What's the Best Anti-virus?

[newpgm]

It's unfortunate that Microsoft (MSE) is @ (or near) the bottom. Seems like Microsoft should have a better footprint in security detection/protection. The free versions of AVG & Avast, both of which I have used in the past without problem, are a much better choice.

thank you

 

[UsernameIssues]

It's unfortunate that Microsoft (MSE) is @ (or near) the bottom. Seems like Microsoft should have a better footprint in security detection/protection. The free versions of AVG & Avast, both of which I have used in the past without problem, are a much better choice.

thank you

How do those conducting these AV comparison tests determine what is and what is not a virus? How would all companies that make antivirus apps agree that the same set of files are malicious? AV-Comparatives uses 12000+ files for its accuracy check. Perhaps those working on MSE don't think that all of 12000+ files are bad. Or there is some other reason for MSE's seemingly poor performance.

It would be nice/better if some researcher would take the time to publish a paper detailing the malicious actions of some files and then state which AV apps did not prevent those actions.

 

[newpgm]

I did read your reply of three weeks ago but not well enough. You make a good point re: "how do those conducting these AV comparison tests determine what is and what is not a virus?" Especially with 12,000+ files.

 

[UsernameIssues]

I'm not MSE's biggest fan - as this post shows. MSE should never let an app take over the shell without warning the user.

But I wonder if companies like AVG/AVAST/BitDefender... study the AV-Comparitives testing method and write code that works well for those tests. This would mean that AV-Comparatives has a huge influence on what gets considered as malware. This might be a very good thing - IF those at AV-Comparitives are steering AV companies in the right direction (e.g. driving them to detect truly malicious files). Or, it could be a very bad thing (e.g. driving them to detect files that are not worthy of flagging*).

*assumes that the more files an AV company has signatures for, the slower things get.

 

[Dallas 7]

I'm not MSE's biggest fan - as this post shows. MSE show never let an app take over the shell without warning the user.

But I wonder if companies like AVG/AVAST/BitDefender... study the AV-Comparitives testing method and write code that works well for those tests. This would mean that AV-Comparatives has a huge influence on what gets considered as malware. This might be a very good thing - IF those at AV-Comparitives are steering AV companies in the right direction (e.g. driving them to detect truly malicious files). Or, it could be a very bad thing (e.g. driving them to detect files that are not worthy of flagging*).

*assumes that the more files an AV company has signatures for, the slower things get.

MSE scored poorly in comparison to the other AVs whether they studied the "testing methods" or not.
MSE took the same tests everyone else took, and the test results speak for themselves.
Even if the companies had access to the tests and methods ahead of time like you suggest and MSE STILL scored last, what does that say for MSE? What's MSE's excuse, "The dog ate my homework"?

Not only that, but it's hardly fair to question the integrity of AV Comparatives or their testing methods without concrete evidence to show good cause.
They have a good reputation, and I've never seen or heard of any good reason to question the integrity of them or the service they provide.

 

[UsernameIssues]

I'm not MSE's biggest fan - as this post shows. MSE show never let an app take over the shell without warning the user.

But I wonder if companies like AVG/AVAST/BitDefender... study the AV-Comparitives testing method and write code that works well for those tests. This would mean that AV-Comparatives has a huge influence on what gets considered as malware. This might be a very good thing - IF those at AV-Comparitives are steering AV companies in the right direction (e.g. driving them to detect truly malicious files). Or, it could be a very bad thing (e.g. driving them to detect files that are not worthy of flagging*).

*assumes that the more files an AV company has signatures for, the slower things get.

MSE scored poorly in comparison to the other AVs whether they studied the "testing methods" or not.
The test results still speak for themselves.
Even if the companies had access to the tests and methods ahead of time like you suggest and MSE STILL scored last, what does that say for MSE? What's MSE's excuse, "The dog ate my homework?"

Not only that, but it hardly seems fair to question the integrity of any of the parties or the testing methods involved without concrete evidence to back it up.
I've never seen or heard of any good reason to question the overall integrity of AV Comparative's tests or methods.

I did not mean to imply that any of these organizations making comparisons allowed any company to cheat. I'm not questioning anyone's integrity.

Let me give a concrete example of studying the testing methods:
MS knows that it does not flag the installer for Conduit as being bad.
Conduit is a class of malware that several AV apps ignore.
MS knows who scored high in a round of testing.
If those that score high flag file like Conduit, then MSE could too.
MS could opt to add tons of signatures to MSE.


"The test results still speak for themselves."
Then would you please answer my questions:
What constitutes a virus?
Was each of the 12000+ files used in the test a virus according you your definition?
Who decides what constitutes a virus?

 

[A Guy]

Microsoft has said it bases it's detections on threats actually seen by it's users. How they can determine no new or unseen threats will be added. Supposedly they use user statistics, but how many agree to send such? A Guy

 

[Dallas 7]

UsernameIssues,
First, some people get paid to define/detect viruses, and test AV programs, I don't.
I'm a consumer, not a designer. I have followed the AV test results of AV Comparatives for a long time, and doing so has served me very well. I have never found cause to question the validity or integrity of their services.

Second, if you're insinuating that AV Comparatives is playing favorites or loading the tests with files that don't even qualify as viruses, then you are indeed questioning AV Comparative's integrity for the sole purpose of trying to resurrect MSE from the bottom of the ash pile.

Third, I answered your question, it's your turn to answer mine:

MSE took the same tests everyone else took.
Even if the companies had access to the tests and methods ahead of time,
so did MSE, but they STILL scored last!
What's MSE's excuse, "The dog ate my homework"?

 

[Dallas 7]

Microsoft has said it bases it's detections on threats actually seen by it's users. How they can determine no new or unseen threats will be added.
Supposedly they use user statistics,
but how many agree to send such? A Guy

Good question.

 

[UsernameIssues]

UsernameIssues,
First, some people get paid to define/detect viruses, and test AV programs, I don't.
I'm a consumer, not a designer. I have followed the AV test results of AV Comparatives for a long time, and doing so has served me very well. I have never found cause to question the validity or integrity of their services.

Second, if you're insinuating that AV Comparatives is playing favorites or loading the tests with files that don't even qualify as viruses, then you are indeed questioning AV Comparative's integrity for the sole purpose of trying to resurrect MSE from the bottom of the ash pile.

Third, I answered your question, it's your turn to answer mine:

MSE took the same tests everyone else took.
Even if the companies had access to the tests and methods ahead of time,
so did MSE, but they STILL scored last!
What's MSE's excuse, "The dog ate my homework"?

Your answer to my first question is that you cannot answer it. You really don't have to answer it to see what I'm driving at. There are people at MS that get paid to decide what a virus is. There are people at AVG that get paid to decide what a virus is. There are people at AV-Comparatives that get paid to decide what a virus is. These people disagree about what a virus is and they always will disagree. There is no clear cut answer on what constitutes a virus and there never will be one that all parties agree to.

I am not questioning the integrity of those at AV-Comparatives. They include files they they define as viruses. They don't play favorites. However, they do not set the definition of what a virus is for the entire world.


I've followed AV test results since the early '90s when I had to pick/buy an AV app for our office. Also, malware is a part of my computing hobby. You saw how many hours I put in play with and studying the ransomware in my rant about how poor MSE's heuristics are. You should know by now that I'm not defending MSE - I'm merely attempting to get people to look at these AV comparisons in a different way.


There are classes of malware. MSE (and other companies) simply opt to not call certain classes as being bad. Doing that will always put them near the bottom of AV-Comparatives' testing. MS could decide overnight to flag everything that MS knows about.. but MS/MSE has made a business decision not to bloat their definitions with the files some other AV apps flag. This includes the installer for Conduit and files that are not in the wild. I prefer an AV app that flags Conduit's installer, so I'm looking for something other that MSE to install on the dozens of computers that I support for free.


BTW, Malewarebytes does the same thing. They remove the signatures for malware that is no longer in the wild. And while MBAM is not an AV app, the principle is the same. MSE could easily flag everything that MBAM flags and then some (e.g old malware), but MS/MSE opts not to - so as not to slow the computer down and to avoid false positives.


Just to make sure that I've answered your question:
What's MSE's excuse, "The dog ate my homework"?
They don't have nor need an excuse for coming in last or near the bottom. They opted to be there for good reasons. I just don't like or agree with all of their reasons.

 

[UsernameIssues]

Microsoft has said it bases it's detections on threats actually seen by it's users. How they can determine no new or unseen threats will be added. Supposedly they use user statistics, but how many agree to send such? A Guy

Since you have to opt out, my guess is the percentage is high.

You and I both know how most people click Next, Next, Next... :-(

These are the default settings:

 

[Britton30]

Viruses have been defined for years. Computer virus - Wikipedia, the free encyclopedia That's the technical definition and characteristics.
A worm is similar except its purpose is to spread to other PCs and needs no other program to do its dirty work, while a virus does.

In today's world, as I've said several times, "virus" to most users can mean any type of infection, bot, worm, or adware, to name a few.

 

[UsernameIssues]

Viruses have been defined for years. Computer virus - Wikipedia, the free encyclopedia That's the technical definition and characteristics.
A worm is similar except its purpose is to spread to other PCs and needs no other program to do its dirty work, while a virus does.

In today's world, as I've said several times, "virus" to most users can mean any type of infection, bot, worm, or adware, to name a few.

Defined, yes. Agreed to, nope.

I've read that info before, as well as papers by the first two people cited: John Aycock and Dr. Alan Solomon. They disagree on the definition of a virus.

John Aycock states:

Even the exact number of threats is open to debate. A quick survey of competing anti-virus products shows that the number of threats they claim to detect can vary by as much as a factor of two. Curiously, the level of protection each affords is about the same, meaning that more is not necessarily better. Why? There is no industry-wide agreement on what constitutes a "threat," to begin with. It's not surprising, given that fact alone, that different anti-virus products would have different numbers - they aren't all counting the same thing.

The context of the first quote is dealing with the spec. sheet game - e.g. we detect more stuff = we are better. But elsewhere, the same lack of what constitutes a "threat" is talked about when making product comparisons (i.e. my point).

Like I said, "Defined, yes. Agreed to, nope.":

Chapter 2
DEFINITIONS AND TIMELINE
It would be nice to present a clever taxonomy of malicious software, one that clearly shows how each type of malware relates to every other type. However, a taxonomy would give the quaint and totally incorrect impression that there is a scientific basis for the classification of malware. In fact, there is no universally-accepted definition of terms like "virus" and "worm," much less an agreed-upon taxonomy, even though there have been occasional attempts to impose mathematical formalisms onto malware.

To avoid the terminology issue, I'll reword the question in even broader terms:
Who defines what constitutes a file worthy of flagging?

Or maybe I should stop asking (leading) and just start telling (preaching):
No one group sets the definition of what file is worthy of flagging. The industry cannot agree on Conduit. So don't be shocked when MSE and other apps that don't flag Conduit (there are 1000s of files in the same class as Conduit) score low in tests that do include Conduit and the like.

 

[Dallas 7]

MSE is at the bottom because it is designed that way. According to MS anyway

Microsoft: Security Essentials is designed to be bottom of the antivirus rankings | Security | News | PC Pro

They say they also only make it detect the things that it's users actually run into. They get that info from those that allow MS to collect the info.
I was expecting people to stop doubting these AV test results when MS themselves said it was true.

A Guy

You'd think!
I saw nothing in that article that made me feel confident about MSE. Nothing.

 

[UsernameIssues]

MSE is at the bottom because it is designed that way. According to MS anyway

Microsoft: Security Essentials is designed to be bottom of the antivirus rankings | Security | News | PC Pro

They say they also only make it detect the things that it's users actually run into. They get that info from those that allow MS to collect the info.
I was expecting people to stop doubting these AV test results when MS themselves said it was true.

A Guy

You'd think!
I saw nothing in that article that made me feel confident about MSE. Nothing.

People disagree on what Holly Stewart was conveying.
Sensationalist Press Got it WRONG! Microsoft Does Not Recommend Two Antivirus Programs! ~ Security Garden
(with MS blog and Ask Leo links at the bottom of that article)
Microsoft never said you need to install another antivirus along with Security Essentials


I don't see any info from these comparison companies that address my concerns with their reports... but I still read them.

 

[Dallas 7]

I don't see any info from these comparison companies that address my concerns with their reports... but I still read them.

I find it interesting that out of 23 AV products rated, only one group that I'm aware of has attempted to blame their low score on AV Comparatives' definition of a virus.......MSE.

In AV Comparatives' March 2014 Real World Protection Test, 23 products were tested.
Out of those, 22 scores ranged from over 90% to near 100%.
#23 scored 88.4% and was labeled "Non-competitive".
Number 23 was MSE.

http://www.av-comparatives.org/wp-content/uploads/2014/04/avc_factsheet2014_03.pdf

 

[Layback Bear]

Do a little research and you will find that Microsoft does not design MSE
towards AV competition run by and controlled by who ever. They spend their time and money improving the product. It works for me.

 

[UsernameIssues]

I don't see any info from these comparison companies that address my concerns with their reports... but I still read them.

I find it interesting that out of 23 AV products rated, only one group that I'm aware of has attempted to blame their low score on AV Comparatives' definition of a virus.......MSE.

In AV Comparatives' March 2014 Real World Protection Test, 23 products were tested.
Out of those, 22 scores ranged from over 90% to near 100%.
#23 scored 88.4% and was labeled "Non-competitive".
Number 23 was MSE.

http://www.av-comparatives.org/wp-content/uploads/2014/04/avc_factsheet2014_03.pdf

The definition of what files deserve to be flagged matters to the detection rate test (File Detection) because those tests include files not prevalent the wild.

The test that you cited via that PDF is totally different. Those rely heavily on MSE's heuristics - which I've already said is poor. Very poor.



Back to the discussion on MSE's detection rate:

More from John's Book:

Malware is often categorized based on where it's located. Malware is said to be in the wild if it's actively spreading or otherwise functioning on anyone's computer. Malware not in the wild, which only exists in malware collections and anti-virus research labs, is in the zoo. Accurately determining whether malware is actually in the wild requires omniscience in the general case, so an approximation is used. An organization called the WildList Organization. has a worldwide membership of anti-virus experts who verify malware occurrences and report their data, which is combined to form the WildList, a (presumably close) approximation of the malware in the wild at any given time. Malware on the WildList is confusingly referred to as being In the Wild (ItW). As Figure 10.2 shows, this means that malware can be in the wild but not In the Wild, but something In the Wild must be in the wild. Hopefully that clarifies things. An argument can be made, from an engineering point of view, that the only threats that need to be detected are those that are in the wild, since anything in the zoo cannot pose a direct threat. Anti-virus software could potentially be made smaller and faster by only detecting malware in the wild, whose numbers can be several orders of magnitude lower than the total number of threats. From a marketing point of view, however, this would be a bad idea. If company A advertises that they protect against 100,000 threats, and company B's product only guards against 500 threats - even if they're really the only ones that are in the wild - then company B is at a competitive disadvantage.

MS: "...94 percent of the malware samples not detected during the test didn't impact our customers."

Here is one (of many) responses claiming that the testing companies know best what is in the wild.

Microsoft's market share is #1 in North America & #4 World Wide. This puts them in a position to know what is in the wild. I just wish they would flag more of what they know about... like Conduit.


You are not going to find an AV product the gets along with Windows, drivers and other apps as well as MSE does. That said, it can be claimed this is because MSE does so little

While troubleshooting Windows issues, MSE will still be the recommendation of many here. People can go back to using whatever AV tool makes them happy once their issue is solved.


NoN, any more BSOD issuses?

 

[andrew129260]

You are not going to find an AV product the gets along with Windows, drivers and other apps as well as MSE does. That said, it can be claimed this is because MSE does so little

That right there ladies and gentlemen,

defines MSE.

Any questions?

I don't know why I asked....

 

[andrew129260]

Some interesting information on what antivirus companies send info back to them from your machines:

http://www.av-comparatives.org/wp-content/uploads/2014/04/avc_datasending_2014_en.pdf