Av-Comparatives June results!!

These are the results from June ,

-http://chart.av-comparatives.org/chart2.php-

still no improvements with Webroot oh oh oh when will they keep up there word and make the product better so the result are better , i have the feeling that i bought this product for nothing with these detection results.
Maybe i the 2013 version it will be better

Greats,

darts

 

Having trouble seeing results using IE 9.
Any help is appreciated.

 

When you want too use the link you need too do it without the - on both sites , Webroot scores 90.9% i am thinking about too use a other solution because also the FREE solutions scores better then Webroot

 

Yes. I know that. Maybe someone can attach results or create a pic as part of this thread.
Thanks.

 

FYI, I sent a note to AV-Comparatives regarding the chart.
Received a response that the webmaster is working on it and the chart
should be working again shortly.
Cheers.

 

Here is it:

 

Webroot is second.....from the last. Only AHNLAB scored higher....in 'Compromised'. Kaspersky and Quihoo tops

 

@darts,
Thanks for the chart. The result for Webroot is obviously unacceptable.

 

From these results and past results, we're seeing a trend of many samples just not overlapping with what our users see. Yes, we scored lower here, but in looking at what we actually missed, the only "user" in our userbase to have seen those files was AV-C themselves. What isn't reflected in these results is that minutes later, we caught every one of them, and, during the period where the first user was seeing the threat, we were watching exactly what it was doing on the system to be able to detect it and then remove every component of it 100%.

I'd certainly want our score to be higher here, and the changes for the 2013 product will definitely improve it (and 2012 will be auto-updated to 2013), but I don't think this is as apocalyptic as some users may think.

As a side note, these scores were not caused by what we saw in the past with the anti-FP issues - that fix was indeed still in place. We also had zero FPs in this test, as a data point.

I pose the same observation as before: our customers have been happier than ever and we see very, very few infections which WSA doesn't take care of automatically. While third party reports are definitely helpful to get an external data point, don't discount your own experience with the product. If anyone ever has anything get past, please write into our support inbox but also send me a PM or post directly as these cases are rare enough to require personal attention by myself and other members of the team.

 

Yeah Yeah same story evertime but all the other vendors score well with the same samples so the problem i with Webroot , whe pay a lot of money too get protected by Webroot but we see very bad results . If i wanted too be protected good in 2013 i did bought a 2013 version and not a 2012 version because it is a waist of my money then or am i wrong

 

You'll be upgraded for free to 2013 when it's released.

Has Webroot ever missed anything on your system? If not, then I would think there isn't an issue. Every vendor has a different mix of users - our userbase is built of a large number of retail customers and primarily US-only at this point, which will certainly affect the types of samples we see in relation to other solutions.

 

What is the benefit of catching malware "minutes later" if I'm already infected? Aren't there proactive measures in place?
Thank you.

 

Yes there are, it's only relevant for the absolute first user to ever see the threat where it could get through more often (although that's the case for every solution).

Even if we miss it on that first instance, WSA is transparently sandboxing the sample as it runs to journal exactly what it changes on the system. When it rechecks the file with the cloud and it's found to be bad, it will be automatically removed and every change completely reverted.

 

Nice result from Avira.

 

Unless you're the first user to see the malware. In that case, you're infected. Correct?

 

Not always - we block a very large number of threats on first sight (several dozen of the files that we caught in this AV-C test were also first seen by them). Even if you're the first user to see it, we'll likely catch it automatically shortly after once we know more about it, even if no one else has seen it yet. The agent automatically rechecks with the cloud when it knows something untrusted is running.

 

Yeah but have 240 days left where i did pay for , and a user needs too feel save with his antivirus and these tests are a good line too look at and if you see that all the vendors score better then Webroot then there is something wrong with Webroot , and when i get infected before Webroot knows the virus then i have a problem.

 

Time does play an important part in detecting samples. You might be interested to know Nossirah (from Malwarebytes) is conducting a test on 1 0-day sample as mentioned here. At the start 2/42 vendors detected it, but almost 12 hours later only 10/42 vendors detect the same sample.

 

8 more detected it 12 hours later, but what was the virus doing for those 12 hours? What about the other 32 that might not detect it until a day or a week later? Bleh.

Knowing how Webroot works, the fact that it does completely wipe out the infection after a few minutes even if it was unknown the first time it scanned (I've seen it do so often enough) makes me trust it more than things that score high. 100% on AV-C doesn't mean 100% everywhere. I can still hunt down obscure infections all over the place that AV-C never finds to use in their testing, and find those infectors triggering 0 on VT. Then toss it at WSA. Sure, it installs, and runs for a few minutes (worst one ran for half an hour before getting killed), but then it gets wiped out. Three days later, still 0 detects on VT.

WSA worst case: 30 minutes of being infected by something that NOTHING knew about. Averaged under two minutes.
Everything else would have left me infected three days later.

 

hello

is it not against the rules of Av-Comparatives and or Wilders to post that chart here ?

just wondering

thanks

 

That's a good point - it probably isn't legal. I'll remove it from the thread. Thanks!

 

I second that completely TechFox.

It is clear that no AV/ISS can cover the bases 100% given what is out there. I think that you are right when you say that there is a need to understand and focus on how quickly an AV/ISS detects that it is out of date and then how quickly it does what needs to be done to secure the 'perimeter' again/deal with the nasty that has gotten in.

I believe that WSA is ahead of the curve re. this...so far ahead in fact, that the test in fact works against it and the way it handles the above situation.

Just my halfpenny's worth...for what it is worth.

Regards



Balders

 

I agree completely with you and Techfox.

(and, I'd give my halfpenny worth, but the US hasn't had a half cent since 1857 )

 

That's my fault for requesting it. The website is working fine now.
I apologize.

 

Could you please explain why this is so?
Thank you.