What's the Best Anti-virus?

A Guy said:

Microsoft has said it bases it's detections on threats actually seen by it's users. How they can determine no new or unseen threats will be added. Supposedly they use user statistics, but how many agree to send such? A Guy

Since you have to opt out, my guess is the percentage is high.

You and I both know how most people click Next, Next, Next... :-(

These are the default settings:

Britton30 said:

Viruses have been defined for years. Computer virus - Wikipedia, the free encyclopedia That's the technical definition and characteristics.
A worm is similar except its purpose is to spread to other PCs and needs no other program to do its dirty work, while a virus does.

In today's world, as I've said several times, "virus" to most users can mean any type of infection, bot, worm, or adware, to name a few.

Defined, yes. Agreed to, nope.

I've read that info before, as well as papers by the first two people cited: John Aycock and Dr. Alan Solomon. They disagree on the definition of a virus.

John Aycock states:

Even the exact number of threats is open to debate. A quick survey of competing anti-virus products shows that the number of threats they claim to detect can vary by as much as a factor of two. Curiously, the level of protection each affords is about the same, meaning that more is not necessarily better. Why? There is no industry-wide agreement on what constitutes a "threat," to begin with. It's not surprising, given that fact alone, that different anti-virus products would have different numbers - they aren't all counting the same thing.

The context of the first quote is dealing with the spec. sheet game - e.g. we detect more stuff = we are better. But elsewhere, the same lack of what constitutes a "threat" is talked about when making product comparisons (i.e. my point).

Like I said, "Defined, yes. Agreed to, nope.":

Chapter 2
DEFINITIONS AND TIMELINE
It would be nice to present a clever taxonomy of malicious software, one that clearly shows how each type of malware relates to every other type. However, a taxonomy would give the quaint and totally incorrect impression that there is a scientific basis for the classification of malware. In fact, there is no universally-accepted definition of terms like "virus" and "worm," much less an agreed-upon taxonomy, even though there have been occasional attempts to impose mathematical formalisms onto malware.

To avoid the terminology issue, I'll reword the question in even broader terms:
Who defines what constitutes a file worthy of flagging?

Or maybe I should stop asking (leading) and just start telling (preaching):
No one group sets the definition of what file is worthy of flagging. The industry cannot agree on Conduit. So don't be shocked when MSE and other apps that don't flag Conduit (there are 1000s of files in the same class as Conduit) score low in tests that do include Conduit and the like.

A Guy said:

MSE is at the bottom because it is designed that way. According to MS anyway

Microsoft: Security Essentials is designed to be bottom of the antivirus rankings | Security | News | PC Pro

They say they also only make it detect the things that it's users actually run into. They get that info from those that allow MS to collect the info.
I was expecting people to stop doubting these AV test results when MS themselves said it was true.

A Guy

You'd think!
I saw nothing in that article that made me feel confident about MSE. Nothing.

Dallas 7 said:

A Guy said:

MSE is at the bottom because it is designed that way. According to MS anyway

Microsoft: Security Essentials is designed to be bottom of the antivirus rankings | Security | News | PC Pro

They say they also only make it detect the things that it's users actually run into. They get that info from those that allow MS to collect the info.
I was expecting people to stop doubting these AV test results when MS themselves said it was true.

A Guy

You'd think!
I saw nothing in that article that made me feel confident about MSE. Nothing.

People disagree on what Holly Stewart was conveying.
Sensationalist Press Got it WRONG! Microsoft Does Not Recommend Two Antivirus Programs! ~ Security Garden
(with MS blog and Ask Leo links at the bottom of that article)
Microsoft never said you need to install another antivirus along with Security Essentials


I don't see any info from these comparison companies that address my concerns with their reports... but I still read them.

Dallas 7 said:

UsernameIssues said:

I don't see any info from these comparison companies that address my concerns with their reports... but I still read them.

I find it interesting that out of 23 AV products rated, only one group that I'm aware of has attempted to blame their low score on AV Comparatives' definition of a virus.......MSE.

In AV Comparatives' March 2014 Real World Protection Test, 23 products were tested.
Out of those, 22 scores ranged from over 90% to near 100%.
#23 scored 88.4% and was labeled "Non-competitive".
Number 23 was MSE.

http://www.av-comparatives.org/wp-content/uploads/2014/04/avc_factsheet2014_03.pdf

The definition of what files deserve to be flagged matters to the detection rate test (File Detection) because those tests include files not prevalent the wild.

The test that you cited via that PDF is totally different. Those rely heavily on MSE's heuristics - which I've already said is poor. Very poor.



Back to the discussion on MSE's detection rate:

More from John's Book:

Malware is often categorized based on where it's located. Malware is said to be in the wild if it's actively spreading or otherwise functioning on anyone's computer. Malware not in the wild, which only exists in malware collections and anti-virus research labs, is in the zoo. Accurately determining whether malware is actually in the wild requires omniscience in the general case, so an approximation is used. An organization called the WildList Organization. has a worldwide membership of anti-virus experts who verify malware occurrences and report their data, which is combined to form the WildList, a (presumably close) approximation of the malware in the wild at any given time. Malware on the WildList is confusingly referred to as being In the Wild (ItW). As Figure 10.2 shows, this means that malware can be in the wild but not In the Wild, but something In the Wild must be in the wild. Hopefully that clarifies things. An argument can be made, from an engineering point of view, that the only threats that need to be detected are those that are in the wild, since anything in the zoo cannot pose a direct threat. Anti-virus software could potentially be made smaller and faster by only detecting malware in the wild, whose numbers can be several orders of magnitude lower than the total number of threats. From a marketing point of view, however, this would be a bad idea. If company A advertises that they protect against 100,000 threats, and company B's product only guards against 500 threats - even if they're really the only ones that are in the wild - then company B is at a competitive disadvantage.

MS: "...94 percent of the malware samples not detected during the test didn't impact our customers."

Here is one (of many) responses claiming that the testing companies know best what is in the wild.

Microsoft's market share is #1 in North America & #4 World Wide. This puts them in a position to know what is in the wild. I just wish they would flag more of what they know about... like Conduit.


You are not going to find an AV product the gets along with Windows, drivers and other apps as well as MSE does. That said, it can be claimed this is because MSE does so little

While troubleshooting Windows issues, MSE will still be the recommendation of many here. People can go back to using whatever AV tool makes them happy once their issue is solved.


NoN, any more BSOD issuses?