KAV based scanners... compare... again?

next time i get my hand on one that's undetected by KAV based av's i'll send a copy to you

just PM me the email addy you want the sample sent to

 

great!
... err... which mail provider doesn't have an AV installed?
I guess... hmm...
well... my friend's isp doesn't... and he's got a 50 MB account vacant...
I'll check out the TOS soon.

 

Firecat...
relax my friend.
I shall reveal my location not yet.
Maybe, if someone proves that the semi-hyper paranoia I feel w.r.t. my anonymity is useless considered the resources I'm spending... [0 bucks... tonnes of time and effort]...
then I think I'll probably reveal all...
I've had a long chat with JB too on this. And he concurred. At that time at least...
Or you could ask the admins.... they'll give you ip's from all over the place.... IPs from Indian ISPs [tonnes of them... all dsl... I have friends ] some italian, a couple german... and now from the TOR network.

Any ways... enough off topic discussions....
get back on track people!

 

Hey no13,

Check FastMail.fm. Free acounts here have no virus protection and even for paid accounts they recently switched from king to beggar i.e Kaspersky to ClamAV.... Make an account here for your viruses...though you get only 10MB... you can try unitedemailsystems.com they mention no AV protection.
eScan will recieve definitions for new viruses two hours after Kaspersky (eScan therefore is closest to Kaspersky. If Kaspersky puts definitions in 16:00 update, this update will reach eScan when Kaspersky releases 18:00 update..).

EDIT:- By the way, who is JB?

Firecat

 

Hi Firecat

It sounds to me like you are very close to the people at escan ??

If they could update their interface and engine to something a lot less complicated and user friendly (like Defender Pro - Kav5) I'm sure they would get a lot more business at a sensible price.

I like the software a lot but is too complicated for a novice (or too annoying for an accomplished user) to get right.

Maybe you could drop the hint.

 

Ianb,

How did you guess? I am pretty close to those guys. I test their eScan line of products and have already given many many suggestions and reported bugs to them (and I still keep doing so). Don't worry, your comments about the interface were mentioned a long time back. I had even been called to their office for they were impressed by my efforts in testing and bug reporting. That day we discussed a few things about the market and I presented all my ideas to make eScan a better product. Sometime this year you'll see a new product line coming out from MicroWorld. That time you'll see the fruits of all that I had suggested. Even some new features....I won't ruin any of the suspense.

I know its very hard to believe given my age (Check my account details), but it happened. Even their CEO, Govind Rammurthy knows me pretty well (I saw him too personally, and we were all sitting in the same room and discussing business)

The following matter was added with the edit:-
Actually, the matter of fact is that Mr.Rammurthy (and MicroWorld) wants to perfect eScan before trying anything else at all. Therefore he'll welcome any suggestion which he thinks would improve the end user experience. Only thing is that he wants it in a written (typed) manner, not just word of mouth.
So, if anything at all, do not hesitate to drop a line to support@mwti.net or govind@mwti.net
<End of edit>

I saw at least one person from every department that day (January 13). I'll take your comments as proof to verify that the market does require a simpler interface. By the way, can you e-mail (check my account details) me telling me what kind of interface you'd like? It'd help me a lot if I got some feedback from different users on what the interface should be like. I have given my own description to MWTI but I think it may be a wee bit tedious to configure...

How do you think of security levels to define the settings in eScan? Do tell me how you want the product to be. I have been told to gather such information. Also, would you like a quarantine feature? And would you like suspicious files to be submitted to MWTI using its own SMTP engine through the quarantine?

Also, here at the forums, one of the tech support personnel thrive by the name of prabinvijay. He has not taken part in a single forum though.

Thanks for the suggestion. It's only this way that MWTI can improve their products to offer an excellent product suitable for novices and professionals alike. Do keep the thoughts flowing, either to me or to MWTI support. Either case, they'll get your message, I promise. I will drop your hint tomorrow, AND I'll tell one of those guys to see this forum.

Hey...By the way, the 'Prompt required action' bug seems to occur only on AMD Semprons and Athlon64s not Intel PCs. Unfortunately, MWTI's only got Intel in their QA department, and following my suggestions, they'll get a few AMDs in there soon.

Best Regards and a good life always!
Firecat

 

Thanks Firecat

I will reply fully tommorrow when I have some more time.

 

Ianb,

Try PMing me about the issue if you cannot get my email address.

Regards,
Firecat

 

don't worry about AV's when i send a sample to you:

1) its an undetected virus

2) it will be in a password protected .rar archive

 

Thanks
reverseenginer_no13{at}yahoo.com

Firecat (it's not your first name, is it?)
JB=JimBob1989
nice guy.... a bit too fast on the trigger, but honest guy anyways.

hmm... what about eScan's product range? their website isn't exactly helpful for a layman....

 

no13,

This MIGHT be my last post of the day. I got a test tomorrow sigh.

Firecat IS my first name and I'd be hard pressed to reveal my last name....

Regarding eScan's product range, those ppl offer so many products in their line, one'd get confused..

In their marketing campaigns they mention the following products for Home users:-

1)eScan Virus Control Edition - meant for home users who want decent security at cheap (so they say) prices. This one comes with the following features:-

- AV Scanner
- Real time monitor
- E-Mail Scanner (scans for malware and restricted keywords/phrases)
- Anti-Spam
- Remote Access File Rights/NetBIOS firewall (not the normal type, this one will block the hacker from modifying any file on your hard disk, but does not block ports. It will allow hackers into your PC, but will not allow them to touch any of the file types specified by MWTI)

2)eScan Professional

- Meant for advanced users with a bigger pocket and those who want more security. Includes:-

1)All features of Virus Control
2)Parental Control features (ability to block websites based on restricted keywords defined by user or ratings-based)

3)eScan Internet Security Suite - A full system suite offering various utilities to keep your system in good shape. Meant for new PCs and existing PC users who want maximum security and privacy. Includes:-

-All features of Virus Control and Pro
-Popup blocker for uninterrupted web browsing
-Browser eraser for cleaning of clutter in temp folders in order to secure your privacy.

Apart from this, one product is not advertised most of the time for home user, and that is the eScan Anti-Virus edition. You can still buy from their website or any retail outlets, though. Features are described below:

- Real time scanner, it says that it even scans e-mail for viruses
- AV scanner

Cost outside India (not including taxes):- USD 58.95 for Internet Security Edition, USD 25.00 for Anti-Virus edition, USD 45.95 for Virus Control edition, and USD 54.95 for Professional edition.

Cost in India (excluding General Service Tax):-Rs.1093 for AV edition, Rs.2008 for Virus Control edition, Rs.2275 for Pro edition, Rs. 2305 for ISS

India (including GST):- Rs.2750 for Internet Security, Rs.2184 for Virus Control and Rs. 2528 for Pro edition (AV edition is not advertised).

Hope that helped. Bye for today

Best regards,
Firecat

 

Ianb,

I thought you were going to give me a reply? Please do. As I mentioned earlier, word of mouth from the layman will further encourage MicroWorld to enhance their product's interface. I am not exactly a layman, so my idea of an interface can be more complex than yours. Therefore, please try and spend some time to provide me the necessary information on how the interface should be. Also mention how you want Content Administrator's (y'know, the module from which you control the E-Mail Scanner, popup blocker etc.) interface to be.

Do you like the idea of having a single user friendly application from where you can control the entire plethora of features? Do tell me please.

Regards,
Firecat

 

What is the resource/memory usage of the latest version of Escan AV?.

Last year I tried the 2003 AV only and found that you needed a fairly fast computer to run it without a performance hit. Has this improved of late?

 

Hi Firecat, hope the test went well.

I would like to see an interface more like the one in KAV 5. A plain control panel where you can quickly and easily set detection levels for both "On Demand" and "On Access" ...... ie HIGH DETECTION - RECCOMENDED - SPEED. But, also an option to enter and modify these settings for advanced users. All security settings should be a breeze. A quarantine feature would also be good.

http://www.kaspersky.com/imagesen/screenshots/kav50pers_settings.png
http://www.kaspersky.com/imagesen/screenshots/kav50pers_settings_od.png
http://www.kaspersky.com/imagesen/screenshots/kav50pers_settings_upd.png

 

Blackcat,

I also tried the 2003 edition. Now it has improved, but that could also be because I upgraded my RAM. There still is a slight performance hit, though for me its nothing to worry about. What I did observe was that it seemed heavy during the first few days after installation and came down after some time. But I'll tell you... Do try it again. I feel they have improved the speed somewhat, and many improvements have been made. But the On Demand Scan still eats CPU like no other AV has on my system... Real time scanner does not seem to be a problem.

Resource usage (eScan Internet Security, NOT eScan AV edition) - Quite a lot, but not slowing my PC down

AVPM.exe - Monitor, can use about 768KB-7MB (Normally 4 or 5MB)
AVPMWrap.exe - Monitor Wrapper, uses about 3.2MB
MailScan.exe - E-mail scanner, uses about 3.1MB
TRAYSSER.exe - Dunno, possibly updater related, uses 1.5MB
KAVSS.exe - KAV Single Scanner Interface, uses about 10.5MB
MailDisp.exe - MailScan related,uses 1MB
Trayicos- eScan updater - uses about 10MB

Total = 33.3MB (can vary, Can go to 1/4 of this while playing games) I think this is more than Norton, but still does not slow my PC down like Norton.

If you have a 800MHz processor or better with *more than* 96MB RAM I think you'll be fine.

EDIT:- Since I have two OS (Windows XP Home and Pro) dualbooted with same software except AntiVirus/Firewall, I am seeing that my PC runs faster with eScan than with KAV 4.0 (did not have trial of 4.5 but I think resource usage would be the same), McAfee VirusScan 7 and 8 and Norton (remembering from past experience). Also note that here the resource usage is of eScan Internet Security Edition. The AV edition I believe should be a lot lesser. I'll let you know in a 3 days; I have the trials of all eScan editions.

Regards,
Firecat

 

Ianb,

Thank you for taking the time for this. I also wanted to ask how would you like interface of the additional software like popup blocker, Webpage scanner etc.? Please try to give a reply. I know this is wasting your time, but then it would help a lot of current eScan users, plus it would improve MWTI's business.

Would you like those settings (for popup blocker, e-mail scanner, webpage scanner etc.) in a separate module with an interface similar to the KAV interface? I mean for example, On the left side of screen, you can have the buttons like e-mail scanner, popup blocker, etc. on the right side, as usual the plethora of settings?

Relating to webpage scanner:- Suppose you want to block sites with restricted words/phrases, then would you just like an Activate/Disable button with a security level based on ratings, with an 'Custom' button for specifying own settings?

i.e. Low security - Predefined phrases
Medium security - Content based on ICRA rating
High security - Content based on ICRA and RSACi ratings

TIP:- If you want to customise your options, click on the Custom button.

Anyhow, however you like it, do not hesitate to tell me!

BTW, thanks. My test went reasonably well. I wont fail. I want get a full 100. But atleast I'll get something in 70s-80s.

I've got to go out today. I might only be there another two hours. See you tomorrow if not today. As I don't have enough time, I'll send your suggestions to MWTI tomorrow. I hope its OK (sorry if its not)?

Regards,
Firecat

 

I don't know about other people but I hate seperate modules. EVERYTHING in one single control panel is what I would prefer.

Exactly like that, nice and simple.

Are they working on the Sempron \ AMD 64 Bit problem ?

 

Maybe a 'smart' scanner as with Dr Web and KAV

The systems on which I tried the AV Edition were all much more powerful than the one you quote, yet I found considerable slowdown!

KAV 4.0 initially was a complete resource hog so maybe not the best version of KAV to use for comparative purposes. Have you tried the latest KAV 5 Personal? This runs very light on one of my older computers here and I would take a second look at Escan if it ran as light as KAV 5.

Thanks for your efforts on keeping us all up to-date with Escan, Firecat. Most people know of the free AV scanner that Escan provide but have little knowledge/use of the commercial scanner.

Maybe worth a little review if you have time

 

I guess he should be called "eScan expert", yes?

hey... someone.... share what you know about other KAV based AVs [GDATA/F-secure 2005 users... wink.gif]

 

Blackcat,

I am refraining from the trial because of the ADS tagging and also because I might be buying it soon enough (by two weeks, two choices - McAfee or KAV Personal Pro - Do you think I should save money by buying KAV personal instead of pro?)

I feel eScan may not be a 'smart' scanner like Dr.Web or KAV, but since there is a file called iChecker.ppl in its directory, I feel the iChecker technology may be used. I only have one FAT32 partition though (others are NTFS), so I thinks its iChecker AND WinXP's so called 'self-optimisation' feature, huh?

I don't know too much about slowdown problems, except that the first build I tried was noticeably bogging down my system and the latest build only slightly bogs it down. I did notice that my older Pentium 4 had more of a hit (slightly) than my current Athlon64.

Actually, the matter of fact is they are using an old monitor module,KAV monitor 4.5.0.58, which is not optimised for 64bit/Physical Address Extension and Multithreading/Hyperthreading. I believe performance improves quite a bit with 4.5.0.94 and above? I will do a review soon. I don't feel very good since yesterday. I'll get a review done in a week.

Regards,
Firecat

 

in a few days, KAV pro's new version will be seen sans the istreams modules.
wait a couple of days for your trial version.

 

Ianb,

What if the control panel is maximized (by default)? Would that be OK? Cause I feel that if they are to include that many features into one control panel, it should better be maximized.

As for your suggestions, I'm sending them right now. Regarding the AMD64/Sempron problem, I have not got any updates, I'll speak to them.

Have a nice day!

With Regards,
Firecat

 

no13,

Thanks for the information. I just learn more and more of AV programs as I keep using them. For example, by using McAfee, I learnt a lot about Trojans, and how Norton and PC-cillin do not remove registry entries of malware. While using eScan, to my bad luck I came across a lot of bugs which were fixed, but I did have to wait a bit. Looking at the files a bit, I got to know more about the program.

Well have a good time!
Firecat

 

Ianb,

One guy was telling me that the prompt required action bug has been fixed and we'll see it in next build. But the others tell me they have not seen it happen! I guess we'll have to wait to find out, huh?

Firecat

 

By the way, I heard KAV based scanners are not that good in unpacking capability as KAV itself. I would like to question this as unpackers are all handled by unpack.avc file which is latest for all KAV clones too. So I feel unpacker should be the same. Can somebody clarify this?