Heuristics in action

Can't find the AV test thread that had a text file of fresh 10 malware sites in it ? Maybe it was removed Someone would have to go through several hoops to actually get to those sites though Anyway glad i got it whilst it was there Thanks to whoever it was

Visited all those 10 sites in the list, and one in particular was so FULL of assorted new nasties i lost count. I managed to get into their directories, yes many of them, and pull out every dodgy looking file i could find. As they were chockablock with stuff it took me quite some time to do this, and download them all. Nearly gave up there was that much

I had to 7Zip and upload them in FOUR seperate stages, including a rapidshare link for the extra large files. I used http://analysis.avira.com/samples/index.php and virus@avira.com via hotmail. As AntiVir are good enough to supply me with a Top free AV, i feel i'm doing my bit by sending them whatever comes my way, fair exchange i say.

Anyway what follows is just the tip of the iceberg, from their first report batch. A lot of them were caught by AntiVirs heuristics as i tried to download them, and before i did.

Click image for full size



Looking forward to the next reports on the others. Well done Avira.

 

Which version of Avira did u try?

 

@icr

More than try i've been using for several years.

Avira AntiVir Personal Product version 9.0.0.419

 

Looks more like viruses known, well they have names at least

 

@Noob

Yeah that's because Avira named them after anaylising them and discovered they were Actually malware.

The ones that were intercepted and detected by heuristics as i tried to download them, were given temporary names that appeared to be similar in certain ways to known threats.

Take another look at the screenies descriptions.

 

It's the only free AV I'll ever use Nothing else has ever impressed me,period.

 

avira having best heuristics in terms of false positive.it is just like a Japanese samurai sword who using it based on that fact it will be useful. if nobody understand my posting sorry i not able to explain more than this bye bye

 

What a BS.
In more than two years using Avira Premium, I just had one FP: exactly 1.
That one was corrected within one hour! Yes that's right, within one hour.

 

Your experience doesn't make someone else's experience "BS". The facts support him if you look at tests.

 

I agree with Elapsed. The only BS would be the fact you only ever got one FP with Avira.

 

Fact of the matter is Avira has excellent heuristics. Have used it for years and had only a few false positives. Guess the fact that everyone surfs in a different way diferent sites etc. will also make a difference. As far as the tests go I take them with a grain of salt. I remember some time ago a top AV that I used because I went by the tests let many trojans in. Have had Avira for years and in the real world has protected be very well.

 

3 years and 0 false positives but I probably don't surf on the dark side that much.

 

I have been using Avira on demand for over 1 year and I have had 2 false positives which were corrected within a few days. Both files I knew were safe anyway. The fact is that I would rather my antivirus be paranoid than to miss things. The way I use it on demand suits me well. For the not so knowledgeable, it might be a problem. But from what I am reading here, it would suit everyone on this forum just fine.

 

Without the latest VDF.It is Avira's proactive detection technology?It is as the same as Kaspersky's HIPS?

 

Avira have a very strong HIPS..Even we have saw this on last year AV Comparative tests...

 

I have had the same experience with Avira. Only a couple FP's over the years and I run my heuristics cranked to the max. But the detection of actual stuff is very very good. I am a happy Avira camper.

 

Hmmm, so now you know what's going on, on other peoples computers as well?!....You never stops to amaze me, trjam
By the way, every AV and/or IS have FP's from time to time, claiming different is BS to me


Cheers

 

Avira does NOT have a HIPS.

In the near future, Avira will have a behavior blocker (of sorts) when version 10 (now in late beta) is issued. But it has not had any HIPS in the past. It has had excellent heuristics, but heuristics is not HIPS.

 

Have you seen AVC's comparative test where Avira got dropped down an entire rank because it had to many FP's?

Avira flags alot of harmless files as FP.

 

They can drop it 5 ranks for all I care. Tests mean nothing in real world protection.

 

That's funny, because I'm pretty sure most people started using Avira in the first place because of tests!

 

In the real world those FP's can render your OS useless.

 

Depends on the context. But yes, it can, although this is completely user dependent. What might be more worrying for others are those FN's (false negatives) destroying your computer.

 

Aviras detection rate at AVC of 99.7% is because of FP's. Without those FP's its detection is much, much less making it worse than the next best that doesnt have FP's.

Id rather get a virus that wipes out my system and destroys the MBR rather than have Avira delete my important Windows .dll files and figure it out in the middle of something important when the system crashes or doesnt load.

 

Wait, what do FP's have anything to do with TP (True Positive) detection rates? I think you have completely mis-interpreted the data there.