SSUpdater.com Anti-Malware test

[BlackNeo]

Naletih na ovaj test AV software-a, zanimljivi rezultati: http://ssupdater.com/modules/Forums/index.php?showtopic=3746

Welcome to SSUpdater.com Anti-Malware test, the only independent malware test online!!!
In total 30 programs have been tested, which were picked by our members, all the programs tested used maximum settings including heuristic behavior and riskware defense.
The test was conducted in virtual environment using Microsoft's Windows XP SP3 with all the latest updates.
The main goal of this test is to make a comparison to VirusBulletin's VB100 test and therefore we did NOT use any of the samples from their test, another goal is to compare our results with always questionable results form AV Comparatives.
In this case we used a malware sample containing 800.025 items, in the folowing categories:
Windows Viruses, Trojans, Backdoors, Worms, Spyware, Adware, Rootkits, Exploits, Keyloggers, Hacking Tools, Malicious Scripts and other malware
In other words we used 99.5% of the known malware from the last 4 years including this year, we also used samples which are a bit older but only the ones that pose a threat of possible outbreak/infection.
As always we used a collection of unknown malware, those samples are custom made and are NOT for mass distribution, in total there were 18 255 samples in that collection.


The Results
(Name/Detection Rate)

1. a-squared Anti-Malware - 99.12%
2. AntiVir PE Premium - 98.88%
3. Avast! - 98.75%
4. Norton Antivirus - 98.69%
5. Ikarus Virus Utilities - 98.48%
6. Kaspersky Antivirus - 97.83%
7. BitDefender Antivirus-97.79%
8. F-Secure -97.21%
9. Zone Alarm-96.91%
10. Spy Emergency-95.64%
11. McAfee VirusScan Plus - 94.18%
12. Comodo Internet Security - 92.53%
13. Twister Anti-TrojanVirus - 92.49%
14. Rising Antivirus - 92.27%
15. Dr.Web- 92.04%
16. Norman Antivirus & Antispyware - 91.78%
17. Blink Personal Edition - 90.93%
18. PC Tools Internet Security - 89.77%
19. Nod32- 88.35%
20. AVG Antivirus - 87.45%
21. Microsoft Windows Live OneCare - 87.12%
22. MoonSecure Antivirus - 86.43%
23. Spy Sweeper with Antivirus - 84.64%
24. TrendMicro Internet Security- 84.13%
25. Spyware Terminator with Antivirus- 61.38%
26. VIPRE- 60.97%
27. 123 Spyware Free - 57.68%
28. Ad Aware - 28.04%
29. SuperAntiSpyware - 07.24%
30. Malwarebytes Anti-Malware - 02.66%

Zanimljivi rezultati - ujedno i prvi zvanični test Comodo Internet Security-ja, za početak odličan rezultat.

Na testu loš rezultat Malwarebytes Anti-Malware - ipak je on više anti-spyware nego antivirus softver.

a-squared ostvario odličan rezultat (to je a-squared sa Ikarus antivirusom, koliko mi se čini, stoga i bolji rezultat). Nod32 malo podbacio, Avira i Norton očekivano u vrhu, Avast ih prati u stopu...

 

[danilo989]

Speed and VB100 Award

1. a-squared Anti-Malware - average - N/A
2. AntiVir PE Premium - fast - Passed
3. Avast! - average - Passed
4. Norton Antivirus - average - Passed
5. Ikarus Virus Utilities - average - Failed(37 wildlist misses, 8 false positives)
6. Kaspersky Antivirus - average - Passed
7. BitDefender Antivirus - average - Failed(4 false positives)
8. F-Secure - average - Passed
9. Zone Alarm - average - N/A
10. Spy Emergency - very slow - N/A
11. McAfee VirusScan Plus - slow - Passed
12. Comodo Internet Security - fast - Passed

Nisam znao da je Comodo testiran na VB100................
Greska u tekstu verovatno...

 

[BlackNeo]

Nisam znao da je Comodo testiran na VB100

I meni se čini da sam to pročitao, ali sad otvorih stranu opet:

...
12. Comodo Internet Security - fast - NA
...

 

[danilo989]

Ono sto me zanima, a nigde nisam nasao da su naveli:
1) Da li su proveravali ispravnost koriscenih sample-ova, tj. da li su proveravali funkcionalnost istih. Nema smisla detektovati nesto sto ne radi
2) Da li su gledali False Positive rate AV programa...? Mogu da se napravim pametan, pa napravim AV progam koji ce da detektuje sve fajlove kao maliciozne... dobice ocenu 100% ali da li je kao takav upotrebljiv u realnom svetu?
Veliku vecinu sample-ova su verovatno "skupili" sa raznih VX sajtova, medju kojima ima veoma starih, a kao takvi ne predstavljaju realnu pretnju danas... ITW sample-ovi su bitniji IMO.
Ispravili su se za Comodo

 

[BlackNeo]

Koliko sam pročitao i u raspravi na Comodo forumu, postoji i problem sa korišćenjem Virtuelne Mašine, pošto ima malware-a koji se ne manifestuje kada vidi da je VM u pitanju (pa ga ni AV ne može detektovati). Evo linka ka temi na Comodo forumu, pa možeš baciti pogled: link.

Ovaj što je glavni za testiranje kaže da ima tim od 14 ljudi koji mu sakupljaju malware (plus što ih dobija iz drugih izvora).

Što se tiče False Positive-a, koliko sam shvatio uzeli su i to u obzir:

Expert= program may have high false positive rate, interface (GUI) could be complex for users without expert computer skills. Program may display many pop up notifications that required expert skills to know what to do.

Average+= program may have false positives, interface (GUI) may be a little complex for the average user. Program may display pop up notifications that may be a little complex for the average user.

Average = program is suitable for most average users, interface (GUI) is not complex and program doesn't display pop up notifications that an average user would find hard to understand.

Novice= program is suitable for all users, everything is easy to understand.

 

[danilo989]

<snip>
Što se tiče False Positive-a, koliko sam shvatio uzeli su i to u obzir:

Expert= program may have high false positive rate, interface (GUI) could be complex for users without expert computer skills. Program may display many pop up notifications that required expert skills to know what to do.

Average+= program may have false positives, interface (GUI) may be a little complex for the average user. Program may display pop up notifications that may be a little complex for the average user.

Average = program is suitable for most average users, interface (GUI) is not complex and program doesn't display pop up notifications that an average user would find hard to understand.

Novice= program is suitable for all users, everything is easy to understand.

Po meni ovaj sistem ocenjivanja nije validan. Na primer, neki program ima 0 FPa ali mu je GUI kompleksan i okrenut ekspertima... da li ce on onda dobiti "Expert" "ocenu"? Ako da, kako se to onda reflektuje na FP rate, jer se iz ocene moze zakljuciti i da ima veoma veliki broj FPa... sto ne mora da bude slucaj
Neka pogledaju kako su u AVC testu to odradili...
I ne svidja mi se kako pljuju po drugim testovima, pre svega na AVC o kome/kojima imam veoma pozitivno misljenje... to pomalo govori o njima... sta vise cini mi se kao da su Script kiddies...
No, bilo kako bilo, kao i kod bilo kojeg drugog testa- read, digest and move on...
Edit: I hvala za link

 

[BlackNeo]

No, bilo kako bilo, kao i kod bilo kojeg drugog testa- read, digest and move on...

Upravo tako - korisno je pročitati razne opise i poređenja, ali ništa dok se ne proba iz prve ruke

A i ovo oko FP su baš zakomplikovali, bez potrebe. I ja sam primijetio da dosta pljuju po AV Comparatives, mada i ovi uzvraćaju po njima - opšta pljuvačina :d

 

[danilo989]

Ovo postaje sve bolje i bolje
Nasli su warez materijal na njihovom forumu (medikamente i meleme svih tipova ) i izgleda da pokrecu sudski postupak protiv njih... E, ovo jos nisam doziveo :d:smash:
Necu postavljati linkove ka thread-ovima na njihovom forumu posto je to protiv pravila, ali mozete i sami pretraziti.
Sto se tice samog testa, slazem se da je nepravedno da testiraju aplikacije kao MBAM i SAS, jer se ti programi pre svega koncentrisu na detekciju stvari koje AV programi redovno propustaju- trojanci, fraud tools, spyware etc. i nisu namenjeni da budu zamena za AV vec dopuna.
Kao takvi, MBAM i SAS IME siju sve ostale programe tog tipa... stvarno imaju dobru detekciju i removal rate i obavljaju posao (u realnom svetu), sto je najbitnije. Jeste da koriste neke po meni pomalo cudne tehnike detekcije (pre svega mislim na file name based detection), ali ukoliko to obavlja posao ne bunim se.

 

[samer]

Ovo postaje sve bolje i bolje
Nasli su warez materijal na njihovom forumu (medikamente i meleme svih tipova ) i izgleda da pokrecu sudski postupak protiv njih... E, ovo jos nisam doziveo :d:smash

HAHAHA

Sve mi deluje vrlo nezrelo!
Bice :smackbum:

 

[BlackNeo]

Nasli su warez materijal na njihovom forumu (medikamente i meleme svih tipova )

He he, vidi stvarno :d

 

[danilo989]

...and the site is down... probably permanently