How Do You Know If An Anti-Virus Test Is Any Good?

marsmimar · 19 Apr 2013

NOTE: This is not meant to be a discussion about which anti-virus product is the best. It is meant to explore how testing organizations reach their conclusions.

One of the recurring questions people ask is, "Which anti-virus/anti-malware product is best?" When trying to answer that question, others usually cite the latest test results from one of several different testing organizations.

Perhaps the better question should be, "What makes one test better than another, or are they all equally brilliant/useless/biased/random?"

John Hawes (Technical Consultant and Test Team Director at Virus Bulletin) has been running independent anti-malware testing there since 2006. He prepared this article for Sophos and attempts to provide a basic understanding of how anti-virus testing is conducted.

How do you know if an anti-virus test is any good? | Naked Security

magicdave26 · 19 Apr 2013

Low system resource use
Successfully removes the most malware samples from a pack
Allows FPs to be ignored without much hassle
Blocks dangerous websites and malware those sites try to infect the visitor with

Basically NOD32 (apart from the ease of allowing FP)

Roderunner · 19 Apr 2013

It would be really good if 'hackers' did the testing.

cyrilhubert · 19 Apr 2013

Many so called AV programs failed to do their job.
I am not talking bad about these programs. Some of these programs are stopped dead on their tracks if the virus is running or stopped from installing by the virus itself.
Avira is stopped from installing on the system itself if viruses, malware, rootkits are there.
Trend is stopped from scanning halfway during a scan on the system itself if viruses, malware, rootkits are there.
Lavasoft AdAware, Prevx or Webroot, Super Anti Spyware and one more (I forgot the name) returned free of virus when there are a few.
Not all are that good. You can read the review on PCMag.

whs · 19 Apr 2013

Simple answer is: You don't know. It is a matter of trust and own experience.

carwiz · 19 Apr 2013

marsmimar said:

NOTE: This is not meant to be a discussion about which anti-virus product is the best. It is meant to explore how testing organizations reach their conclusions.

Most will document how the test was performed. Not many, if any, are real world applicable because they all choose a batch of known infections and count how many hits were made on that batch. It's not likely that you will ever encounter 65,000+ infected modules on a webpage or in files. Some AVs are more sensitive but the drawback is too many false positives that aren't mitigated. And then there's zero-day infections. Unless it happens to match a known pattern, it could slip by.

No matter which you choose to use, it's only as good as the last update. MS adds another level by using the monthly (or sooner if warranted) update scan. This scan targets selected infections that are more likely than not to be prevalent at the time.