My review of eXtendia AVK Antivirus System.

eXpendia AVK Dual Engine Anti-Virus/Trojan Review
By: Kobra 5-24-04
http://www.extendiaavk.com/

My interest in multi-engine AV/AT products was peaked when I saw how well F-Secure handled many uglies due to its multi-engine layout.. Obviously the multi-engine system seems like a wonderful idea - 2 is always better than one, right? I'd have to say, in my opinion, the best security is layered security - I often see security concerened people running a resident AV(antivirus) and AT (antitrojan) products along side each other - some even add spyware/adware guards ontop of this as well. The layered system does work, in practice and in principle, so why not a layered AV product? The two multi-engined Antivirus products out there are F-Secure which uses Kaspersky(KAV), and two proprietary engines (Orion and Libra), and eXpendia AVK which uses KAV and RAV engines.. Since most people know about F-Secure, I wanted to obtain a trial copy of AVK for testing, as the concept sounded great... The eXpendia folks were nice enough to provide me with a full working version of their product, with a 30 day trial key, which allowed me to run a battery of tests on this product.

The install was smooth, simple, and very well done. Nothing crazy here, and it was quick and efficient, not even requiring a reboot of the system. Once the install was finished, the program contacted the update locations and grabbed engine and definition upgrades for both the Kaspersky and RAV engines respectively - neither the program or windows required rebooting.

Once installed, and operational, the first thing I noticed was the TINY footprint this product has on your system - only about 8,000-9,000k on the high end. See photo:

http://home.comcast.net/~prolawn00/cpu.JPG

This was quite nice to see! Especially after half a day of testing various products that consumed up to 50MB's of RAM! Ouch... Another thing I noticed, was the interface of this product is *GORGEOUS* and well layed out. Best of all, everything on the front-end was user friendly, and on the back end it was loaded with hardcore techie tweakability.. Whoever designed this product, knows how to appeal to both the novice and the professional..

http://home.comcast.net/~prolawn00/menu1.JPG
(Frontend)

Next, I checked on how the on-access, realtime scanning options are layed out. The first menu, presents user friendly, and easy to understand sliders, where you can compromise speed over protection, or a mix of both, or anything in between! The "advanced" tab in this menu, allows you to go deeper, and expressively set other aspects including the methodology of how you want the on-access/realtime scanning handled. An interesting thing to note here, is that you can do this SEPERATELY for the on-demand and on-access parts of the product! Therefore, for hard drive scanning, you could set it to scan very deep, with both engines. But for on-access/realtime, you could set it lighter and use either the KAV or RAV engine, or any combination of...

http://home.comcast.net/~prolawn00/menu2.JPG
(Monitor settings)

http://home.comcast.net/~prolawn00/menu3.JPG
(On-demand scanner settings)

For mail programs the product comes with an integrated module for Outlook/Outlook Express, that puts the controls for the AV directly on the toolbar within the email client. It places the options for the product within the email programs options menu. For people who do not use Outlook, you can totally configure any other program or generic POP3 scanning via ports - which should mean 100% compatibility with any mail client (I tested it with 4 different ones). AVK scans OUTBOUND as well as INBOUND emails, which many AV products lack. There are a plethora of options on how to handle infected mail, including sending out notices to another email address, automatically sending out a warning to the person you recieved the infected mail from and more. (configurable of course)

http://home.comcast.net/~prolawn00/outlook.JPG
(Outlook integration - Pop3 Support for ANY mail client)

All of this is great but if the product doesn't seek the baddies well, then a fancy interface and options mean nothing.. This product uses the Kaspersky Engine with around 90,000 Definitions and the RAV Engine with close to 100,000 Definitions. Each engine uses its own definitions for comparative double analysis, effectively giving you nearly 200,000 possible definitions! Combine this with dual heuristics, and you see why this product consistantly scores perfectly.. To start off, lets throw some Eicar files at it..

http://home.comcast.net/~prolawn00/eicar2.JPG

http://home.comcast.net/~prolawn00/eicar1.JPG
(Many AV's miss this one)

Another cool thing was AVK picked up the archived test files immediately at download - without fully downloading them - including the double-archived variant. Other products i've tested, let these download, and they are only detected if you open them.

http://home.comcast.net/~prolawn00/eicar3.JPG
http://home.comcast.net/~prolawn00/eicar4.JPG

Next up I used AV Tester 3.0, which basically creates fake trojans that mirror real ones, and creates variations in realtime - mostly this is to test on-access memory monitoring heuristics. Its a pretty effective test it seems - and several AV's and AT's miss these completely! Results from AVK were quite impressive here..

http://home.comcast.net/~prolawn00/avtester1.JPG
(AVK wouldn't even let the file execute, in fact, merely moving "near" the file tripped off a full file-lock on it.. Apparently AVK heuristics are picking up slight traces of the test files signatures within the program itself. Note how it labeled it a "Generic" VBS trojan. This indeed is impressive to me, and out of every AV product i've tested, this is only the second one to do this. Needless to say, to continue these tests, I had to add this program to AVK's exclusionary list)

http://home.comcast.net/~prolawn00/avtester2.JPG
(AVK aced all of the tests, using Heuristics - labeling them as "Generic" for the most part.)

Ok, so now that the synthetic testing is done, how about a *REAL* badguy? First, I wanted to see if AVK was cheating on Eicar, by doing something to look for Eicar filenames on websites and picking them up off that rather than real scanning.. So I decided to pit AVK against a really nasty altered-packed trojan with several rebased/stealthed trojans inside. Ironically, this very file infected me this week - bypassing my previous layered system.

http://home.comcast.net/~prolawn00/rebased.JPG

This was surprising.. Only 4 total AV/AT products in the world detected this file in my previous tests the last few days. AVK stopped the download before it finished writting it to my hard drive, locked access to the file, then quarantined it. Great scanning and detection going on there, especially when you consider about a dozen or more other products don't even recognize this threat! The final test, was to see if this product recognized nasties hiding in both your temp files (renamed) and in your Windows System-Restore CABs. I have good news on both fronts, it finds them, and cleans them. When Windows goes and creates the next system restore point, AVK reachs in, finds baddies, and cleans them out. I've seen few AV's do this firsthand, but I don't have data on how many do or don't. (I know my previous AV - NOD32 doesn't even support CAB unpacking)

So what happens when the baddies are found? As with any AV product, you choose how you want to manage them, either automated or manual. Logs are generated, and the product has a built-in logview system thats very well done. In addition, once qurantined, you can one-click submit the file for inspection and reporting to the folks at Gdata/eXpendia, and you can right-click the file, and get detailed information on the threat - which loads the very nice Encyclopedia at AntiVirusLab, which incidentially is maintained by Gdata/eXpendia. http://www.antiviruslab.com/

Ok, so obviously my tests and reports are looking really nice on this product, but how do the big testing places feel about it? Lets have a look...

Virus Bulleting seems to like it in how it deals with Virus threats, WindowsXP ratings are all I care about;

http://www.virusbtn.com/magazine/archives/...tives/gdata.xml
ItW Overall - 100.00% ItW Overall (o/a) - 100.00% ItW File - 100.00% Macro - 100.00% Standard - 100.00% Polymorphic - 99.92%

Wilders likes it - even though they are reviewing the German version, which uses the BitDefender+KAV layout - RAV+KAV in the US version has more definitions.
http://www.wilderssecurity.org/avk.html
(We do regard AVK AntiVirus a top notch product - and vastly underestimated.)
http://www.wilders.org/anti_viruses.htm
(We are impressed by this outstanding antivirus)

This is an older test, but if you can filter through the BS, you'll see AVK got second place on Windows2k

ftp://agn-www.informatik.uni-hamburg.de/p...-12/0xecsum.txt

http://www.claymania.com/tests-trojan.html
(Older test again, but AVK scores tops in all catagories, and closes with a 0.09% false alarm rating.)

Summary:

This is a pretty exciting product to test, and I look forward to running it through more baddies to see how it reacts in the coming weeks. Updates are daily on this product, despite some rumors that it only updates once a week - thats just not true. During one day of testing, it got a regular KAV update, and an emergency KAV update, so thats two updates today! RAV engine is updated less, but their updates can be quite large, sometimes in the hundred definition range. Overall, i'm impressed with this product. It uses very little system resources, almost no memory, and no measurable CPU cycles in system processes - the most I noticed was a 1% tick on the AVK.EXE process and this was so fast, you had to be quick to even notice. The biggest horsepower draw I saw, was a general slowdown in some tasks, such as loading a general application (such as a browser). Loading my browser would take about 1 second without any AV on, with AVK on, and on full settings, this would double to around 2-2.5 seconds. If I disabled the KAV engine for realtime scanning, and went with just the RAV engine, the delay was no longer noticable... A slowdown of 1-2 seconds on loading an application is certainly tolerable for this level of security. At the very least, with its configurability, you could run the on-access realtime monitor on the RAV-Only engine, set on-demand scanning to both engines in deep mode. The best of both worlds are at your disposal right there, great realtime heuristics and the deepest scanning you'd ever need!

The value of this product cannot be questioned.. At only $29.00 for the product, including 1 full year of full updates, this is really a bargin, especially when you consider with this product, you will NOT need any additional protection. Yearly upgrades cost only $24 per year,and keep you up to date on all the latest definitions, engines, and product upgrades. Considering many AV/AT products cost double or more, this seems to me like a best-buy. At the very least, this product should be on your hard drive as a dedicated on-demand scanner, because in deep-mode, with both engines running, you'd be hard pressed to find a better product in my opinion. Considering that many AV products need to be backed up by a good Antitrojan product, the value is even greated.. (for example NOD32 @ $40 + BOClean @ 40, and still not this level of protection - for $80?!?)

Check out the product at: http://www.extendiaavk.com/

This product has the "Kobra" two thumbs up.

 

Hi Kobra,

very nice review!

Where can I take a trial version of eXtendia Antivirus AVK Pro?

 

where did you get the trial version from, I am currently considering a move from our current av product (McAfee) and want to find an easier solution due to the fact that our av contract runs out in 6 months, I have tried KAV, RAV, Panda, trend micro, etrust, the only one that came close is panda BUT, the cost is too great for our business so im hoping the price is as good as you say the program is.

 

Terrific review, thanks for all the time and effort you put in. Where can I get a 30 day trial?

 

I emailed them directly, inquired about a trial, and was sent back a link with a 30-day key to run the full version. There also is client/server commercial versions available as well according to their email to me.

http://www.extendiaavk.com/

Is the link to the product. Small oversight.

 

can you download it, I cant they want me to order it.

 

Excellent review Kobra

Taken from extendias website

So it would appear that there are frequent daily update free for the first year and every year on providing the subscription is continued.

keep us posted how the AV performs as i`m very interested

 

I emailed them, asking nicely for a trial, and was provided a full version with a 30-day activation key.

Note: This product isn't limited to once a day updates either, I found options to poll hourly for updates - and today so far, i've gotten a few Kaspersky updates.

http://home.comcast.net/~prolawn00/updates.JPG

^^^ Shows the options.

 

Kobra,

Have you heard back from them regarding RAV support/updates and the MS acquisition? Also, any scoop on them following GDATA and utilizing the BD engine?

EDIT - Called Extendia and talked to someone there. He didn't know the KAV/RAV engine version number. Indicated that at some point they might follow GDATA (sister company) with respect to changing the engine out to BD. He felt that most people were happy with RAV as the other engine. I checked up on RAV and it doesn't seem the engine performs terribly well. They are pushing the low price in the hopes of getting users to buy the product and offering the update service as part of the package. I told him it might be a good idea to offer a fully functional trial given the fact that every other competitor on the market is... best practices is always a good thing to observe. We shall see if anything happens.

 

I understand that Microsoft bought RAV, and I don't believe that MSFT is in the business of buying crap companies/products

However this does bring up the question, kobra, if you run your tests with just the single RAV engine and not the KAV, and vice versa if the results are truly night and day. Wondering if you can find/document a time when one engine missed a virus/trojan but the other one picked it up.

I know it would be time consuming but would be interesting nonetheless. By the way, great review and excellent work

 

You sure about that? Take a look at some of their acquisitions. Companies have made bad acquisitions more than once. Things don't work out always as expected.

That is a great suggestion though, comparing the performance of the two engines. I'll second that request.

 

Well AVK tells you which engine picked up which baddie first, and the first one with the hit, gets the "Award" so to speak, and I have to say, its about even at this point.. I have done some limited testing with each engine seperately, and I did find at least one item that KAV missed where RAV picked up - RAV seems to have pretty solid heuristics. But i've also found a file RAV missed, and KAV picked up. So the combo seems to work well.

Inspection of the RAV website, shows their definition database has 98,633 definitions as of today. Last I checked, BitDefender only had about 68,000-70,000 or so definitions in their database. So I think the RAV database is definately an improvement over the BitDefender database. So I see little merit in changed to Bits engine at this point? Another problem with BitDefender, while a great product, their engine has almost no unpacking support, so in effect, it might actually be a detriment to change to that configuration.

I did recieve an email from Gdata, saying that the US version was decided to stay with RAV for now because everyone was overwhelmingly satisfied with it, and its quite a bit more extensive than Bitdefenders. If the situation at RAV changes - which it hasn't after over a year - their defs are still strong and coming out fairly quickly - then they are prepared to change the US version over to the KAV+Bit combo. But for now, the KAV+RAV setup seems actually better.

On a side note, i'm getting KAV emergency updates as they are released, check out todays updates alone:

Begin Internet update (virus database)
Start time: 05/25/2004 01:02 PM
KAV-Engine: Update transferred... OK!
RAV-Engine: You already have the current version.
KAV-Engine: Internet update transferred successfully.
Quit: 05/25/2004 01:02 PM

Begin Internet update (virus database)
Start time: 05/25/2004 09:44 AM
KAV-Engine: Update transferred... OK!
RAV-Engine: You already have the current version.
KAV-Engine: Internet update transferred successfully.
Quit: 05/25/2004 09:45 AM

Begin Internet update (virus database)
Start time: 05/25/2004 08:14 AM
KAV-Engine: Update transferred... OK!
RAV-Engine: You already have the current version.
KAV-Engine: Internet update transferred successfully.
Quit: 05/25/2004 08:14 AM

Begin Internet update (virus database)
Start time: 05/25/2004 12:43 AM
KAV-Engine: Update transferred... OK!
RAV-Engine: You already have the current version.
KAV-Engine: Internet update transferred successfully.
Quit: 05/25/2004 12:43 AM

Thats 4 updates already today, so I think the question about the product being "Behind" on definitions is really a moot point. RAV releases updates less frequent than KAV, but RAV's updates can include hundred+ items i've read. So to me, thats a really good compliment to KAV... KAV for the fast emergency updates, and RAV for the deep-extended definitions. Another nice thing, is I do believe in RAV's heuristics, they seem excellent, so double redundancy heuristics = will anything pass thought this??

 

Really good review!
I´m very interesting in this AV, and I consider of buy it after
trying. It seems very amazing!

backfolder.-

PD: I´m new here, so this is my first post. Greets to all.

 

Kobra,

I actually bought extendia AVK after you brought it to my attention. I'm not much of a tester though, and probably wouldn't risk playing with viruses/trojans to test, even fake ones. I beta-ed the KAV/BIT version of AVK and liked that but the KAV/RAV seems a bit faster.

The one thing that i noticed most, and stood out is that i download a lot of .exe files from the net (game demos and such) and you can see KAV/RAV going through the "contents" of the .exe file (unpacking i guess is the term). I do wish that they would display the files scanned (.exe counting as 1) as well as actual files scanned (.exe containing more than 1 for the individual files packed into the .exe) that way you get a true sense of the number of files scanned in a given time frame.

i now have nod32 and KAV/RAV on my machines and they seem to coexist, with KAV/RAV as my resident scanner at the moment (i might change this to nod32- not sure yet) since it's light on the memory as kobra showed with his screenshot. Then again, i might just take nod32 out of my system altogether and go with KAV/RAV.

One thing that i did notice is that with the new zone alarm pro 5.0 firewall, running the firewall program and setting the antivirus program monitor switched to on, with kav/rav, my machine would blue screen. However, with just nod32, there were no problems. I got around this problem simply by disabling the ZA pro 5.0 antivirus program monitoring setting (apparently ZA 5.0 will monitor your antivirus program to see if it's updating correctly, or if it's on, it's not referring to an antivirus program built into ZA, as far as i know this setting only works with norton av and mcafee)

 

Where does eXtendia AVK get their updates from? eXtendia? or Kav/Rav servers?

 

Diesel this is good news.. Which did you buy? The full kit, or just the AVK Pro itself? I'm curious to know how the kit is as well. But you are right, I noticed the KAV+RAV setup was a good deal faster, and lighter than the KAV+Bit setup. Nothing to complain about there.

I'll probably end up buying this product shortly, i've uninstalled all the other AT/AV products from my box since installing AVK, as I see little need for them now. But thats just me.

As for RAV, I found a few writeups on it:

http://www.scmagazine.com/products/index.cfm?fuseaction=productDetails&productID=5823&type=review

http://www.virusbtn.com/magazine/archives/200306/comparatives/rav.xml

Also, I noticed Rokop says RAV supports about 61% of known packers, KAV is 80-85%+ range, and I bet theres some that don't overlap as well, bringing that close to 100%.. Other products, like Norton support at best, 4%.. NOD32 I believe is under 50%, probably much less. /shrug

Let us know how it works out Diesel, i'm running here on my boxes as well to give it a thorough trial run.

 

Unknown, but based on how fast the updates from KAV are coming, I suspect those might come directly from Kaspersky. Possibly the same for RAV? I really don't know.. I've not gotten a RAV update since yesturday, but i've already gotten 4 KAV updates today.

 

Kobra,

Got this when I tried to download a trial of a RAV product.

"Due to the acquisition of RAV's IPR (Intellectual Property Rights) by Microsoft Corp., GeCAD Software SRL is currently engaged in a strategic reorganization of its operations, which includes scaling down and discontinuation of its anti-virus related business. More details at:
http://www.ravantivirus.com/pages/shownews.php?i=153 ."

Going to the support section of the site... I wouldn't expect any further app updates. Sent an email in asking about signature updates.. Will report back.

 

Wrong

What does this say about the real resource usage? How much longer will it take to copy 500 files from one disk to another?

Oh, great! Another spam engine....

And you tested how many?

What does the signature number tell us about the product?

Or if you do a daily scan of your hard disk ...

This tool didn´t even notice that the file was blocked and moved by my on-access scanner and told me, my scanner failed while it worked as it should.

Generic doesn´t mean heuristical detection

Do you have any idea what you mean when you say heuristic? The file was fully downloaded to your harddrive - before the IE was able to move it from the temporary folder to its destination, AVK recognized it by signature. That´s all, no heuristic, no voodoo.

However - AVK is a nice product - if you have the right hardware. On a 2 years old machine it´s a pain. Please be more careful with words like heuristic - make sure you know what you talk about, others could believe it.

 

I purchased AVK pro extendia Security Suite. and I bought this at 29$ from BoomerangSoftware. The suite implements a firewall (totally outdated, with no configuration and simple on or off tabs of the programs outbounding), a encryptor (nice gui, but not as Diamondcs one), secure messenger (but your buddie has to have one too for using it correctly), backup tool (which I already have) and an Antispam utility and popupblocker (practicallyno config.)
To be honest: their crown jewel is the AV. it is very good. but recently I read that the one with the bitdefender engine is better. except that they update 3 times a week (max.) except for emergency ones.
I do not regret having licenced to KAV Pro.
I really don't but I use only the encryptor and the topnotch AV all the rest is just not good, but for 29$ if you use one or two of it , you already saved your money.

 

Aye, thats what I read.. The thing i'm thinking of though is, their engine is done, their heuristics are in place. Obviously GData has their sourcecodes, or at the very least, partial source codes if changes do need to be made. But having the 100k RAV definition database in place within to compliment KAV, is pretty good if you ask me.

I believe RAV probably has some extended contracts, and MS would have a vested interest to keep RAV's databases current, because its a product they themselves are using. I see daily updates for RAV, so despite not releasing the actually product anymore, they seem to be keeping the database current!

I noticed since July 2003, RAV has released 13,292 new definitions into their database. So they appear to be keeping very current.

As a last resort should something bad happen with RAV, I suspect we always have BitDefender option to plugin to it - as I was told by Gdata...

 

Nice positive attitude there Standish.

Evidence to the contrary? I've seen expensive server/mainframe AV's that use 3-8 engines, so they are wrong too?

Not much, but I wasn't referring to that aspect of system usage, was I? If I wanted to test that, I guess I could spend a week logging millisecion variances on file transfers. Why bother if I barely notice anyway? I'm not PAID to do this ya know.

Then turn it off, don't complain. Unlike *SOME* products, this one is configurable..

4 of them. Bat, Pocomail, Outlook, Eudora.

Alot.

For me, I demand exceptional realtime monitoring, thats what matters. Any product can daily scan reasonably well, what seperates the men from the boys are how it handles threats in realtime. Your mileage may vary, mine doesn't, and i'm exposed to a dozen+ threats a day on light days.

Which AV product do you use? Make sure to set your AV on "Delete File" mode before running the test, otherwise results may vary. The documentation says this.

I've read that "Generic" and "Variant" is usually an indication of a Heuristic pickup. Perhaps that is wrong then, got any data to point that it doesn't? I'll dig up where I read this. I remember the guys at Normal telling me that their product also appends "Generic" on the end of whatever possible new one it picks up that it determines it might be a variant of. Thats one product of course, no clue how everyone else does it.

Actually, I do.. Your correct, it was a definition pickup, and I'll change the label as such. I will stress that this file was only picked up by 4 AV/AT products though, and both the RAV/KAV engine picked it up, that says alot.

Possibly, but then we have a simple answer for that don't we? Run it in single engine mode only for on-access scanning. Then use both engines, in deep mode, for on-demand scanning, and you have it all, don't you? Is it really necessary to have 5 AV's and 6 AT's installed? Not really, I think i'll just buy this product, and be done with it. On another one of our PC's here, thats a good bit slower than my 3.4Ghz box, we set the on-access scanning for RAV only, and the on-Demand for Both-Deep, and scheduled to run twice a week. More than sufficient for that machine, and nothing noticable with the performance.

Good Day

 

Nice attitude Sandish. There's something called constructive criticism, might want to read up on it.

Looking forward to reading one of your "reviews" in the near future.

 

And you tested how many?
4 of them. Bat, Pocomail, Outlook, Eudora.


I use it without any problem with Mozilla Thunderbird.

Gerard

 

Well since Microsoft bought RAV more for know-how (to provide better 3rd party antivirus integration in Windows/(rumour) to knock out a Linux AV) than the actual product, I would suspect RAV will completely stop support around the time the last licenses end. (I suppose if a special deal can be made, they might stay around longer)