AV-Comparatives June (May 2007) Results (Retrospective / Proactive Tests)

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Well keygens/cracks or not, thats still a false positive and as such it may or even will cause problems on other files not even virtually similar to keygens or cracks.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Are you talking about pskill being detected as an SPR? This isn't a false positive, it's a deliberate signature detection, the same as some AV's detect for example restart.exe (used in some spyware removal tools) or process.exe (used in smitfraudfix smitfraud removal tool) as 'riskware'.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

For all those witch-hunters who are trying to lynch AntiVir for it's FP's, you'll be happy to know that it just passed the Virus Bulletin VB100 testing with flying colors - in other words NO FP's!

By the way, Kaspersky didn't if you want a new victim

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Rejzor: I'm not quite getting your conclusion from cracks getting detected leading to other things getting detected. That's rubbish. Cracks are illegal, and for all I care they could even add a CRACK/ detection. Using cracks is always a risk, and I'd rather not have them waste time on trying to NOT detect illegal software.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

All because a detection had been removed from the database while a correction was being made to it.

I think the major problem here is understanding these kind of tests, and what goes on behind the scenes with them. VB100's results are only fully accessible if you're a paid-up member I believe so it's hard to make complete judgements without knowing the full facts.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Fine, i don't care either. But every wrong detection be it made on legal or illegal content is bad. And even worse for other legit files with similar characteristics.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

It's pretty safe to say that VB100% doesn't use near the amount of samples compared to AV-Test & AV-Comp, and from what I can tell they are not using advanced settings.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

As I stated earlier, IF an AV has configurable heuristics sensitivity, THEN that AV should be tested separately for each setting of its heuristic. For example, Avira should have been tested 3 times: #1 Avira-high, #2 Avira-medium, & #3 Avira-low.

Further, since the default setting of Avira (out of the box) is medium, the fact that AV-C tested it on high setting ONLY, & then faulted it for FPs, seems questionable to me.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Rejzor: What makes you draw the conclusion that FPs in legit files are not removed because FPs in cracks are not specifically removed?

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

You are trying to compare apples with oranges. The VB test for FP's has nothing to do with heuristic detection. KAV failed because of ONE IN THE WILD SIGNATURE FP not heuristic FP.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

There was no FP from KAV, it missed one sample ITW, the definition of which was temporarily removed from the database for the purpose of reviewing/fixing at the time of testing, which is why it failed. eScan seems to not have had this anamoly, which proved lucky for them.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

I feel that I've made the right choice with Kaspersky and this test of 7.0's heuristics reinforces as much. 35 percent is very very good for a brand new heuristic engine, especially when taking into account the lone false positive on The Comparatives.

I sampled Avira a long long time ago.. before it was so highly regarded.. I did so because even then it was the most highly regarded free choice.

It's a definite quality program and a great choice for many people. The same can be said for Nod32 which I really liked (with the notable exception of the slow browsing with imon enabled)

Even Norton's gotten alot better as I've seen on my father's computer when visiting his house.

Kaspersky's for me though. I love the hourly updates and just how well KIS 7.0 has been running on this pc. That alone is enough to sell me.. and then add to that the improving heuristics and proactive defense module and I can imagine it only being a matter of time, before Kaspersky is back to leading the pack in detection.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

I don't think KAV removing detection temporarily is a defense against the VB100 failure. All tests measure a point in time. At that point in time, KAV didn't detect the threat, and if you were running KAV and encountered the threat, then you would be infected. KAV has an excellent VB100 track record. Next time they'll probably pass. This time they failed.

/jab

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

I wish they had tested KIS6 against KIS7 against the same sample set. WIthout doing that its hard to tell if there is an improvement or not.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

I also think programs should be tested at standard settings as most users at home probably just will install and rely on standard configuration. And you can also not expect the average user to know how to configure an AV properly. The AV companies should try to fine tune their settings so that detection is maximized subject to minimum FP's. That would in my opinion be the best default option and that should be used for testing. If power users want to deviate and use more aggressive settings at the expense of more FP's, that's fine then, too, but of minor importance to the average user.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

I agree and any tests performed based beyond what 90 percent of the average person would naturally leave theirs at out of the box, are invalid in my thoughts.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

There should be two tests, one with standard/ default settings and second with max settings.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

this would be nice but it's double work for the tester.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Don't understand "not present anymore.." please clarify

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

it means they fixed them after i sent them the FP's.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Maybe I'm missing something, but I'm a bit alarmed that Kaspersky removed an ITW virus from its databases, even for testing purposes. Isn't testing like that something that's done internally? What about the people who ended up getting this virus because the protection wasn't there?

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Thanks, IBK.
Sort of like closing the barn door after the horse has escaped. Fixing it after the test is too late.

But it's good they are using your results to improve their product.

I'm working on an update to my Simplistic Method of selecting AV's based on your data. Will post here when done. You and Posters may recall my quest to try to remove emotion and product loyalty as factors in selecting. You gave me leave to use your data for that purpose but you are in no way connected to the methodology I use.

Of course it is just one posters view.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

I dont think tests should be done by default settings as it does not show the full capabilities of the antiviruses. The average users should learn to tweak their antivirus. All you have to do is know how to read.

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Right! As well, use the information read and verify it. User manuals are not always 100% as they are written by humans and we know what that means!

 

Re: AV-Comparatives June Results (Retrospective / Proactive Tests)

Someone might respond: "Do it right or not at all."