Unsolved
This post is more than 5 years old
5 Journeyman
•
15.6K Posts
•
45K Points
0
3174
June 8th, 2010 06:00
AV Comparatives Retrospective/Proactive Tests, May 2010
http://www.av-comparatives.org/index.php?option=com_content&view=article&id=144&Itemid=152
The testing this time focused on the ability to detect UNknown threats (i.e., before they were placed in a signature database) using generic/heuristic methods.
As a result, ALL the scores were low (relative to what these products normally receive when considering their detection rates of KNOWN, signature-based malware): the TOP products only scored 63%.
of the popular FREE products, Microsoft Security Essentials and Avira received an "Advanced+" ranking, while Avast receieved only an "Advanced" ranking.
No Events found!
Bugbatter
4 Apprentice
•
20.5K Posts
0
June 8th, 2010 19:00
Thank you for posting this, ky331. :emotion-1:
ky331
5 Journeyman
•
15.6K Posts
•
45K Points
0
June 8th, 2010 20:00
BB,
you'll be happy to know that Microsoft's Security Essentials did especially well in this particular test: not only was it toward the top of the chart in proactive detection rate, it was also near the top in fewest false positives. An excellent "1-2 punch".
in fairness, I think one other critical aspect of this test must be noted/emphasized here: it considered only the generic/heuristic capabilities of a passive on-demand scan. in other words, it did NOT consider on-execution / behavioral analysis. This can (possibly) explains avast's significantly poorer showing, in that this test did not factor-in the proactive nature of avast's "behavior shield", which "monitors activity on your computer using a number of sensors (file system, registry and network based) and reports/blocks any suspicious behavior"; nor avast's [optional] ability to perform "code emulation: If avast! detects some suspicious code in a file, it will attempt to run the code in a virtual environment to determine how it behaves. If potential malicious behavior is detected, it will be reported as a virus. Running the code in this virtual environment means that if the code is malicious it will not be able to cause damage to your computer".
joe53
5 Journeyman
•
5.8K Posts
•
17.3K Points
0
June 9th, 2010 19:00
Good points, ky.
On-demand detection is perhaps a less important indicator of an AV's overall protection. I'm more interested in prevention, than in detection. AV-C indicated in its latest newsletter that new dynamic tests are forthcoming.
And in fairness it should be noted these tests were actually conducted in early February/2010, and the analysis only now just published. As I recall, avast! 5.0 had just been released in its first version back then.
Nonetheless, it's a bit disappointing to see that of the 15 AVs undergoing this test who were all last tested 6 months previously, fully 13 had lower proactive detection rates this time around (the average drop was about 10% in absolute score).
I'm glad to see that MSE did not fall in this group, and actually improved a bit.
But the moral here seems to be: don't rely on your on-demand scans to protect you, and don't choose an AV solely on tests like these.