Virus test

[Oleg]

Well I have tested 3 anti-virus products so here Is my results

Dr Web - Fail 3 viruses
NOD32 - Fail 1
MicroWorld - Fail 0

[Firecat]

How many viruses in total? MicroWorld passed b'coz of KAV engine.

Please state testing conditions and samples used along with product versions too

regards,
Firecat

[TonyKlein]

The authoritative Virus Bulletin appears to come to another conclusion:

http://www.virusbtn.com/vb100/archives/tests.xml?200502

Maybe you should call them... http://www.spywareinfoforum.com/html/emoticons/weee.gif

[Oleg]

Originally Posted by Firecat

How many viruses in total? MicroWorld passed b'coz of KAV engine.

Please state testing conditions and samples used along with product versions too

regards,
Firecat

Number of Viruses: 5
Viruses names: agent_bg, Bagle_BA, InstaFinder_inst, small_aio, SRG1

[Firecat]

eScan fails in VB due to scan restrictions at default settings and slower updates

[Oleg]

Originally Posted by Firecat

eScan fails in VB due to scan restrictions at default settings and slower updates

I see.

[Oleg]

How come McAfee passed?

[Randy_Bell]

Originally Posted by Oleg

Number of Viruses: 5
Viruses names: agent_bg, Bagle_BA, InstaFinder_inst, small_aio, SRG1

Is that all you used for your testbed The first one looks like [nonviral] adware.

[TonyKlein]

Originally Posted by Randy_Bell

Is that all you used for your testbed The first one looks like [nonviral] adware.

So is the third, and possibly the fourth as well...

[Oleg]

Well those are trojans.

[RejZoR]

Hehe,5 samples to test. You must be kidding right? Even 100 doesn't mean anything.

[TonyKlein]

Originally Posted by Oleg

Well those are trojans.

They're still adware... Instafind is a rather basic browser hijacker using mainly a browser plugin (BHO) to do its thing, incredibly far removed from a "real" (remote control) trojan, although that's indeed hpw most antiviruses that target spy/adware prefer to tag them ...

[Oleg]

Well I am still looking for more viruses,but no luck In finding some. I forget to tell I have also tested: W32.HLLW.Veedna.C and W32/Winur.worm.b

[RejZoR]

It's worthless testing with just few samples.
Database of 10.000 verified samples is another story. But there is so many more malware and almost the same number of so called tests. Just check av-comparatives.org for such tests. They seem to have the most trustworthy test far around. And they also perform it using 30.000+ samples as far as i know.
Thats a really huge number.
But it's fun collecting malware thats for sure. Some collect badges and stamps,we collect viruses and worms

[IBK]

You mean 300.000+
In August it will maybe be 400.000+

Originally Posted by Oleg

Well I have tested 3 anti-virus products so here Is my results

Dr Web - Fail 3 viruses
NOD32 - Fail 1
MicroWorld - Fail 0

Not to be rude, but this "test" serves to mislead people and nothing more. Not only is the method, settings, and samples not posted, but the amount is probably miniscule and questionable. Without a broad and comprehensively verified test set, its quite pointless, as every AV has things they miss. The mere fact that most virus download sites use KAV to verify their samples, will instantly skew your results.

Testing is a tricky thing, that should be left to the professionals. I recomend this thread be locked so it falls off the front page.

Originally Posted by SDS909

I recomend this thread be locked so it falls off the front page.

I second that. In the most cases such threads ending up in insultings and a lot of waves around nothing.

[Firefighter]

Originally Posted by IBK

You mean 300.000+
In August it will maybe be 400.000+

Did you mean really 300.000+ DIFFERENT infected Win32 viruses, worms, trojans, macros and scripts etc. names or variants?

Within last 60 weeks DrWeb has got only 23 315 new signatures. Let's suppose that DrWeb is able to catch about 85 % of all NEW nasties, so in your 300.000+ sample collection you have all possible nasties dating back to spring 1994, quite impressive.

PS. Actually your collection is dating back more far away, because the speed of new signatures is accelerating all the time.

Best regards,
Firefighter!

[IBK]

I think it is better if I do not jump into a number discussion, as I tried in past to explain in detail that they are all different in their way - but showing/prove it does cost me time for something that should be clear.
But I make another example: lets assume e.g. Kaspersky has a own collection which consist of ~500.000 samples (+ all the other various collections; but this is not of interest now) - I guess 500k is currently their size. They have 124.000+ known viruses (virus records) and do use about 70.000+ different names for them. Other AV's have 40.000 different names, other 80.000 different names, etc. In total, we have about 96% of all virus names of every AV in our collections; but this does not mean much, as those are just the names; as you see, the collection of the AV's are even bigger. So it is not complete, but nearly - those we still do not have are mainly old samples or samples that really for sure never saw a byte outside a lab.