2008 AV Comparisons

Quote:

---

In terms of signature-based on-demand detection, Windows Live OneCare 2.0 held its own. Microsoft's security solution ended up detecting a total of 992,880 out of all the malware samples thrown against it, and accounting for a "Signature Detection" rate of 96.9%. This is nothing short of an excellent score for Windows Live OneCare, an antivirus that at the beginning of 2007 managed to occupy positions only towards the bottom of the security solution pack in early 2007. In the latest AV-Test "Signature Detection" test OneCare 2.0 came on top of F-Prot (986,961 – 96.3%), Panda (979,409 – 95.6%), McAfee (959,919 – 93.7%) and Nod32 (953,936 – 93.1%).

However, OneCare 2.0 was bested by the likes of AVK 2008 (1,022,418 – 99.8%); AntiVir (1,020,627 – 99.6%); Avast! (1,018,204 – 99.4%); Trend Micro (1,009,662 – 98.6%); Symantec (1,006,849 – 98.3%); AVG (1,005,006 – 98.1%); BitDefender (1,003,902 – 98.0%); Kaspersky (1,003,470 – 98.0%);
Sophos (1,001,655 – 97.8%) and F-Secure (999,806 – 97.6%). The complete results of the "Signature Detection" test from AV-Test can be accessed here, courtesy of Sunbelt Software

---

Article is here:

http://news.softpedia.com/news/The-B...08-77419.shtml

Hmmm.. Sunbelt?....

OK.. interesting results... especially when the results are biased to reflect the quality of their own product...

This site is better.. http://www.av-comparatives.org/seite...se_2008_02.php

But what many miss is the performance Hit... (anyone dare run NAV with less than 512Mb ram?)

Hi Undies~

This is the outfit that actually did the testing:

http://www.av-test.org/

Who appear to be independent, or they would be out of business?

Quote:

---

OK.. interesting results... especially when the results are biased to reflect the quality of their own product...

---

Are you sure? I wasn't aware that Sunbelt had an AV product at the time of this testing? OK, they do now (it is called VIPRE) but I am sure it wasn't included, as it was only announced back end of July 2008.

Quote:

---

But what many miss is the performance Hit... (anyone dare run NAV with less than 512Mb ram?)

---

Actually I don't think that RAM is the issue nowadays. 1Gb+ has been the norm for some time now. What I have been noticing is that these suites tend to hog the CPU, particularly if they clash with other applications. I have yet to see any low memory warnings, and the systems still run like dogs!.

I certainly don't like the idea of background system scanning. IMO system scanning is best done dedicated, in safe mode.

EDIT:

Your link doesn't work; click on "comparatives" in the left hand column from that 404 page to get to the results ;)

Quote:

---

Originally Posted by nihil

Hi Undies~

This is the outfit that actually did the testing:

http://www.av-test.org/

Who appear to be independent, or they would be out of business?


Are you sure? I wasn't aware that Sunbelt had an AV product at the time of this testing? OK, they do now (it is called VIPRE) but I am sure it wasn't included, as it was only announced back end of July 2008.

---

My Bad.. confused Products and manufacturers,, yes your correct..

Quote:

---

Originally Posted by nihil

Actually I don't think that RAM is the issue nowadays. 1Gb+ has been the norm for some time now. What I have been noticing is that these suites tend to hog the CPU, particularly if they clash with other applications. I have yet to see any low memory warnings, and the systems still run like dogs!.

---

I still encounter many machines (at the cheaper end of the market) of 3-4 yrs of age.. sold with only 256Mb.. boost these to 1024Mb and it is a big difference - Certainly bigger if the bloated performance killer is not there.. but brings the machine to very usable.
I find most machines of Intel 1.7Ghz (intel) or 2.5Ghz (AMD) class and above the memory upgrade shows improvement.. below that the cpu hit reduces the effectiveness..

Quote:

---

Originally Posted by nihil

I certainly don't like the idea of background system scanning. IMO system scanning is best done dedicated, in safe mode.

---

yes.. background scanning is a waste of resources and appears (to me) to be a waste of time for the poor effectiveness...

Oh and sorry.. forgot about the hot linking issue on that site

Hi Undies~

Quote:

---

I still encounter many machines (at the cheaper end of the market) of 3-4 yrs of age.. sold with only 256Mb.. boost these to 1024Mb and it is a big difference - Certainly bigger if the bloated performance killer is not there.. but brings the machine to very usable.
I find most machines of Intel 1.7Ghz (intel) or 2.5Ghz (AMD) class and above the memory upgrade shows improvement.. below that the cpu hit reduces the effectiveness..

---

I take your point, but I was (subconsciously) referring to the home, SOHO, SBE sectors. I recall doing a bit of research back in late 2002, given all the stick that XP was getting. I found from a review of 5 UK computer buyer type magazines that only two (new) products were being offered with 512Mb........... the rest were all 1Gb.

Personally, I haven't built with less than 1Gb since 2001. Before that it was 512Mb, which made sense for 9x/ME boxes. Windows 2000 was the oddball, because it was quite happy with 512Mb or far less if on a corporate network (thinner client).

I do come across stuff with 256Mb, but these are all Dell, IBM or HP manufactured and are obviously ex-corporate boxes. Mostly PIIIs with a few P4s thrown in. My guess is that they used to boot NT4.0 SP6a or Windows 2000. I do upgrade those to 1024Mb, or whatever.

I am not sure about processors, as I have never tried XP or Vista on a PIII, but I can assure you that XP runs just fine on an Athlon 1900+ (1.6Ghz) and 2200+ (1.9Ghz?), and that Vista runs fine on the 2400+ (2.01Ghz) and 3000+ (2.1Ghz).

I am not sure that processor speed is the issue though. Looking at the process monitor I see 100% peaks when the machines noticeably lag, followed by periods of "normal" activity. The peaks match the security suite activity, so I would suspect that it is the security software not letting other applications have a share of the action?

Another aspect might be process conflicts? I noticed that when installing the commercial version of ZoneAlarm; a machine slowed down to a snail's pace and took about 10 minutes to boot. Now, there were two other AV products running on this box, and I had disabled them in the startup....... or so I thought. The trouble seems to be that these things try to protect themselves against malware shutting them down, and launch processes before the main application? Once I uninstalled them completely, everything returned to normal.

So, if for some reason you have installed another security product, make sure that you get rid of it or your original one, completely. Remember you may have to go to their website to get a special tool to do this

:)

Without background scanning enabled, wont this affect the security of your system?

Who actually runs a scan in safe mode very week or so :P

Sorry Cider, I don't work for an AV outfit so I might not use the terminology the same as yourselves?

By "background scan" I meant a scheduled scan that happens whilst you are still using the machine. I guess you could also include those scans that activate whilst the screensaver is running............. not as bad, but do they hand the resources back promptly and completely?

I suspect you are thinking of what I would call "interactive scanning". Basically checking downloads, opened files and suchlike.

If you follow the link that Undies~ kindly provided, you will see that they alternately check the retrospective (or background) scans and then the interactive ones.

Quote:

---

Who actually runs a scan in safe mode every week or so

---

I do, and so (I hope) do my customers.:halo:

A bit of advice for those who feel that their security software is causing their system to lag:

1. Turn off automatic updates.
2. At the start of the day/session, manually update your security software.
3. Reboot into safe mode.
4. Defragment your HDDs.
5. Reboot into normal mode.

My reasons are:

1. Anything that uses pattern files will be fragmented on update. If you defragment the pattern files your interactive scanning will be quicker.

2. For on-demand scanning the same applies, but you will also not be scanning fragmented files on your system.

Obviously, I am talking desktops here.

Also, just think about what you are doing?

1. If you scan e-mails at the server, there is little point in scanning them at the desktop as well?

2. If you scan a file on opening, there is little point in scanning it on closing?

Well Nihil the background scanner as I know it , it continously scans files in a cycle to check if anything hasnt come in. Something like a scheduled scan but not an on-demand one.

Yes that's more or less it. It doesn't matter what the trigger is, it is scanning your system's files whilst you are trying to use the system, and soaking up resources in the process.

Quote:

---

it continuously scans files in a cycle to check if anything hasn't come in

---

I really don't see any great value in that. After all, if something has infected you it has already bypassed your interactive scan, and if it does find something you would be well advised to perform a thorough on demand scan in safe mode anyway?

I can see a sort of logic in it, insofar as if the AV regularly updates the pattern files then a subsequently (to the infection) identified malware will be detected. For this to be effective you need to allow updates on a very regular basis. and you really need an environment that justifies it, which I don't think applies to most home users?............. not to the ones I deal with at any rate :)

I guess the best results are the one from my own experience. So far, I've tested almost all popular products since 2001 like Norton, Panda, BitDefender, Nod32, Kaspersky etc...
I've seen many machines infected with all kinds of trojans, viruses and so on. From all of them I liked only one antivirus - Kaspersky Antivirus, it is using small RAM resources and it's very effective. I saw on this page some "tests" :

AVK 2008 (1,022,418 – 99.8%); AntiVir (1,020,627 – 99.6%); Avast! (1,018,204 – 99.4%); Trend Micro (1,009,662 – 98.6%); Symantec (1,006,849 – 98.3%); AVG (1,005,006 – 98.1%); BitDefender (1,003,902 – 98.0%); Kaspersky (1,003,470 – 98.0%);
Sophos (1,001,655 – 97.8%) and F-Secure (999,806 – 97.6%).

It's amusing to see such results I guess somebody is paying a lot of money for such results. And it's sad that people pays more money for a product that is ten times weaker than another one that is cheaper. For those who didn't try Kaspersky Antivirus, you can download it from here, just make sure to update it.

http://www.downloadbestsoft.com/Kasp...Antivirus.html

WHY ARE YOU PEOPLE STILL USING AV PRODUCTS????

People. A virus is a program that replicates itself. PERIOD It's A PROGRAM YOU HAVE TO INSTALL AND RUN.

GRrrrrrrrrrrr

/rant

Dino...you know why!!!

The general luser population still clicks on everything!!!

Come on....why is spam profitable?? because lusers still click.

remember...common sense isnt that common!


Keeps us in business ;)

MLF

Quote:

---

But what many miss is the performance Hit... (anyone dare run NAV with less than 512Mb ram?)

---

Deployed on 3800 machines having 256 MB DDR1 RAM at 333 .. ;)

Quote:

---

Originally Posted by morganlefay

Dino...you know why!!!

The general luser population still clicks on everything!!!

Come on....why is spam profitable?? because lusers still click.

remember...common sense isnt that common!


Keeps us in business ;)

MLF

---

Yea, so how come whenever I send out 50 million emails stating that I am the financial ministers ex wife and I need to get 10,000,000 USD out of the country, I don't get a SINGLE reply?

I know the lusers on my list, the majority are employees on MY NETWORK, I know how stupid they are.

If there were no Av products I wouldn't have a job ...

Quote:

---

WHY ARE YOU PEOPLE STILL USING AV PRODUCTS????

---

It is the CYA factor............. have you ever tried to explain to the average MD/CEO why you don't have an AV product and your company just got creamed?

They are a job insurance policy for the CIO ;)

Sorry to seem so cynical, but please think about what you have seen IRL :eek:

Please don't tell me IRL stands for In Real Life. I haven't ran AV on anything but laptops for years. Many servers, many more workstation. And it's not just me. Lots of companies are beginning to understand that antivirus products are reactive.

Meaning if the av software does it's job, your security measures have failed.

Cut the BS................ you know that real life is about politics and covering a$$es................you have been around far to long to think otherwise. :D

I don't mean to be stupid or anything but how do you cover yourself besides setting up crazy policies without any AV's products running.

I workl in the AV industry and if I had to say to my boss that you dont actually need AV products in corporate , im sure he would drop dead.

./dontflame

Quote:

---

Originally Posted by nihil

Cut the BS................ you know that real life is about politics and covering a$$es................you have been around far to long to think otherwise. :D

---

I've seen my share of politics and cya files. I guess there are two things.

First I never have and never will play those games. I tell the truth and only the truth. I do not deceive.


Second. I'm at a point in my career that I don't have to play games, even if I were so inclined. The people I work for rely on my opinion and trust my decisions. Fact that I have a reputation of being honest and never "Playing the Game" is why Companies across the state contact me for contract services. I never initiate contact.

That being said...

Cider:

I had the luxury of building the network I am now in charge of.

First and foremost LEAST PRIVILEGE

My core network. If you are not authenticated you cannot get there.

Border network - before it's gets there It's tested, tested and tested.

Perimeter network. I double up on every thing. Any nasty that manages to get to the border network, I know about instantly.

LAYER 2 and 3 lock it down. With today's hardware it's point and click. In Fact I've seen some nortel hardware where you are not offered a CLI.

End Point security. Lock it down.

Now most end users were first introduced to least privilege with Vista. If you want an example of how NOT to implement least privilege - see Microsoft!

It is a lot of hard work and planning, but in the end you can remove 90% of all running antivirus services across the enterprise with out FEAR of "Something" that "Might" happen.

That is a network you built yourself from scratch ... in my current line I do not have that privilege.