dr web 4.44 scan speed

id like to know the differences between what they actually scan, compared to others, im sure IBK or Firecat or someone like that knows.

also, i dont think drweb is dual core etc compatible.

 

Yes, absolutely. A visit to their very useful forums and a search there would pay dividends. Very good source of humor too.

 

@Banshee

i dont understand your problem, if you dont like the software, simply do not use it, there is no need for your constant bashing of the product.

--- yes, they do have a great sense of humour and are always informative, maybe you just need to learn it a bit more, as the english translation can sometimes wonder off to distant lands.

 

I could tell you the same CSJ. I don't understand your problem-If you like the software, simply use it.There's no need for you constantly presenting fiction as facts.

 

i speak nothing but facts, whether you choose to accept them is your problem.

summary:

Version 4.44 has the following enhancements:
- Full support of Windows Vista;
- 'Curing' a system from rootkits;
- New non-signature unknown virus detection technology (origin);
- Optimized engine that quickly scans;
- Support for new archivers and packers.

im sure drweb will add more information about the version to their news page as soon as its released.

 

CSJ,CSJ,


Until you can back your claims some/most of what you have been saying about the software is fiction and wishful thinking.Period.


This my last on this. Rant on.

 

i am a little bit confused.........
i have never heard or seen " this av is dual core compatible " or "this av is not......." . plz recommend some web links . i am curious . thanks .

 

@031

its quite simple really, some av's are able to max out dual core processers during on demand scans, drweb isnt compatible to do this as far as im aware. Max priority scan will always be about 50% cpu on a dual core cpu.

@Banshee

F-secure 'sometimes' has a slower on-demand scan than Drweb depending what you have on your machine, also there are others, why dont you bash them for a week?

ok, but to be serious now.

there will always be faster, yeah?
there will always be slower, yeah?

lets not make a big thing out of it all.

its weekend, time for happy posts

ok?

-------------------------------------------------------------

anyway, to keep this topic heading in the right direction.

The fact is that the version 4.44 knows more archivers and packers. And for the same time of scan, as 4.33.

now version 4.44 scans more objects than version 4.33. Therefore, the total scan time can be the same.

Version 4.44 in particular is much faster at scanning CHM-files and certain types of installations.

 

If something is flagged as "probably trojan" or "suspicious" etc then how can that count as a false positive? I think false positive would be if it flags it as a Trojan.Example or so. If an exe is small sized, and has code that downloads something/installs something .. then why not flag it as suspicious when usually that kind of programs are. That is why you can choose to ignore/exclude it if you know that it's not a trojan or virus. Better to let user decide if that program is ok or not than to let possible disaster happen. You can also choose to use "heuristic analyzer" or not.

I would understand that "dr.web & false positives" debate if it would be about detecting a valid program with a 100% sure "detection name" or removing those without asking.

 

Falks, please read carefully about the garbage:
nobody suggests all 22K samples are garbage. Nobody but IBK. I repeat: finding garbage in several samples means that all of the remaining have to be checked. And this does not prevent us from admitting that there are real samples that are missed.

And they are being checked. IBK was told a few days ago about this. To add the whole collection to the base is a 20 minutes work. This is what IBK is obviously suggesting. However, Daniloff is not sharing this point of view. Thank you for the advise, though.

About withdrawing from the tests: no problem to do that, of course. But the tests like this are becoming to have too much impact on the industry. We prefer to receive the test collection and to find out what the problems are there. And we do not care really about a standard/advanced level - be pretty sure, we have our own measurements. WE hope to finally improve the quality of the tests themselves.

 

it feels soooo good to not be the only 'target' for any drweb wrong-doings, or what people believe to be so.

*PM limit reached, not ignoring the people who have sent me one.

 

I believe it is a misunderstanding. Some people call "false positives" what should be called "false alarms".

 

BULLSHIT! What I suggest you is to add the real malware, no more, no less.

Btw, we will allow Panda to participate again starting from 2008. Panda wants to participate in the tests and all AV vendors I spoken with (with one exception which I prefer to not say) said that the quality of the test(s) and the test-sets (I am talking about the one of August) is higher than any other tests based on large sample sets.

 

calm it down chaps

im sure they will add the real malware, i take it they have now recieved the dvds?

 

yes, they got the DVD's.

 

ok, well im sure they will check them and add what they feel is a threat IBK.

Folks*

@ IBK, if it only takes 20 mins to add them all, im sure some av's will just do exactly that, which is a bit of a shame.

 

No BULLSHIT! Do not be tricky, adding 22K of samples and analysing them all takes a while, you know that. We do not have spare people to do that because there are some hundreds of current ones every day. Pushing them all to the robot is not our style, sorry for this. We'd rather keep those users who respect us for being Dr.Web than acquire new ones who will be seduced by good AV-comparatives test results.

As for the one who is not happy about the AV-comparatives tests quality I think I know them. Doctor Web, Ltd. is their name. But they are not the only one.

 

1. The answer is - any test can be trusted if it can be reproduced by third parties. When I am told that my product missed some 25004 samples I have to be sure all of them are the malware to be detected. But if I find 1,2,3,4 files that are NOT viruses - can I agree that the test results mean something for me?
My first question is - HOW DO YOU SELECT FILES FOR THE TESTS? Unless I am told the exact methodology (by the way, do you know it for AV-comparatives?) - I can never be sure that the tests results are relevant for me.

2. No comments, unfortunately. We are going to study these tests, too.
Do not dismiss those results, of course. But give yourself the honest answer - are you sure the methodology is 100% transparent to you?
Anyway, I am waiting for 4.44 to be tested at av-test.org

 

Re: dr web 4.44 scan speed

IBK, cant reply because im maxed out on my PM limit grrrr

but cheers for letting me know, ive never had any problems with drweb, and even you must admit that your tests can make it a some-what easy av to bash.

we both know, there are loads of people too incompetent to use their own brains and their own ideas about such programs.

even with my 26 year f-secure licences, i will continue to stay with drweb as its a firm favourite for my laptop

 

Still BULLSHIT. Of course it takes a while, everyone knows that. You got 70k samples and you get tousands of samples every day. All those samples have to be analyzed and of course you are not (and will never be able) to analyze all those samples manually (even if that is DrWeb philosophy) - If this philosophy means that DrWeb scores lower in tests because DrWeb detects less real malware than other products, than you have to live with that, because that is what the test shows. Most other vendors nowadays use automated systems to analyze the files for functionality, maliciousity and add detection (I am not talking about the crappy systems which rely on the [e.g.VT] results of other AV products and just add everything what some other vendors are detecting, no matter if it is garbage or a false positive).
name the other ones, like I name you that also in av-test drweb scores 89%.
You say the test is full of garbage and want to contribute to better tests. Than send me the lists of files you consider garbage and I will show anyone the impact they had on the results, along with my excuses to DrWeb in case that DrWeb would have reached Advanced instead of Standard due garbage.

 

you know when this will be Severyanin?

@IBK, i dont think he means 'full of garbage', just that it exists in the test sets, and how much is unknown.

also IBK, a few times this week ive heard 'we dont know the methodology', is this a secret to the companys?

 

It can be reproduced by anyone, as you get the missed samples.
Even IF you would find TOUSANDS of NOT viruses, the results still show that you miss MORE than other products.

Did DrWeb sign the TOS without reading the methodolody? DrWeb signed the TOS stating that they agree with the methodology. If now because you are at the end of the list of the 17 best products you have a problem with the methodology, it MAY be better to state you do not agree anymore with the methods used and retire the signed TOS and from the tests. So far the only ones who prefer to do not show up in the tests are the ones which rely more on marketing and obscure statements and score low in independent tests based on large test-sets. You may wonder that some products which score e.g. 60% would love to take part in the main tests even if anyone would see that other products are scoring higher, but they stand behind their results, and want to show their improvements over the years.

1. TEST METHODS. The methods used by the Tester are described in a document published on the Test center website www.av-comparatives.org. The Tester reserves the right to improve and or change the methods as necessary. Notice of such changes will be published on www.av-comparatives.org website at least 30 (thirty) days before they take effect. Agreement with changes notified is implied by continuing to participate in testing, subject to terms in (2.)

2. PARTICIPATION. Any vendor of security software (hereinafter referred to as “the Vendor”) has the right to decide whether to participate in tests performed by the Tester. If the Vendor decides to participate in tests performed by the Tester, the Vendor is obliged to send an application for inclusion in testing to the Tester by email or by fax. The application will contain notice that the Vendor accepts this TOS and the current methods published and used by the Tester. ​

Fortunatly av-comparatives is a little bit more transparent than others, so any user can build up his opinion by himself.

 

Actually, I already did that calculation, shown here. Again, the assumptions were roughly half of the set missed (i.e. ~41,000 samples) by Dr Web were junk and that the same number were improperly flagged by every other AV. The simulated calculation is trivial and the overall test results don't (in my view) materially change.

Blue

 

@BZ: hm, yes, but as "products belonging to one category can be considered as good as the other products belonging to the same category regarding the on-demand detection rate", if half of the files would be garbage (and if mostly only DrWeb does not detect this garbage), DrWeb would be in Advanced.

 

Agreed. But the calculation is a very extreme example with everything positioned in favor of the final result for Dr Web. Cut the estimate to 25,000 files of junk and the category would be unchanged. In other words, the test is not the issue here.

Blue