NOD32 vs. VBA32 vs. DrWeb

Hello,

quick opinions on these? current and long-time NOD32 user here. lately have noticed the NOD kernel taking a very long time to scan certain files, and generally not so happy with NODs exclusion feature which has been an endless problem for me... so sniffing around for potential alternatives...

Have seen some good things re: DrWeb + VBA32 and looking for honest unbiased opinions.

I am by no means bashing NOD32 in fact still think very highly of it, just wanting to see what else is out there.
thanks

 

I have valid licences for both NOD32 and VBA32. I have been using NOD32 for a while now and have not been very satisfied (other than the price with a student discount). It is a great AV for people that want a set and forget product, which is why I recommend it to people, but I personally prefer VBA32. I consider it to be a cross between KAV and NOD, a combination of heuristics and signatures. There are four levels of heuristics in VBA32 and currently 114000+ signatures. The maximum heuristics can lead to false positives but once submitted they are easily corrected. I often get responses within hours. I am very impressed with it.

 

thanks n8chavez, I'm interested in any further info regarding stability and system resource usage. From what I understand VBA32 is extremely light, using about 12MB of ram and only a single running executable. Have you found it to be stable enough for rigorous daily usage?

 

I have never seen it that light on my system, I guess it depends if you use Rambus ram. It is pretty light on my system NOD has been increasing its resource usage as of late and I find that VBA32 is close to NOD now. There is an option in VBA's real-time monitor to include only new or modified files, which will help with resource usage. I think it is very stable. Also, the price of VBA32 is very competitive and is cheaper than than the regular ($40) price of NOD/per. There are no actual tests (such as VB or av-comparatives.org) that include VBA32 yet. But it is definitely one to keep an eye out for. I feel completely safe with it and use it on a daily basis.

 

These 3 are lightweight AV's, all with very good heuristics.

1. VBA32 Personal's RTM has 1 running process showing 18-24MB VM usage on my system but it still appeared very light and no slowdowns were apparent. The full and beta versions have been very stable if the Anti-Dialer component is not installed. Support from Belarus is very quick and excellent in solving problems. They have added over 80,000 signatures in 8 months so they don't hang about!!!

However, minor problems include the fact that the GUI can appear confusing to newbies, it has no scheduler, and trojan/backdoor detection could be improved. On-demand scanning is very slow, compared to most other AV's I have tested/used. Despite the results over at Jotti's, the big minus is that its detection rate has not been officially measured on any of the major AV testing sites as yet.

2. Dr Web has the smallest memory footprint of the 3 AV's considered ( 2-5.5MB VM )and in Smart mode it is probably the lightest AV (this includes F-Prot) on any of my systems. Again very stable and incremental updating is very fast, as updates are very small with files of only 3-4kB. One of the best AV's in dealing with malware. Generally has performed well on a variety of testing sites and probably the best unpacker of the three.

However. its on-demand scanner when scanning all files is, apart from Norman, the slowest I have used and support can be very patchy.

Comparing your problems with NOD, IME, the NOD on-demand scanner is much faster than those of VBA32 and DW, but the exclude seems to work very well in the latter 2 AV's.

If you are thinking of a replacement to NOD, of the 2 alternatives I would select Dr Web for the simple reason that you have some evidence of its detection rate on a wide variety of testing sites. VBA32 is very promising but I would need concrete testing of its abilities before I considered it as a primary scanner.

BUT see if you can sort out your problems with NOD first before testing out any alternatives

 

Exclusion in NOD32 is kinda buggy because you have to enter 8.3 format folder/file names to properly exclude certain items. But other than that it works.

 

Thanks to who ever copped my screenshot. I don't know how to do that.

 

Next time, try using Alt + Prt Scr

 

IME with the latest batch of SDBots running around, VBA32 and Dr. Web have been finding them but for some reason NOD hasn't.
Just a personal experience.

VBA32's interface can be a bit confusing at first but then again you have been using NOD so you are used to it. Also the lack of a scheduler means you have to be more involved in the scanning/safe keeping of you files. But I choose that over the added memory usage of a schedular any day. And yes disable the AD as it is known for problems, I just do a custom install and leave it out along with other things like the sounds, Mail plugins etc. HTH
I have been using it as my primary scanner for a few months now and it has not let me down yet.

 

I recommend VBA32.
The price is comparable to Dr.Web and the support has been better for me.
The updates are incremental and VBA32 does run light.
Resource usage is generally around 25k for me.
I like the configurability,especially with regards to heuristics.

I can't argue with the assessment about scanning speed.It is slow.
That doesn't bother me at all.
VBA32 is the only a/v that I use and it has done the job for me.

 

I was working on my sister's computer this past weekend and I ran scans with both VBA32 and NOD32; VBA32 found malware that NOD32 did not. I cannot remember that they were specifically but there were like six or seven of them. Also, I used Dr Web's CureIt and it also found two malware(s) that NOD32 did not. But I agree there needs to be actual test results as to the effectiveness of VBA32.

 

I suggest that you submit those samples to support[at]eset.com with a link to this thread, maybe they'll turn out to be non-functional or harmless files. If you find some other suspicious files not detected heuristically nor by generic detection, please send them to samples[at]eset.com

 

well this was quite an un-scientific test but after downloading and testing both Dr.Web and VBA32 I have reinstalled NOD32 and will just deal with its (few) shortcomings.. those others slowed down my system noticably compared to NOD and I did not find them particularly intuitive to use. Can't say much about detection rates because I am not currently infected ......

so now I sit with NOD and just hope for v3.0 early next year