AV Testing

[Dinesh]

Avira, G Data and Prevx.

 

[Dinesh]

Today I installed XP in VM and then infected it badly, very badly. Then scanned it with Hitman Pro.
Here are the results.

 

[polarbear]

I have been testing Avast! and MSE for a few months now running side by side... not many programs you can run side by side... hope to switch to just one shortly down the road... may just keep both for a few more months now... GL

 

[Pichu]

If they were really zero day then no AV would be detecting the samples at the time of finding them.

Well, perhaps our idea of zero day is different then. By that I mean they were listed links on various malware web sites found THAT day. These are not old links from weeks ago or anything. These were posted on that day on those sites as active threats that day.

Sorry guys, I don't have any screen shots. The testing was done and no video or screen shots were taken. Screens most likely would have been a good idea though. If I perform a test again, I will try to grab some. Problem is, it is easy to make a product look bad if you really want to, even with a screen shot.

While 15 links is not a huge sample, it is just that, a random sample of links that someone may or may not come across while surfing the Internet.

Listen, I'm not a professional by any means. This test was performed on my main system using Shadow Defender to simply start over again, uninstall the current AV and then install a new AV. After all the testing was done, I had imaged my system using the built-in Windows 7 image backup, so I simply put that image back on to be sure nothing was left behind.

I will add that in some more testing, Avast has not remained perfect (using other links found), but what Avast missed, my Malwarebytes Pro caught, so a layered approach is best in my opinion.

Would tend to disagree running multiple antivirus is suicide to your computer. What your avast missed would have been caught after the virus started becoming more prominent on your computer. How would you know whether those antivirus/antimalware are conflicting your computer?

 

[TheIgster]

Would tend to disagree running multiple antivirus is suicide to your computer. What your avast missed would have been caught after the virus started becoming more prominent on your computer. How would you know whether those antivirus/antimalware are conflicting your computer?

I think you misunderstood. Layered approach in something that CAN run alongside an AV product such as MBAM, Prevx, etc. I am not saying people should run two AV products that are not meant to run alongside each other.

 

[TheIgster]

More testing done the other night with some of the same AV's to see if they keep performing along at the same pace, as well as some new ones that I had requests for. I used 15 brand new malware links. Most were links to .exe files including fake AV's, other rogues, and other various types of malware. All AV's were installed, allowed to update and set to the default settings. The only AV that anything was changed on was A-Squared, as it appeared by default, a couple of the shields were off for some reason, so they were turned on.

After each test, Malwarebytes was ran and updated and a fast scan was done. The results for each fast scan after each test are listed along with the tested AV. In some cases, files that were 'infected' were simply left behind files in the temporary folder. This doesn't seem like a big deal to me, but it may be to some. I personally use CC Cleaner all the time to clean temp folders out, so those files would be gone. Not sure why some of the AV's didn't simply delete those files, but they seem pretty harmless sitting in a temp folder and not running in memory or anything.

One of the surprises for me again was Avast. Caught everything and the only thing left behind was a registry key. Also, the new Trend Micro Titanium Beta. It stopped everything in it's tracks. I will say though the beta seems a little heavy to me. About 45MB of RAM and I did notice a bit of system slowdown, but it works very, very well for a beta, so maybe the drag on the system is worth it or maybe it's just because it's a beta. Kaspersky still did very well in reporting every single link, but three items were left behind in the temp folder. Again, not a big deal to me personally, as they would be deleted soon anyway and were not running in memory. It was the same with Vipre, which performed VERY well and only left behind three files in the temp folder.

I don't mean to offend anyone but BluePoint Security is not good. It did nothing. Their sell line is Revolutionizing Computer Security. If by that they mean, allowing every system to get completely infected, well, they have achieved their goal. Not sure what has happened to Nod32 as well. It didn't perform very well at all. Now, onto the results:

A-Squared Beta 5

Links Missed: 2/15
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 5
Files Infected: 19

Avast

Links Missed: 1/15
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

BluePoint Security

Links Missed: 15/15
Memory Processes Infected: 4
Memory Modules Infected: 1
Registry Keys Infected: 2
Registry Values Infected: 7
Registry Data Items Infected: 5
Folders Infected: 5
Files Infected: 29

Dr. Web

Links Missed: 2/15
Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 4
Registry Data Items Infected: 2
Folders Infected: 5
Files Infected: 18

F-PROT

Links Missed: 7/15
Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 4
Registry Data Items Infected: 5
Folders Infected: 3
Files Infected: 19

Kaspersky

Links Missed: 0/15
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Microsoft Security Essentials

Links Missed: 2/15
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 3
Files Infected: 15

ESET Nod32

Links Missed: 8/15
Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 4
Registry Data Items Infected: 5
Folders Infected: 5
Files Infected: 25

Trend Micro Titanium Beta

Links Missed: 0/15
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Vipre

Links Missed: 1/15
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Please keep in mind, I'm no pro and these are just small tests. All AV's could perform badly when only given some 15 links. These tests are just simple tests to see how each AV performs under these conditions.

 

[Pichu]

I understand then. However, I wouldn't ever recommend to a user that they run two antiviruses together in any situation. Users don't need such security.

Nice security test by the way, I'm curious as to how you got your viruses to test with lol.

Also, for your security setup, I personally, think you should not run kaspersky with malwarebyte, with pc tools firewall, with shadow defender. What, are you paranoid or something? Just MSE is enough. Why don't you delete everything and only keep shadow defender? I'm curious. Why run four security software that obviously could possibly conflict with each other?

 

[TheIgster]

I understand then. However, I wouldn't ever recommend to a user that they run two antiviruses together in any situation. Users don't need such security.

Nice security test by the way, I'm curious as to how you got your viruses to test with lol.

Also, for your security setup, I personally, think you should not run kaspersky with malwarebyte, with pc tools firewall, with shadow defender. What, are you paranoid or something? Just MSE is enough. Why don't you delete everything and only keep shadow defender? I'm curious. Why run four security software that obviously could possibly conflict with each other?

Well, as I've stated and it's been pretty much proven by the testing that I have done, running something like MBAM as well as Kaspersky allows me to ensure I'm pretty darn safe actually. If Kaspersky misses something (and it has), MBAM catches it. As for PC Tools Firewall Plus, well, it's a firewall, not an AV product. Shadow Defender is there, but not used all the time. I only enter Shadow Mode when I am going somewhere that I know may have some serious threats or I use it for testing. Having it on the entire time can cause issues when wanting to download and save things and especially when wanting to install something.

Edit: I would like to add as well, in the testing I have done, sorry, but MSE is not good enough. It has failed in many respects.

 

[Pichu]

In my informal and completely possibly flawed test, I found that microsoft security essentials blocked a rogue antivirus that shadow defender missed, but of course, that is nowhere as professional as yours =).

I just wanted to suggest to you, that keeping such a layered protection can have negative consequences for your computer. This is simply my opinion but I do not want four different programs to scan every file on my computer even if they can work harmoniously together. It misses the point of less is more in windows 7. Yes, it is definitely possible that a virus that gets through one layer is blocked by another layer, so two layer approach is feasible but four layers of protection??!?! lol, im probably just overreacting, but you are being paranoid !!! I don't even think a fanatic like Dinesh, keeps so much to protect his computer??!! I can only imagine how much your cpu has to work and your disk has to thrash...

Note: I'm not criticizing, just suggesting.

 

[TheIgster]

In my informal and completely possibly flawed test, I found that microsoft security essentials blocked a rogue antivirus that shadow defender missed, but of course, that is nowhere as professional as yours =).

What? Shadow Defender doesn't "miss" anything or "block" anything. It's not an AV product.

What is Shadow Defender ?

Shadow Defender is an easy-to-use security solution (for Windows operating systems) that protects your PC/laptop real environment against malicious activity and unwanted changes.

Shadow Defender can run your system in a virtual environment called 'Shadow Mode'. 'Shadow Mode' redirects each system change to a virtual environment with no change to your real environment. If you experience malicious activity and/or unwanted changes, perform a reboot to restore your system back to its original state, as if nothing happened.

I've stated numerous times that I am not a "professional" and I simply do this for fun. Take from the tests what you will. I've stated how they are done and what happens exactly.

I have no slow down issues at all on my system running the security setup I have, but each to his own.

 

[win7clutz]

Gotta agree with Pichu on this, although what people do with their PC regardless of whether or not it's reasonable is certainly their choice. Just hoping not many follow poor advise like this.

 

[Pichu]

Lol, clam down clam down,

I created two virtual drives with windows virtual pc. One has shadow defender installed. The other has mse installed. It says in the product features pages that shadow defender prevents all viruses and malware.
Please, do not think I underestimated you or judged you too high, or insulted you, etc.
I'm simply saying that my suggestion to you is that you remove some of that layers. I sincerely believe that you are one of the maybe one or two people on this forum who seriously use a computer with four layers of security.

I am merely saying and suggesting to you, why all four layers? evenn if you are an av aficionado... (it is a optional/slighly rhetorical question, you don't have to answer it if you don't want to)

 

[TheIgster]

Lol, clam down clam down,

I created two virtual drives with windows virtual pc. One has shadow defender installed. The other has mse installed. It says in the product features pages that shadow defender prevents all viruses and malware.
Please, do not think I underestimated you or judged you too high, or insulted you, etc.
I'm simply saying that my suggestion to you is that you remove some of that layers. I sincerely believe that you are one of the maybe one or two people on this forum who seriously use a computer with four layers of security.

I am merely saying and suggesting to you, why all four layers? evenn if you are an av aficionado... (it is a optional/slighly rhetorical question, you don't have to answer it if you don't want to)

Calm down? I'm fine. You are simply misstating what SD is. You said:

It says in the product features pages that shadow defender prevents all viruses and malware.

Exactly. As in, you reboot and it's all gone. It's not an AV product and it will not block anything from getting on your system.

I'm sorry, but you don't even know what SD is and you are giving me advice on what setup to use.

I have an AV and a malware product running side by side, which allows a dual layer of protection and the two work very well together with no system slowdown. In fact, MBAM states that you shouldn't rely on their product alone.

PC Tools Firewall Plus is just that, a firewall that is there to prevent intrusions on the system. It is doing a completely different job than the AV//malware products.

And again, as I stated, SD is used when testing mostly, allowing me to infect my system when testing AV software such as MSE, etc.

 

[Pichu]

I'm sorry, I misunderstood what shadow defender was. I simply installed it and just left it, not really looking deeply into the program. That was my fault and I apologize. However... hey! "I'm sorry, but you don't even know what SD is and you are giving me advice on what setup to use. " That was mean!! and uncalled for, even if it is true, don't be so insulting! :huh:=.=.

I know what pc tools firewall plus is because I have used it in the past. Their spyware doctor is good too, but I found their programs to be resource intensive...

My point is still the same. Why all four? Also, If i'm not mistaken again isn't kaspersky antivirus and malwarebyte pro both antiviral/antimalware programs? My suggestion to you is to use malwarebyte as on-demand and kaspersky as your protection.

Also: maybe you are calm, but I get the impression that you feel like I insulted you....:shock: just a feeling.....

 

[TheIgster]

Malwarebytes is added protection for malware. There are times that many AV's, includng some of the best such as Kaspersky miss zero day threats. MBAM seems to catch these quite well, although IMO MBAM cannot be counted on as one's main AV product. As stated, the two work very well together with no slow down issues.

PC Tools Firewall Plus actually runs pretty light and doesn't cause any slowdown issues for me at all. I will agree that some of their products are quite heavy, but this firewall product is not and as stated, it serves a different purpose than the AV/malware combo.

You keep saying all four, but again, as I've stated numerous times now, SD is not being used most of the time. I have stated when and why I use it.

I wasn't trying to be mean, but it seems on this site people like to state a lot of things without knowing anything about it and try to almost argue without stating knowledge. Not to mention that I have explained why I use all four and how I use them over and over again and you keep asking the same questions.

 

[Pichu]

"I wasn't trying to be mean, but it seems on this site people like to state a lot of things without knowing anything about it and try to almost argue without stating knowledge. Not to mention that I have explained why I use all four and how I use them over and over again and you keep asking the same questions."

dude, lol, I just started sevenforums not long ago, how was I suppose to figure our a profile of you =.=. I mean, I could reread every post that was made in the security category...

 

[TheIgster]

dude, lol, I just started sevenforums not long ago, how was I suppose to figure our a profile of you =.=. I mean, I could reread every post that was made in the security category...

In this thread and the last few posts...geez.

I'm curious. Why run four security software that obviously could possibly conflict with each other?

Yes, it is definitely possible that a virus that gets through one layer is blocked by another layer, so two layer approach is feasible but four layers of protection??!?!

I sincerely believe that you are one of the maybe one or two people on this forum who seriously use a computer with four layers of security.

My point is still the same. Why all four?

Over and over and over again. I have stated why each and every time.

 

[Pichu]

(=.= If I am not the only person who faced this issue, I'm guessing that there were other people who were probably insulted by this kinda post...)

"Over and over and over again. I have stated why each and every time."

Wow, alright.... nice answer, very short and to the point =.=

 

[TheIgster]

I'm not trying to be insulting, but how are we supposed to have a conversation if you continue to ask the same question over and over again after I've answered it over and over again?

 

[Pichu]

Lets stop this alright? seriously, this "argument" is not the topic for your new thread, I apologize for starting this alright?