Dr. Web Statement Regarding Virus Bulletin

I believe it was fixed some time ago, that when trying to delete lots of files it would crash. I'm not sure though, but I remember it was some release that contained a lot of bug fixes.

Could it be possible that it's their corporate clients and so on, who demand explanation why they don't participate in testing anymore? But it is of course true that failing tests isn't good publicity.

I just don't understand people who state some products are garbage or crap and they've never even tried the software(or used it longer than few days before switching to some another, to switch for another.)

The thing for me is: scanning some collection of malware and detecting files x, y, z, q isn't "performing", but using some security software without problems and staying malware free for years .. is "performing."

Smart scan has changed, it will scan a file if it gets written and if a file is executed. For example, if I download some trojan .. it will popup detection just after the browser/p2p program/etc says it's 100%. Will get detected also when I copy the trojan from one folder/drive to another. I remember it used to detect only when I tried to run the malware.

Well, anyway afterall.. my point was that Dr.Web shouldn't be called garbage because it's a reputable AV and some people bashing it have zero experience of it or know only little about it. But I don't argue with the fact that failing tests is bad publicity.

 

Are there any tests that DrWeb still partakes in? If so, which? Or are they too good to be part of any test?

 

Perhaps they got too busy working on their famous Win32.Ntldrbot (aka Rustock.C) that they forgot there were other viruses out there?

Their front-page still claims their the only one to get rid of this rootkit. That's a bit out-dated isn't it?

 

They are listed in shadowserver.org and anti-malware-test.com .. don't know about others

 

of course it is,

its on the news..... it is dated if you look closely, 6th May.

 

My point is that the "news" is still right there on the front page, and I can't see no date. That is unless you click to read more.

I just think Dr.Web is making too much fuzz about this single rootkit, and how proud they are of being the first to remove it.

But what about other malware that they fail to detect? From my own experience from both work and helping others fixing their computers, I have encounter lots of malware that Dr.Web misses. Whenever I come across a new malware (often a trojan or rough antispyware) I always upload to VirusTotal. And very often the malware is detected by almost every AV except some of the smaller vendors like Dr.Web, AhnLab, VBA32... What can I say, it's just my experience, but I base it on working with LOTS of computers running different setups.

I think some of the Dr.Web "fans" here believe it's some sort of über-AV that never fails, and they argue with the fact that few people need help with infections when they use Dr.Web. But on the other hand, Dr.Web is a relatively small vendor, so it's not at all strange that more people get infected with Norton, McAfee, Trend or whatever...

Fewer customers means fewer users with problems - it's simple mathematics

 

yes, because the front page is made using the news section,

i dont think its the actual rootkit they are proud of, its the fact their lab found it and cured it with great work, its their lab/staff that they are showing, same thing happened with the Stealth MBR rootkit aswell this year, again the news was to show drwebs lab abilities and to show their staff can not only detect it (or to detect an .exe either) but to cure a customers computer of the threat, this is and always will be Drwebs way of business.

all av's miss things, this is the story of all, according to prevx's daily chart - the lovely Avira miss over 1000 'real' samples on 'real' machines PER DAY, but they have no removal for when the signature does arrive, so whats the point? - deleting the .exe is not a clean

but you shouldnt put too much faith in VirusTotal either, i have seen, and actually have 'hundreds' of samples that while VT says "nothing detected", on my machine.... it is detected.

fact is though, the removal is there ready for the signature to be added, and drweb offer many updates per day, including weekends if something should becoming a higher risk, i know i will be protected throughout the week, unlike alot of others who would have to simply back your stuff up and return once again to a full restore/format.

drweb add signatures for threats 'they believe' to be threats to customers
drweb add signatures only when a removal procedure has been included

Drwebs latest technology, AV-DESK is a big success so far and is helping drweb for sure, on more 'real threats' rather than a crappy wildlist, or a 1 million sample set that nobody but virus collectors will ever see, once again drweb are showing their business includes developing new technologys that 'they' have thought of themselves and creating it, again... alot of companys do NOT do this, from online file scanning right through to the latest shield technology and av-desk service for ISP's, i only wonder what drweb will create to improve next.

if not, and everything else fails, drweb offers fantastic support, 2nd to none, again unlike 'some others' if all else fails to remove such a threat, they offer clear instructions in a speedy manner.

can i ask, have you tried Drweb Antivirus?

thats my thoughts anyway, and i think some of these 'bashing' comments from 'those lot' are expected for this place.

 

Just a question, will Dr.Web be included in the August Av-Comparative test

 

C.S.J.,

I'm definitely not here to bash any product. I have nothing against Dr.Web, and I also like supporting smaller companies in competition with multinational giants. Often small companies make equally good or better products than their larger counterparts.

I have also used Dr.Web (otherwise I wouldn't comment on it ), but it has never been my primary AV. I have mostly only used Dr.Web Cure-It, but I have also used a trial version of the full Dr.Web, and done a little bit of beta-testing. Being an "oldschool" kind of guy, I like the oldschool style of Dr.Web's GUI without all the unnecessary animations and shiny buttons you find in some competitors.

But my biggest problem was the fact that on-demand scanning is slooooow Some people say it's more thorough than other scanners, but sounds a bit fuzzy without documentation to back it up. Actually last time I tried Cure-It with default settings it was less thorough than most other on-demand scanners, because it excluded a lot of files by default (incl. *.zip and other archives). But it was still slow...

Another thing; you emphasize the importance of proper cleaning. Yes, in many cases it's important. If your work consists of helping people with cleaning infected computers you would naturally choose an AV with exceptional cleaning abilities. But in other scenarios cleaning is less important, or maybe not needed at all. For instance I run AV on servers, and here I only need detection. The simple reason is that no software is ever run on the server, they are only inactive files stored on file-server, mailserver etc. So what is important is the best detection (incl. proactive detection of unknown threats). Cleaning is never an issue because the server itself is never compromised. BTW, the servers also run linux and are therefor unaffected by windows-malware. Not that it matters much though...

And it's not true that Avira doesn't remove any malware. But I think it's recommended to use safe mode (or even the bootable linux-based scanner) to fully remove active malware. Yes, Dr.Web may be better at removal than Avira, but Avira isn't useless like you seem to imply. Why does discussions like this always end up with Dr.Web vs. Avira? I never mentioned Avira... I am far from no fanboy, and I use multiple AVs on different computers (F-Prot, Kaspersky, NOD32, Avira)

And why should an AV-vendor hold back signatures because a perfect cure isn't yet available? Isn't an "imperfect" fix better than nothing at all? After all it can prevent futher spreading of new malware...

 

Unlike other fanboyz who keep interjecting on Avira threads with their rants I wouldn't come and add salt to the injury here but since Avira has been mentioned let me clarify, Avira's superior detection rate keeps you cleaner than most and when you do get infected, Avira will inform you before anyone else and will even do a fairly good job of removing most of them as indicated by tests done but then now that the tests show the various fanboyz favorites in poor light, I guess they have no relevance for them.

 

no, i didnt say you were bashing but there are some on here are do, they feel the need to enter a drweb thread just to say so.

yes, we would all like a faster scanner, me included and v5 will increase it by 10-30%, but drweb like to scan deeply with massive unpacking abilities, some may say this is useless, but if by doing this it finds just 1 infected file on a customers computer, to me its worthwhile.

i dont agree with the imperfect fix, because while it may say 'deleted', most likely it has not, and yet you would use your computer believing so, because people do trust (on the worldwide majority) what they AV says.

but to swing this back on topic, VB tests are completely useless, drweb have not had access to the wildlist files as others have or a while now (dont know if this is still the case) or maybe i mis-translated, but they still didnt have access to something that the others did, i found this to be unfair, but a big problem that drweb has with VB is the files 'they say' are in the wild and an actual threat to users, drwebs lab does not see the same results.

wont mention any names, but some AV's get the list, detect those threats just to claim this little logo on their website, even if it offers no relevance to real protection, because people do believe those to be superior, yet a few p2p downloads and that AV fails quite impressively.

AV-Desk gives drweb a very good option to see what malware actually is attacking the joe-public, and offers protection (aswell as their usual methods) for these files.

alot of the 99% avs receive the missed samples from Av-test or whatever, dont manually check them and simply just add them to their database, this doesnt seem right to me and offers no real protection. ANY av could add all those missed samples in less than 20 minutes and move on, but drweb have their methods, as do others have theirs.

 

Folks,

Read and understand ronjor's post. Using quotes to try to finesse the admonishment will not be tolerated. Stay on topic.

Blue

 

Well, I'm not a Dr.Web "fan", but just an ordinary user who is not that intrested in how much in percentages it detects here, there, or somewhere in sites like x, y, q, or z that have been testing scanners on a collections of viruses since homo erectus invented the fire.

But I do care about software that suites my needs, works well with my setup and doesn't annoy me in any way. Dr.Web does that for me.