Anti Virus Testing

[FanIn80]

Hmm interesting. I'm one of those crazy basterds who has always avoided running virus protection on my PCs (and avoided viruses as well), but now I have to run one in order to join the wireless network on campus.

Anyway... long story short... I'm trying to find something that stays out of my way but still passes the socket check for net access on campus. Believe it or not, I had Avast running earlier with everything turned on and protected... but it failed the check. It turns out that Avast is blacklisted at the school for some reason. So now I'm running some McAfee enterprise thingy but I've had to disable everything because it was really slowing me down. The really stupid thing is even with everything disabled, it still passes the check on campus and their inspection client clears me for access.

So...

Newest Avast with everything enabled = net access denied.
Newest McAfee with everything disabled = net access granted.

Am I missing something? Why would Avast be blacklisted? Is there something known about it that drives IT departments bonkers?

(I know it's blacklisted as the campus IT guys told me about it. Both Avast and AVG are on the "do not use" list.)


Edit: What really pisses me off about McAfee (I couldn't care less about actual virus detection) is that it is constantly popping up notices to remind me that I've disabled everything. For the love of God, I know I've disabled everything. Stop. Popping. Up. I even went in and disabled everything single notification option I can find, but it still keeps trying to remind me of stuff. Like almost every 30 minutes. It's getting pretty stupid when virus protection software starts acting like a freakin virus itself.

Edit: Also, how is Kaspersky for resource usage and/or reminders? If I leave everything enabled, will it get in my way? If I disable something, will it shut up about it?

[Azure]

McAfee is known to be a pretty sucky service too.

Those same tests that ranked Avast, Kapersky and the others up there also said that McAfee only catches 60% of all viruses.

[KootenayFlamesFan]

I was lucky enough tonight to get the malware that has the Antivirus Soft ads and all the pop-ups that make it look like the world is coming to an end. A pain in the butt, but I finally got rid of it. Looked in here after to see if anyone else was as lucky as me and saw this thread. I've used AVG for years, but have installed avast and will give it a go. Just wanted to say thanks for the informative thread.

[OilKiller]

Originally Posted by FanIn80

Am I missing something? Why would Avast be blacklisted? Is there something known about it that drives IT departments bonkers?

Not sure...guess it would be a question for them. If IT guys get something in their head (I speak from experience myself...) then it's tough to change their opinion. Obviously someone there doesn't like Avast for some reason.

Originally Posted by KootenayFlamesFan

Just wanted to say thanks for the informative thread.

np... Going to do some more testing tonight most likely with a bunch of different AVs.

[FanIn80]

I'm giving Kaspersky a shot now. I've heard a lot of good things about it over the years, so now we'll see if any of it is warranted. The only things I care about are resource usage and unobtrusivness. Well, and it has to be on the "approved" list on campus.

[Azure]

Anyone know anything about a gateway anti-virus?

We use the Sonicwall Gateway at the office and it does a great job(we get a lot less viruses now)....but its still not AS good as I want it to be.

[OilKiller]

OK, so on tap for testing later tonight (after hockey of course):

Avast
Kaspersky
Norman
Immunet Protect
ClamWin
Norton Antivirus 2010
Panda Pro
A-Squared

I want to test Avast and Kaspersky again since they are perfect to date, with Avast stopping 30 out of 30, while Kaspersky stopped 15 out of 15.

The rest of the test subjects are requests from this forum as well as a couple of others I post on. All are the latest release of the product, while Immunet Protect and A-Squared are current beta releases.

I am going to try and use at least 30 links this time, so not all links will be zero day threats. Some will be from the last few days, which isn't a bad thing because it's nice to see how these products react to something that has been out there and is known currently as well.

[Vulcan]

Originally Posted by OilKiller

OK, so on tap for testing later tonight (after hockey of course):

Avast
Kaspersky
Norman
Immunet Protect
ClamWin
Norton Antivirus 2010
Panda Pro
A-Squared

I want to test Avast and Kaspersky again since they are perfect to date, with Avast stopping 30 out of 30, while Kaspersky stopped 15 out of 15.

The rest of the test subjects are requests from this forum as well as a couple of others I post on. All are the latest release of the product, while Immunet Protect and A-Squared are current beta releases.

I am going to try and use at least 30 links this time, so not all links will be zero day threats. Some will be from the last few days, which isn't a bad thing because it's nice to see how these products react to something that has been out there and is known currently as well.

Hey if you download and test Shaw Secure you can win a free laptop.

http://shawsecure.ca/contest.php?WT....TSSEM2021710L2

[OilKiller]

OK, so some interesting results last night. Finished up pretty late so posting the results this morning. Included in the test (I ran out of time for any others) were:

1. Avast Free 5
2. ClamWin
3. G Data
4. Immunet Protect
5. Kaspersky
6. Norman
7. Norton AntiVirus 2010
8. Panda AntiVirus Pro

All latest versions I could download, all allowed to update any required information (program and signatures) and all set to default out-of-the-box settings. All tested in shadow mode using Shadow Defender and all done on Windows 7 64-bit.

Used 25 malware links that were found that day (some consider these zero day threats, while others may say one day threats). Included in those were rogues, bots, droppers, etc. No real focus on any one thing. Just lots of nasties, including a rogue AV called PC Defender. Not really sure how nasty it was, but it got by everyone except for one.

Stopped/Reported means just that, the AV reported there was a threat and it had been stopped or dealt with. No Reported Threat means the AV didn't say anything and it appeared the threat got through. How dangerous the threat was is anyone's guess. MBAM Infections Found means that once the test was over, Malwareybytes Antimalware was loaded, updated and ran (just a simple quick scan) and the # of infections found was reported.

Results (Worst to Best):

8. ClamWin

Stopped/Reported: 0
No Reported Threat: 25
MBAM Infections Found: 45

Overall: 0%

7. Immunet Protect

Stopped/Reported: 5
No Reported Threat: 20
MBAM Infections Found: 35

Overall: 20%

6. Norman

Stopped/Reported: 5
No Reported Threat: 20
MBAM Infections Found: 33

Overall: 20%

5. Panda AntiVirus Pro

Stopped/Reported: 12
No Reported Threat: 13
MBAM Infections Found: 35

Overall: 48%

4. Norton AntiVirus 2010

Stopped/Reported: 13
No Reported Threat: 12
MBAM Infections Found: 22

Overall: 52%

3. Avast

Stopped/Reported: 16
No Reported Threat: 9
MBAM Infections Found: 27

Overall: 64%

2. G Data

Stopped/Reported: 18
No Reported Threat: 7
MBAM Infections Found: 22

Overall: 72%

1. Kaspersky

Stopped/Reported: 20
No Reported Threat: 5
MBAM Infections Found: 2

Overall: 80%

So there you have it. Avast finally not perfect anymore and neither is Kaspersky, although Kaspersky did an excellent job and was the ONLY one to not allow the rogue AV PC Defender to get in and start displaying pop-ups and tray alerts. Kaspersky also had a note that a reboot was required, so it might have even removed the other two upon a reboot, but I could not reboot to see while running in shadow mode. I think it would be fair to almost give Kaspersky an honorary 100%.

Couple of other side notes. G Data was a huge download, and was the only one that required a reboot after install as well as a reboot after updating. What a pain. It did really well though, although it did also give me a prompt when downloading and installing MBAM (looked like some sort of HIPS prompt), so I'm not sure if it was prompting for just about everything, or it truly was doing as well as it did.

Also, I had to go on the hunt for something to uninstall Panda because it immediately displayed an error when I tried to uninstall it. That was also a pain. Even a reinstall and another uninstall would not work. It's great if the AV does not require a reboot after installing because all of it can be done in shadow mode, allowing me to simply reboot and move on the the next test, although I installed Panda by accident not in shadow mode, thus the trouble.

So again, not saying one is any better than the other and these tests are not professional or scientific by any means, but more links used this time. So take from this test what you will.

[Azure]

Holy crap ClamWIN sucks.

Even Avast didn't do that great, but still, pretty good.

Kaspersky, as usual is the best of the bunch.

[OilKiller]

Originally Posted by Azure

Holy crap ClamWIN sucks.

Even Avast didn't do that great, but still, pretty good.

Kaspersky, as usual is the best of the bunch.

Yeah, ClamWin a waste of time IMO. Avast didn't do that great this time. No one AV can always do well it would appear. Kaspersky, yes, very good.

Edit: My bad, but I think this was a fair assumption. After looking at the ClamWin site, they state: Please note that ClamWin Free Antivirus does not include an on-access real-time scanner. You need to manually scan a file in order to detect a virus or spyware. What type of AV software doesn't have realtime protection????

[sclitheroe]

Have you tested the real-time protection mode for MBAM yet? I know you have to pay to get it, so I'm curious - as a non-real time threat remover, its great, but I wonder how good the real time portion is.

[OilKiller]

Originally Posted by sclitheroe

Have you tested the real-time protection mode for MBAM yet? I know you have to pay to get it, so I'm curious - as a non-real time threat remover, its great, but I wonder how good the real time portion is.

I actually have a license for it and may give it a go at some point, but have not yet. MBAM I'm pretty sure states though that they should not be used on their own as an AV style product, so I'm not sure how it would do overall.

[Hack&Lube]

I have no real data about how good it is, but from my own experience, where Avast and MBAM and ESET have all failed me...this has saved my butt.

http://www.freedrweb.com/

This has no active monitoring though. It's purely for saving your machine by doing a virus scan in the free version.

[OilKiller]

Yep, Dr. Web is pretty decent. HitMan Pro has also cleaned a lot of machines for me. Again, no realtime protection, but good for cleanup.

[Hack&Lube]

I used to be a big Combofix fan as well until a virus came out that started replacing all exe's with itself including Combofix.

[FanIn80]

In addition to its obvious detection-strengths, Kaspersky is pretty darned good at not getting in the way of me actually using my laptop.

So far, so good.

[KootenayFlamesFan]

So, a little CP advice:

Kaspresky vs/ Avast

Who wins?

[stang]

Ok I have a quick question, I think I know the answer but I just want to make sure...

I have a computer that used to be my sisters. Its full of Virus' and Malware. We are talking full on pop-ups, the thing that doesnt let your search work properly, Rogue Anti-spyware programs, pop-ups galore, about 10 different toolbars at the top, and the thing just runs slow and poor (IE and Windows Explorer crash quite a bit)

Instead of just trying to go in and fix everything, I am thinking of just resetting the whole thing back to new specs with the recovery CD. Doing that should clean it up right? It has Windows Vista, should I change that while I am at it?

[Rathji]

Originally Posted by stang

Ok I have a quick question, I think I know the answer but I just want to make sure...

I have a computer that used to be my sisters. Its full of Virus' and Malware. We are talking full on pop-ups, the thing that doesnt let your search work properly, Rogue Anti-spyware programs, pop-ups galore, about 10 different toolbars at the top, and the thing just runs slow and poor (IE and Windows Explorer crash quite a bit)

Instead of just trying to go in and fix everything, I am thinking of just resetting the whole thing back to new specs with the recovery CD. Doing that should clean it up right? It has Windows Vista, should I change that while I am at it?

It will clean it up, but try running malware bytes first, to see what it cleans up. Also, it might help reduce the risk of transfering infected file to the new machine.