AV-Comparatives Retrospective/ProActive Test (Coming Soon)

@Baz_kasp

We are talking about FPs in general . Why do you count on this test only ?? I am sure you remember AVG detecting user32.dll
http://www.avg.com/uk.faq.num-1574#faq_1574 ?

 

Yes, and Kaspersky detecting explorer.exe...Norton deleting a component of Chinese Windows Xp etc. False positives happen, it is a fact that sooner or later every AV will have a little disaster or a major FP that will either disable a well known app or potentially damage the operating system. I am simply referring to the false positives generated in this test...they seem quite trivial, imo...especially as some of the "false" detections are correct in their own respect (e.g. certain packed files)

 

Thank you, very well explained.

 

From what I've been told, if you use a home product and are not a beta tester, you won't get Artemis. (And Artemis with Virusscan 12 would seem really weird).

Although I do find it odd that sometimes several McAfee processes sometimes spike (CPU), and I'm not referring to the updating process or 'warm up period' during startup. I wonder if it's some in-the-cloud computing ? I can't say I like it.

 

Increase detection? - yes, of course
Reduce FPs? - nope, this is done only by cleansing or tweaking detections. We also don't know this time if high FPs are signature or heur, so emulator may not make a difference

 

WoW, guess McAfee really did some cranking of the engine in the 2009 version
Guess, its score could only become better with Artemis. Not bad Mcafee
Now do a Norton and reduce your resource usage

 

Sorry but I think there is one, Vista package ("not in live state" i guess, just scan of package as IBK states in report) detected as Heur.Invader at highest settings, I guess it is Vista OS package, I am not sure

 

zell just have a look at the august report and you will find the answer

 

Where was the question?

 

See the reverse also... the average Joe is happy with his PC for days. Suddenly the PC freezes and he believes a restart should solve it. Restart and... "No windows installation could be found".

Letting jokes aside, users should try to be better informed about their PCs nowadays and they should know at least some basic files that are not so often infected and that belong to their OS.
A short Google search for each detection could also solve the issue: malware = delete, FP = ignore and report.

 

well wou wrote that we don't have information about the false positives. the information about these ones are included in the august test report.

 

I am sorry, but the more I look at this last test. It doesnt make any sense. If there were 45831 total samples over a 4 week period and Avira detected 30790 with 17 FPs and Eset detected only 23200 with 7 FPs, both have less then a 1 percent FP ranking. Where do you decide that a mere difference of 10 FPs in a base of 45831 warrants a lesser ranking when a product that detects 7590 fewer infections warrants a higher ranking.

Way to much is being made out of the FP results IBK. So much that it makes no sense at all if you break it down.

 

Oh yeh, didnt realise FPs were the same as in the last test! Thanks for that

So its FPs from August

 

You are wrong . 45831 are/should all be malicious . False positive is based on scanning another set of file files , which is not 45831 . Detection percentage is based on these 45831 but not the FPs .

 

ok, then the question is what was the size of the other set of files? 20, 300, 5000? That will tell a better tale just as the difference of 7590 more detections by Avira tells one.

 

I have no idea . AV-C should know

 

well, he came, read and left. I am only asking a valid question to make sure I uunderstand the results. I mean I would think the size of that set of files would be important to. I am not saying the test is inaccurate or questioning the legitamacy of it. I just want to know the size. It has to be small for the number 10 to have such importance.

 

Well, it's at least more than 500 files, since it is mentioned in AV-C's methodology report that AVs which detect more than 500 FPs are deemed to have "crazy many" FPs.

It is also mentioned in the FAQ that giving false alarm percentage is both "senseless" & "highly misleading", so I doubt the presentation of such results will change in the near future.

 

Not to mention thats 500 'packages'... add to that the number of files in each package = lots of files!... take into consideration of how deep the AV unpacks packages to (more unpacking = more files scanned = more chance of FPs) = confusion of how to make it fair and more criticism (unless each package is extracted and files counted and all files scanned = llongggggggggg!)


... simply put, IMO FP results should be taken with a pinch of salt
Not totally writing it off, but also not putting toooooo much emphasis on it

 

Artemis is not available for home users, unless they are beta testers.

But as a small benefit: the 2009 version of Virusscan Plus uses a bit less RAM.

 

Thanks, Fly I know.
But I am both an beta and enterprise user of McAfee. Nice to see something good at AV-C for McAfee, for a change.

On the RAM usage front, I don't see a drastic change in usage like that of Norton. Its almost same as 2008. Scan speed is still a bugger, but overall a good enterprise product, with excellent sales and support ( atleast here ).

For home use, you have many better options IMO.