CSAV or F-Prot-Win 3.15

[Firefighter]

Hi everyone! I want to have a good resident scanner that has very low impact to my resources because I have always 5 - 6 different av:s and 2 different AT:s installed in my PC, all these because of my own test occasions. KAV is now out of my mind because all of that above. According to my own tests F-Prot belongs to the absolute top of av:s.

Can anyone say what real add value does Command AV have that F-Prot hasn't? I have read that F-Prot updates twice that frequency what Command AV does. Is that true? About heuristics, which is better of those two av:s?

Thanks anyway!

Best regards,
Firefighter!

[Blackcat]

FF, I think you know my views on these two.

Comparing the present versions, particularly on XP, IMO, CSAV has the edge. CSAV has for example, additional features such as quarantine and an email scanner (although only for OutLook).

In particular, the Dynamic Virus Protection running Guard of CSAV is more configurable than the Monitor of F-Prot, under XP. CSAV does take up slightly more memory but both are very light on resources.

A better comparison of the two can be found here;

1. F-Prot; http://www.wilderssecurity.com/showthread.php?t=10006

2. CSAV; http://www.wilderssecurity.com/showthread.php?t=18801

Authentium seems to update less frequently than F-Prot but you will find that their updates generally contain more definitions and their update frequency increases in times of new malware threats.

Most people seem to think that these 2 AV's should be very similar in detection, but Authentium use their own definitions for the F-Prot engine they use and although I have no direct evidence, I believe that CSAV would give slightly better detection overall. Authentium UK in fact call CSAV and F-Prot 'as similar as chalk and cheese'.

CSAV is on offer now, so now maybe a good time to buy this AV. But I was told by Authentium that no support was available for this 'special offer'.

Overall, however, with the sites you visit for malware samples, I would recommend a good AT program to run alongside either of these excellent AV's.

[Firefighter]

To Blackcat from Firefighter!

I have BOClean 4.11 as my main AT. I am trialing Ewido just now also, that's very promising according to my own tests comparing to TrojanHunter for example (not launched every trojan nastie I have to admit).

Best regards,
Firefighter!

[Firefighter]

To Blackcat from Firefighter!

What do you think about the upcoming unpacking engine in F-Prot? Does CSAV have that also very soon?

Best regards,
Firefighter!

[Blackcat]

All I know is that the new version of F-Prot is due to have an unpacking engine; as to what runtime files it will be able to unpack, I guess we will only know when we see the new F-Prot 4!

Last week, Authentium UK indicated that just because F-Prot is due a new version, does not mean that CSAV 5 is on the horizon. They will therefore carry on adding definitions for each packed variant.

This is one reason why the total databases of both of these AV's are so large.

[Firefighter]

To Blackcat from Firefighter!

Because my email provider already has F-Secure protection, I think that the "original one" has the better future in my case. I think that the update frequency has some add value in this case. What do you think about that?

Best regards,
Firefighter!

[Blackcat]

As always the users choice! But if you do choose F-Prot, I would be very interested in any future testing that you do on CSAV.

[Firefighter]

To Blackcat from Firefighter!

As I wrote to you, I couldn't update that CSAV demo. How I can test that av against my newest collection with current database?

Best regards,
Firefighter!

[Blackcat]

With extreme difficulty if the demo will not let you update! Did you try the demo downloads given in the previous thread; http://www.wilderssecurity.com/showthread.php?t=43122.

I have never used a trial version, but I presume that when you fill out the details in their download form, they then send you, via email, a username and password to obtain the updates.

For example, a registration page is here; http://www.authentium.co.uk/support/.../testdrive.cfm

Unless demo CSAV is like the present mks-vir with no updates available in the demo version! Does anyone else know whether the trial CSAV can be updated?

[Firefighter]

To Blackcat from Firefighter!

I have downloaded that demo from that site but my demo was asking update keywords that I never have got to my emailbox. Sorry!

Best regards,
Firefighter!

[Blackcat]

FF, I will pm you now

[Firefighter]

To Blackcat from Firefighter!

Just scanned my 2040 infected archives collection with Command AV 4.91.

Scan Results:
0 Boot Sectors Scanned
0 MBRs Scanned
0 Suspicious MBRs/Boot Sectors
0 Infected MBRs/Boot Sectors

2040 Files Scanned
2040 Files Processed
0 Files Suspicious
1762 Files Infected
1937 Viruses Found

Time of Scan:
0 hr 01 min 43 sec 906 msec

Obviously that 1762 is that number of infected archives, if so, F-Prot 3.15 found 1797, a bit better.

Unfortunately I couldn't store the results to notepad, where I usually counted manually each infection categories.

Best regards,
Firefighter!

[Firefighter]

To everyone from Firefighter!

Can someone show how I can exclude certain folders from real time scanning in F-Prot 3.15? Thanks!

Best regards,
Firefighter!

[Blackcat]

You cannot exclude ANY File/Folder/Directory in F-Prot for Windows. The RTM has basically no configuration options under Win XP!

[iwod]

So F Prot isn't that bad after all. I think many ( Blackcat ) think F Prot have worst unpacker support than CSAV. Could Firefrighter test this as well?

[Firefighter]

To iwod from Firefighter!

Unfortunately I just can't test runtimepackers.

Best regards,
Firefighter!

[Blackcat]

Originally Posted by iwod

So F Prot isn't that bad after all. I think many ( Blackcat ) think F Prot have worst unpacker support than CSAV.

BOTH appear to have virtually no unpacking support for runtime packed files, even frequently used packers like ASPack.

[Firefighter]

To Blackcat from Firefighter!

Why F-Prot's resident scanner doesn't detect my "2040_infected archived files collection" folder from my PC until I'm gonna remove the whole folder?

Best regards,
Firefighter!