virus software testing

[wingers]

Hi

I have been doing my own independent testing of virus products for my customers using a sample of 5923 known infected files and have been getting some interesting results with different software - some with 96% detection, some as low as 40% - but I have encountered worrying results using MBAM which surprises me as I love the program and find it great at cleaning infected computers, but for some reason it only detect 0.04% of the 5923 infected files I supplied it and asked it to scan?

Any comments on this please?

[exile360]

Greetings

The following likely accounts for your results:

1. Our software is not antivirus software, we never try to detect every single threat that exists or has ever existed. We go after the latest threats that are missed by the majority of antivirus vendors
   
2. We do not scan archives (zip, RAR etc.)
   
3. Our software is designed to detect active infections and droppers for infections, not an arbitrary folder full of malware (infections don't install this way, so it cripples many of our heuristics checks when you scan a folder this way)
   

An example of a more realistic, real world test may be found here. They are conducting detection tests with various products using live samples that are actually found currently in the wild.

[wingers]

Thanks for your reply - I fully understand that your product is not antivirus software but it does supposedly offer active protection - so still very surprised it does not find these files even if they are accessed by me

P.S. They are not zipped

[exile360]

As I said, we go after live threats that are active in the wild. If they're in the wild (meaning there are infected sites trying to drop them on users' systems), then we go after them. After infections reach a certain age (and after they are no longer found in the wild), we will generally remove detection for them from our database to free up space and keep the program light. By that time, the majority of antivirus software would already have those older threats covered so us detecting them would be pointless since we expect all of our users to run an active, up to date antivirus in addition to our software.

[wingers]

As I said, we go after live threats that are active in the wild. If they're in the wild (meaning there are infected sites trying to drop them on users' systems), then we go after them. After infections reach a certain age (and after they are no longer found in the wild), we will generally remove detection for them from our database to free up space and keep the program light. By that time, the majority of antivirus software would already have those older threats covered so us detecting them would be pointless since we expect all of our users to run an active, up to date antivirus in addition to our software.

okay thanks

Have you ever considered doing your own av package so users don't need anything else installed? just curious because as a removal tool of the latest threats your product is world class

[exile360]

I don't think we've considered it, at least not seriously as that might make it seem like we prefer one AV over another, which is not the case at all. I believe personally that there is no one AV that is right for all users because they often work very differently (simple vs complex settings, UI's etc.) so what is good for one user may not be good for another. As an example, 2 of my favorite AV's are MSE (Microsoft Security Essentials) and KAV (Kaspersky Antivirus), but these two products are very different. MSE is simple to set up and use, but doesn't offer the detailed, granular control that Kaspersky offers, so where one user who likes the "set it and forget it" approach might want MSE, another, more savvy user might prefer Kaspersky.

I prefer to leave it up to the user to decide what AV is right for them, that's why you'll often see staff members as well as forum regulars offer a number of suggestions on which AV to use when someone asks, because it's all about finding the one that fits right for that particular user .