporating prevx I thought webroot would do better..:dry:" }-

I am more interested in the test once they do incorporate it. I think they are just sharing samples right now? I think the one tested does not have the full Prevx cloud though (correct me if I am wrong though).

[toxinon12345]

-{ Quote: "they fail a product for even one fp... every product will at some point have fp's no way around that but of course some more than others." }-
If you want an AV with regular quality, at least, these test must be the first to look at.

[ESS474]

-{ Quote: "Good result for Fortinet :)" }-

Yeah, using here Lite version and works great. :D

[The Hammer]

-{ Quote: "wow they dont even test dr web any more." }-
I wonder if anybody does? They withdrew from AV-Comparatives a long time ago and you say they're not in this test either.

[PJC]

-{ Quote: "COMODO is outstanding in the Firewall side; not in the Anti-Malware one." }-
This has always been the case...:argh:

[smage]

I'm not seeing Comodo in the image, how much did rge AV score?

[Thankful]

Emsisoft has failed 5 of the last 7 VB100 tests due to FPs.

[narenbisht]

-{ Quote: "Comodo is failing, as per usual. I do think their suite provides an excellent overall protection... but all this Comodo AV evangelism provided by its users needs to stop." }-

Comodo failed coz of 4 false postives. It has improved a lot. Check out the graph.

Thanxx
Naren

[scott1256ca]

How many samples do they test? I don't feel like paying $20 to find out, and I don't see it posted in this thread.

[The Hammer]

-{ Quote: "Agreed, even Dr. Web is pretty good too:thumb:" }-
How does anybody really know?

[Osaban]

-{ Quote: "How does anybody really know?" }-
Dr Web Cureit has a good reputation as a cleaner for infected computers therefore one could infer the AV must be at least as good. On the other hand I would never buy an AV that consistently refuses to be tested by independent organizations.

[Espresso]

-{ Quote: "COMODO is outstanding in the firewall side, not anti-malware.:thumbd:" }-

Comodo has been very effective with their Firewall and Anti-Malware (D+) modules, just not the AV module. BTW, they never missed anything in this test, just a few false detections.

[thanhtai2009]

-{ Quote: "Comodo has been very effective with their Firewall and Anti-Malware (D+) modules, just not the AV module. BTW, they never missed anything in this test, just a few false detections." }-Comodo failed because 4 FP (it detected FileZilla as Trojan Downloader :o) & 11 Suspicious in clean sets. The detection rate of polymorphic lower than others (only 95.51%).

[Cudni]

ot posts removed to a separate thread

[umbrapolaris]

-{ Quote: "http://www.virusbtn.com/vb100/archive/vendor?id=88

http://www.bkis.com/index.aspx

It is a front-line Vietnamese antivirus. It used to be below average. But from the last few months it is showing outstanding improvement in VB. I am wondering if they have licensed any top notch engine. It already has a dedicated cloud." }-
i living in Vietnam actually, and some of the infected PC i saw last year had BK as anti-virus, i wonder what engine they use now.

[windowsdefender]

Foitinet has been getting better in dection and in gui

[raven211]

-{ Quote: "Microsoft Forefront 14/14 tests passed.
Symantec 7 tests failed.
ESET 3 failed." }-

What? ???

[windowsdefender]

That is odd ???

[toxinon12345]

http://www.virusbtn.com/vb100/archive/compare?tab=onDemand&id=14&id2=1&id3=4&id4=52&id5=&id6=

[dschrader]

Ya'all realize these are static file tests?

This isn't real-world or "whole securty" tests like av-test.org or av-comparatives run. This is put a bunch of files in a folder and run the scanner. This doesn't test the full security stacks of these products.

VB really should enter the 21st century and stop with zoo only testing - or with "certifications" allowing vendors to claim 100% detection - when we all know that no products detect 100% of threats.

[dschrader]

raven211, look a little closer at the stats you quote.

Yes, Symantec had 7 fails - but only one fail since 1999 and 55 passes - see the vendor history - http://www.virusbtn.com/vb100/archive/vendor?id=4

Microsoft Security Essentials had 4 passes and one fail

Forefront has had 14 passes

In any case I still don't think the VB test is much good - it doesn't test real time protection, download protection, host IPS, network IPS, source reputation . . . .

We at Symantec found that approx 50% of our detections last year were by IPS.

[toxinon12345]

"VB really should stop with zoo only testing"

sorry, but for obtaining the VB100 award, real threats with the highest priority and affecting users are used, not zoo samples.

"...when we all know that no products detect 100% of threats."

youre right, but a 100% Detection rate in this important group is expected by a product.

"it doesn't test real time protection"
this is not true, on-access detection must be guaranteed, too in order to obtain the award.

Only some vendors have reliable detection in this test along years of evaluations, including Symantec ;)

[thanhtai2009]

after few years, I think Eset is the strongest VB's competitor :)

[codylucas16]

Outdated testing methodology is outdated.

Your antivirus can have all the detection rate % in the world, but if I can find a virus it doesn't detect in under five minutes and it does nothing to stop me from launching it, its detection rate becomes meaningless.

[Amit]

-{ Quote: "
Your antivirus can have all the detection rate % in the world, but if I can find a virus it doesn't detect in under five minutes and it does nothing to stop me from launching it, its detection rate becomes meaningless." }-
exactly:thumb:

[PJC]

-{ Quote: "After few years, I think Eset is the strongest VB competitor." }-
Indeed, when it comes to Virus Bulletin, ESET is the most successful AV vendor.
However, many have questioned the Reliability/Importance/Methodology of Virus Bulletin Tests...:-\

[thanhtai2009]

-{ Quote: "Indeed, when it comes to Virus Bulletin, ESET is the most successful AV vendor.
However, many have questioned the Reliability/Importance/Methodology of Virus Bulletin Tests...:-\" }-
Mothedology can be found here: -http://www.virusbtn.com/vb100/about/methodology.xml

[PJC]

-{ Quote: "Mothedology can be found here: -http://www.virusbtn.com/vb100/about/methodology.xml" }-
I know, but there are still many criticizers...:-\

[toxinon12345]

-{ Quote: "but if I can find a virus it doesn't detect" }-
look more closely to what you wrote, because in all Anti-malware products you will find a undetected threat.

[codylucas16]

-{ Quote: "look more closely to what you wrote, because in all Anti-malware products you will find a undetected threat." }-

That is exactly my point. When products use nothing but signatures to try to protect, they don't detect it and the system is infected. If they have multiple layers, eg behaviour blockers, web shields, etc. Suddenly it becomes more challenging to infect a system.

Most of the infected systems that come into my house are using such products, products that haven't stepped into the modern world of malware. I could list them off, but I don't want to offend users of the products.

It's not very often a user of Avast, Comodo, Norton, Emsisoft, F-Secure, etc. etc. show up at my door with infected PCs. The reason is that these products have realized they can't keep up to date by releasing signatures for everything and have incorporated very strong alternative methods for protecting.

That is why this test is completely meaningless. A detection rate proves nothing. It just proves specific malware collection teams got lucky, and put those threats in a database before the test was conducted.

[dschrader]

toxinon12345

The point is that VB is just testing scanning static files for malware. This tells you little about how well the security product behaves in a real-world scenario where the machine be being actively attacked. Say where a user accidently lands on an infected site or inserts a USB device and something runs - say obfuscated code within a web page.

So the VB test tells you nothing about how effective each product's packet inspection, browser protection, system integrity, tamper protection or real-time (not on access - but actual monitoring of processes as they run looking for malicious behaviors) technologies work.

VB needs to move away from static file testing to real-world scenarios. This is expensive and labor intensive, but it gives a far better view into the effectiveness of the solution being tested. There is a lot of divergence between VB's test results and those of av-test, av-comparatives or Dennis Labs because the latter test the full product not just the file scanner.

[windowsdefender]

-{ Quote: "raven211, look a little closer at the stats you quote.

Yes, Symantec had 7 fails - but only one fail since 1999 and 55 passes - see the vendor history - http://www.virusbtn.com/vb100/archive/vendor?id=4

Microsoft Security Essentials had 4 passes and one fail

Forefront has had 14 passes

In any case I still don't think the VB test is much good - it doesn't test real time protection, download protection, host IPS, network IPS, source reputation . . . .

We at Symantec found that approx 50% of our detections last year were by IPS." }-
You have a point :thumb:

[Matthijs5nl]

-{ Quote: "That is exactly my point. When products use nothing but signatures to try to protect, they don't detect it and the system is infected. If they have multiple layers, eg behaviour blockers, web shields, etc. Suddenly it becomes more challenging to infect a system.

Most of the infected systems that come into my house are using such products, products that haven't stepped into the modern world of malware. I could list them off, but I don't want to offend users of the products.

It's not very often a user of Avast, Comodo, Norton, Emsisoft, F-Secure, etc. etc. show up at my door with infected PCs. The reason is that these products have realized they can't keep up to date by releasing signatures for everything and have incorporated very strong alternative methods for protecting.

That is why this test is completely meaningless. A detection rate proves nothing. It just proves specific malware collection teams got lucky, and put those threats in a database before the test was conducted." }-
Can you name a product which only uses signatures for protection? Or can you name a product which doesn't use any of those additional layers you named or any other possible additional layer we know?

[toxinon12345]

It would be interesting to compare the products in an offline behavioural test.

[Baserk]

-{ Quote: "It would be interesting to compare the products in an offline behavioural test." }-
Not so much I think. It would, imao, only give a very limited view on a product's performance.
'Whole product dynamic test', that's my cup of tea.

[windowsdefender]

that would be instresting to do.:argh:

[toxinon12345]

Testing the protection capabilities of layers like HIPS, behaviour blockers, sandboxes, on-access scanners, File/URL blockers will require of "Dynamic tests" AND "Retrospective/Behavioural tests".

In addition to the web, additional infection vectors could be used such as removable media, network, e-mail, etc.

[raven211]

-{ Quote: "raven211, look a little closer at the stats you quote.

Yes, Symantec had 7 fails - but only one fail since 1999 and 55 passes - see the vendor history - http://www.virusbtn.com/vb100/archive/vendor?id=4

Microsoft Security Essentials had 4 passes and one fail

Forefront has had 14 passes

In any case I still don't think the VB test is much good - it doesn't test real time protection, download protection, host IPS, network IPS, source reputation . . . .

We at Symantec found that approx 50% of our detections last year were by IPS." }-

Haha, I just go into assumptions and conclusions too quickly. ;D

[raven211]

-{ Quote: "Testing the protection capabilities of layers like HIPS, behaviour blockers, sandboxes, on-access scanners, File/URL blockers will require of "Dynamic tests" AND "Retrospective/Behavioural tests".

In addition to the web, additional infection vectors could be used such as removable media, network, e-mail, etc." }-

Now we're talking!

[windowsdefender]

That would be a complete AV test!:thumb:

[toxinon12345]

It would be interesting to test infection vectors like USB using 10,000 file samples, at least. ;)

[windowsdefender]

That would bring AVs without USB protection to their knees.

[andyman35]

-{ Quote: "Outdated testing methodology is outdated.

Your antivirus can have all the detection rate % in the world, but if I can find a virus it doesn't detect in under five minutes and it does nothing to stop me from launching it, its detection rate becomes meaningless." }-
Sitting here applauding such a common sense post.:thumb:

Remember folks Sandboxie and Defensewall detected 0% last time I checked,so they must be truly rubbish yes?

[toxinon12345]

-{ Quote: "That would bring AVs without USB protection to their knees." }-
well, i dont know a product offering protection without checking the files when you access them.

-{ Quote: "That would be a complete AV test!:thumb:" }-

yeah, dynamic tests evaluating the reaction to threats using all protection layers.
On the other hand, a retrospective/behavioral test would show how good are the protection capabilities (using HIPS, BB, etc) offered by a product when tested against unknown threats.

[Ilya Rabinovich]

-{ Quote: "There is a lot of divergence between VB's test results and those of av-test, av-comparatives or Dennis Labs because the latter test the full product not just the file scanner." }-
Dennis Lab's dynamic tests are sponsored by Symantec.

[Amit]

-{ Quote: "Dennis Lab's dynamic tests are sponsored by Symantec." }-
lol...........:argh: ...:argh:

[King Grub]

Not like that is a secret; it's stated in each test report. And it shouldn't mean that Symantec bought the results, just the test. Dennis Labs is a member of AMTSO and follows the Anti-Malware Testing Standards Organisation standards.

[Ilya Rabinovich]

-{ Quote: "Not like that is a secret; it's stated in each test report. And it shouldn't mean that Symantec bought the results, just the test. Dennis Labs is a member of AMTSO and follows the Anti-Malware Testing Standards Organisation standards." }-
Very funny. May I ask you two things here:
1. What happens if Symantec loose the test? Will they pay for it next time?
2. Why we see no sandboxes there, just anti-viruses? Anti-viruses are better with preventing infections by malicious software?

[Nevis]

-{ Quote: "Very funny. May I ask you two things here:
1. What happens if Symantec loose the test? Will they pay for it next time?
2. Why we see no sandboxes there, just anti-viruses? Anti-viruses are better with preventing infections by malicious software?" }-

well, I do find Dennis lab test to be biased but as still norton is doing very well in almost all other test too, so it doesnt make much difference to me .

[Ilya Rabinovich]

-{ Quote: "but as still norton is doing very well" }-
Norton is doing very well? (http://malwareresearchgroup.com/malware-tests/flash-test-results/)

[King Grub]

Yes, it is, in that test as well. Compare it to similar products, and it's right up there.

And since some products can't protect a modern OS (Windows 7 x64) at all, they are looking even better compared to some of the competition...

[Ilya Rabinovich]

-{ Quote: "Compare it to similar products, and it's right up there." }-
Nobody cares about "similar products". Everybody cares for Internet surfing and online shopping, free of threats. Symantec doesn't satisfy this condition.

[shadek]

-{ Quote: "Nobody cares about "similar products". Everybody cares for Internet surfing and online shopping, free of threats. Symantec doesn't satisfy this condition." }-

You develop something for x64 systems, and I'd gladly use DefenseWall, but right now I cannot. You provide a product which is not similar to other products, but yet cannot be used by most of the recently sold computers in the western world.

A real world scenario wouldn't be an environment in 32-bit in ALL tests done these days. A real world scenario would be 50% tests with 32-bit and 50% tests with x64... but oh wait... then so many products/vendors wouldn't even be able to participate in the test = less money for those who conducts tests.

I look forward to a product which fully support Windows! :) DW is a near-perfect Anti-Malware tool for a limited number of users. I hope to see it for all of us in the future!

[King Grub]

-{ Quote: "Nobody cares about "similar products". Everybody cares for Internet surfing and online shopping, free of threats. Symantec doesn't satisfy this condition." }-

Neither does yours, good as it might be on the kind of os that can run it. x64 is the future (even the current), and software that can only protect 50% of the computers running the latest Windows is no protection at all for those of us who can't or won't go back to yesterday's technology and 32-bit operating systems. It offers me and many million of other users 0% protection.

[Narxis]

-{ Quote: "Neither does yours, good as it might be on the kind of os that can run it. x64 is the future (even the current), and software that can only protect 50% of the computers running the latest Windows is no protection at all for those of us who can't or won't go back to yesterday's technology and 32-bit operating systems. It offers me and many million of other users 0% protection." }-

Yeah, almost every notebook and PC comes with Windows 7 x64. That is the present and that is the future.

[emperordarius]

x64 is the present, not the future. The future is 128-bit.

[toxinon12345]

-{ Quote: "DW is a near-perfect Anti-Malware tool for a limited number of users." }-
is like saying linux or mac is near-perfect for its small number of users interested in attacking it.

Or like UAC/Sudo systems, you are asked because such systems are not designed with detection algorithms, OS is not AV! You cannot implement that security internally in OS, you would loose usability and performance because of the policy of scanning and blocking !!!

[Ilya Rabinovich]

-{ Quote: "Neither does yours, good as it might be on the kind of os that can run it. x64 is the future (even the current), and software that can only protect 50% of the computers running the latest Windows is no protection at all for those of us who can't or won't go back to yesterday's technology and 32-bit operating systems. It offers me and many million of other users 0% protection." }-
And that's the only argument you can provide to protect your favorite blacklisting tool? Poor, very poor. Yes, I can't protect x64 for now, but Symantec can't protect even "outdated" x32 platform for all those years.

[Ilya Rabinovich]

-{ Quote: "x64 is the future" }-
Negative. Smartphones and tablets are the future, PC is the past.

[King Grub]

Norton isn't my "favorite". Why are you so aggressive? You're the one who seems rabidly anti-Norton for some reason. Having a hard time dealing with people using or having positive things to say about the competition?

[Nevis]

I am not going to discuss A vs B .
if @Ilya is so against norton , then let it be.


its not going effect choice of others.
I am satisfied with it and so are many millions of people. Also , I again repeat it is performing much better in many AV test . if you cannot digest it by highlighting 1 or 2 test then its your opinion .

[King Grub]

Agreed. It just seems a weird way to act as a representative of a product - missing no opportunity to bash a competitor. Doesn't make a good impression at all.

[Ilya Rabinovich]

-{ Quote: "You're the one who seems rabidly anti-Norton for some reason." }-
I'm not anti-Symantec. I'm "anti" people who thinks anti-viruses are any "good" nowadays. There are no good anti-viruses at all. Yes, some better then others, Symantec's one is one of the best, but they all too outdated in its basics to be reasonable protection for their users. And yes, I'm aggressively believe in it.

[sg09]

-{ Quote: "......I'm "anti" people who thinks anti-viruses are any "good" nowadays. There are no good anti-viruses at all. Yes, some better then others, Symantec's one is one of the best, but they all too outdated in its basics to be reasonable protection for their users......." }-
+1......:thumb::thumb:

[Osaban]

-{ Quote: "I'm not anti-Symantec. I'm "anti" people who thinks anti-viruses are any "good" nowadays. There are no good anti-viruses at all. Yes, some better then others, Symantec's one is one of the best, but they all too outdated in its basics to be reasonable protection for their users. And yes, I'm aggressively believe in it." }-
I also think that antivirus cannot be trusted as first line of defense, but I also believe that somebody out there should be doing the tedious analyses of what malware is found, more as a post-mortem though. DefenseWall + an antivirus should make an irresistible combination, let's just hope that Ilya finds a way to create a version for the 64 bit OS.

[jad_123]

-{ Quote: "Negative. Smartphones and tablets are the future, PC is the past." }-

While I do not agree 100% with this statement I do have a question.

If you believe smartphones and tablets are the future are you actively developing to protect these?

[jad_123]

-{ Quote: "I'm not anti-Symantec. I'm "anti" people who thinks anti-viruses are any "good" nowadays. There are no good anti-viruses at all. Yes, some better then others, Symantec's one is one of the best, but they all too outdated in its basics to be reasonable protection for their users. And yes, I'm aggressively believe in it." }-

Symantec and other vendors recognize that blacklisting is not answer, hence continued development of of technologies such as SONAR. And while not perfect what choice does the average user have? Unfortunately products such as yours do not reach the average user. If were not for wilders I would never have heard of you. I have 3 laptops and 1 desktop in my home, all are 64-bit. That is what is being sold to the average person. It seems you would be better off selling your product to someone who can provide the capital to develop it and keep it up date.

[Securon]

Good Morning ! I think Ilya Rabinovich needs to take some courses in People Skill's Management. It's how you express yourself ! While his product is no doubt effective...outside of this forum...there is very little mass public perception...regarding the product. Perhaps it's time for Mr.Rabinovich to consider hiring a Public Relations Person to represent a more Customer Friendly Focus in regards to his Product. Sincerely...Securon

[Osaban]

-{ Quote: "...It seems you would be better off selling your product to someone who can provide the capital to develop it and keep it up date." }-
Someone like Symantec? Hopefully not.

[jad_123]

-{ Quote: "Someone like Symantec? Hopefully not." }-

Not saying Symantec. But a company with their resources for sure. If the object is to truly protect the masses of averages users then a product like DefenseWall needs capital to stay current and to reach the end user community.

[Ilya Rabinovich]

-{ Quote: "If you believe smartphones and tablets are the future are you actively developing to protect these?" }-
Because its kernel totally closed from third-party vendors. iOS, Android, Bada, W7...

[Ilya Rabinovich]

-{ Quote: "Symantec and other vendors recognize that blacklisting is not answer, hence continued development of of technologies such as SONAR." }-
This technology is blacklisting-based too. Same with file reputation. Same with heuristic-based sandbox HIPS like KIS and Avast has. If a technology distinguish between good and bad- it's blacklisting-based.

[Matthijs5nl]

-{ Quote: "This technology is blacklisting-based too. Same with file reputation. Same with heuristic-based sandbox HIPS like KIS and Avast has. If a technology distinguish between good and bad- it's blacklisting-based." }-
So what categories of technologies for security do exist in your eyes? Blacklisting-based, sandboxing-based, policy-based?

[Ilya Rabinovich]

-{ Quote: "So what categories of technologies for security do exist in your eyes? Blacklisting-based, sandboxing-based, policy-based?" }-
Blacklisting-based (working only with bad things), whitelisting-based (working only with good things) and graylisting-based (working with the world of unknown things). Sandboxing is a part of graylisting.

[smage]

Fortunately for us, Comodo has come to our rescue. With CIS you get the combined power of blacklisting(AV and Cloud BB) and whitelisting(D+ and sandbox) :)

[toxinon12345]

-{ Quote: "This technology is blacklisting-based too. Same with file reputation. Same with heuristic-based sandbox HIPS like KIS and Avast has. If a technology distinguish between good and bad- it's blacklisting-based." }-
It depends on what criteria you use for object identification.
Some products use just the hash, requiring one hash per file. Compared to definitions that is not a smart approach, which can identify various files with a single signature.

[Ilya Rabinovich]

-{ Quote: "from a technical point of view, signatures is not a blacklisting method" }-
From technical point of view, it's pure blacklisting as it deal with known as bad staff only.

[J_L]

Only somewhat interested in RAP test, until they improve the methodology.

[toxinon12345]

-{ Quote: "Only somewhat interested in RAP test, until they improve the methodology." }- why are you interested in zoo-based tests and not in wild-based tests, which is more important?
RAP testing is static.
Or you disagree with the methodology only when your prefered product scores bad?

[J_L]

I never said I was more interested in zoo-based tests. Don't put words in my mouth again >:(.
Nothing to do with my preferred product.

It's mainly because they test programs in an offline environment, which causes unrealistic results.

[kareldjag]

hi,
AV testing is technically and ethically corrupted since a long time.
My comments about this statement have already be given on this post: http://www.wilderssecurity.com/showpost.php?p=1893867&postcount=239
And VB100 tests are worse than AV-Test and AV-Comparative: even TrendMicro and Dr Web boycott them:
http://countermeasures.trendmicro.eu/traditional-av-testing-file-under-irrelevant/
http://news.drweb.com/show/?i=83&c=5&lng=en&p=16
I will not add Kalashnikov comments to theses no-sense tests, or just one: if there is a VB100, then there is a VB0...
Then it is a waste of time to explain such things to AV fans, as by tradition AV fans have no experience in reversing, can't extract a signature for malware matching, have not the ability to find five or ten different ways to evade and defeat an antivirus...
Each topic, question or problem is limited by our experience, and each one is right FROM HIS PERIMETER POINT OF VIEW.
Regarding Symantec, its leadership in the AV market share has been acquired by its effective mass marketing, especially with NORTON coming embedded in a big part of sold PC.
With this kind of racket practices ( http://no.more.racketware.info/index ), with the sponsoring of some av tests (there is off course RUMORS about Dlabs and VB100), Symantec prooves that a campany can control a market even if its products are less effective than its challengers ones (DrWeb has done more in R. and D. effectiveness in 10 years that Norton in 20 years).
And VB100 logo is no more no less than a marketing weapon: technically, a few of certified vb100 av can't be trusted.
Why promoting such tests if we consider that the antivirus industry has failed since the beginning?
I personally expect that av tests organizations will tell to average users which av to choose according to various criteria/on (country, support etc), and not if Norton performs better that Kaspersky which turns on a kind of war on security forums between av fans, and in the press between av editors:
http://www.comguard.net/kaspersky_june_supplement.pdf

http://www.arrowecs.pl/DNS/WWW/News.nsf/Bitmaps/sep/$FILE/SEP_Competitive_Sales_Script.pdf

The AV industry is really a wonderfull world...

Rgds

[bellgamin]

-{ Quote: "DrWeb has done more in R. and D. effectiveness in 10 years that Norton in 20 years." }-R&D for 10 years & basically ZERO to show for it. :shifty:

[gery]

-{ Quote: "Someone like Symantec? Hopefully not." }-
Nortons have a super client support team and they are really an example to follow .. i had issues with their product and they were so quick that no one else had before. I might not like Norton but their support is blameless