Best way to test antivirus/security software?

Other than reading reviews, I guess the only sure way is to test for yourself. If I wanted to do it with minimal risk, how would I go about it? I've come up with the following:-

1. Must test in a VM, I'm thinking VirtualBox for easiest to use. Then install Xp SP3/Vista Sp1 in it.
   
2. disable the router protection for this VM. For this I must put it into the DMZ right? How do I do this?
   
3. Take a snapshot of VM (like taking an image)
   
4. Install security sw
   
5. Visit bad sites, run malware exe's. What's a good source for these? Which sites to visit? I suppose it also must be done in IE with all its protection disabled.
   
6. See what's caught and what's not - look for firewall notices, false positives, automatic cleaning etc. How will I know that a virus has slipped through if its not detected? Is the only way to do this by running scans with many different online scanners?
   
7. Restore snapshot
   
8. Repeat steps 4,5,6

If someone here has already done such tests, please link to your findings.

 

with all due respect, amateur testing is to professional testing what mud pies are to real pies... there's nothing sure about doing the tests yourself...

 

LOLROF

Time to eat some dirt.