Avira users :)

[mountaintree16]

I was just looking at this thread:

http://www.malwarebytes.org/forums/index.p...st&p=130769

And it seems like Avira is having a lot of FP's?

Could you Avira users out there tell me what your experiences have been with it and regarding FP's? I have never used it, but I am going to install it soon on a system that needs a better AV on it. I was planning on installing Avira. However, I am not there that often, and I am a bit concerned now about FP's messing up the system, or maybe other programs, potentially.

It's a Vista.

Also, if you use Avira AND Vista, how do they get along?

Does Avira need much user interaction?

Anything else I should know about Avira?

[swagger]

I use Antivir on my desktop and used to use it on my laptop. I'm currently using the trial version of KAV 2010 on it right now. I have never had a false positive with Avira but that's just me

Keep in mind that it is a test and there are many variables that go along with it.

[mountaintree16]

Thanks for the reply, swagger

Keep in mind that it is a test and there are many variables that go along with it.

Very true, thanks

[Falkra]

Hi mountaintree16,

I have been using avira on a computer for more than three years or more, mostly the free version, and sometimes the full version, when there are special offers to get a free 6 month full licence.

And it seems like Avira is having a lot of FP's?

There are FPs, indeed, but as far as I see, in an acceptable range. I mean with heuristics set to medium level (it's default setting).

I send files to editors, and Avira reacts quite fast, and in a accurate way, including false-positive delisting requests, as long as you provide information, urls, and the file with some explanations.

I don't use Vista on that computer, so I can't tell you about how Vista and Antivir react together, it should be ok.

Does Avira need much user interaction?

Anything else I should know about Avira?

The interaction can be reduced : there is a built-in scheduler (included in the free version) to set up automatic updates, and the interactions when detection something can be configured, so you can choose to set it to a fully automatic mode (not recommended for antivirus, usually), or an interactive mode, then it asks you what to do.

Antivir v9, when doing a full scan, now reports a summary at the end of scan, so you can scan and forget, then see everything. Before, you had to answer after each detection, and the automatic feature was only available after the first detection (checking "use this decision for further detections"). This is much better now.

One problem is that the update servers of the free versions are slow, and sometimes you just don't get the files. This doesn't happen with the paid version.

Things are a bit better now, but it is a known problem.

I'd like to suggest you a real test. Since there is a free version, you can test it on your machine for free, and see how it works and interacts with your os, your specific hardware and software. This way you will be able to decide if it is ok, and perhaps get a paid version, or go back to another product.

The detection engine is good, and very well updated.

[prairie dog]

I have been running the free version of Avira on XP SP3 and have never had a false positive. Maybe I'm just lucky

I can tell you that I am very happy with it and have no plans to switch

[mountaintree16]

@ prairie dog

Thank you for your feedback

I appreciate it.

[mountaintree16]

@ Falkra

to the first part of your reply:

Thank you! That's helpful information

To the second part, about user interaction

so you can choose to set it to a fully automatic mode (not recommended for antivirus, usually), or an interactive mode, then it asks you what to do

etc...

What do you suggest for settings for a user who knows little to nothing about an AV program? I am not there that often to keep an eye on the AV, so I would like to set it up to run as smoothly as possible with little user interaction needed, whilst providing maximum protection and user benefit to the system.

Thank you for the heads up on the update servers. I found this out partially last week when I was trying to download the setup for this computer; I had to delay my working on the system until tomorrow because of this. Do you know, when there is a delay in the updating of the AV on the free version, if it will come through eventually?

I'd like to suggest you a real test. Since there is a free version,

I would love to test the free version, but I do not have a system to test in on, unfortunately.

The detection engine is good, and very well updated.

Good to know! I've heard this from you and more than several others. That's why I am choosing it for this system It needs a good AV, and for now, a free one. I will be purchasing a paid version for this system at some point, but for now it will have to be a free version. I think I'll purchase Avira for the system, as that seems like the best one for this system

[noknojon]

I was just looking at this thread:

http://www.malwarebytes.org/forums/index.p...st&p=130769

And it seems like Avira is having a lot of FP's?

Could you Avira users out there tell me what your experiences have been with it and regarding FP's?

The test reports I have been reading have listed Avira as being top in detection , But they always drop its position due to the amount of FP's -

Avira is usually 1 or 2 in most lists until they hit FP's - It is a very easy program to use and until a few days ago I never had a FP -

3 items were listed as 'suspicious' but when submitted they came back as OK - I have used it for about a year (gave up AVG) and I am happy -

I have just installed Kaspersky trial for 30 days to ensure that the detections were FP's and I WILL go back to Avira after that -

[mountaintree16]

@ noknojon

Thanks for the feedback. Yes, I saw your post about the FP's, I'm glad that they were FP's and that things came back clean.

Oh, you know, there IS a Kaspersky online scanner

You can get that from Here

(thanks to Exile for the link! )

[YoKenny1]

One of the reasons I switched to avast! is its lack of FP's and now that Vincent Steckler joined as CEO from Symantec avast! will become a more visible anti virus application:

http://blog.avast.com/2009/07/20/welcome-a...-i-joined-avast

[swagger]

Oh, you know, there IS a Kaspersky online scanner

You can get that from Here

(thanks to Exile for the link! )

That is not actually an online scanner. You download the executable, it installs to your desktop and the program loads automatically. You choose what you want to scan (there are multiple items) and then let that bad boy do it's work. Kaspersky DOES have an online scanner that can be found here.

[mountaintree16]

Thanks for the info YoKenny1

[mountaintree16]

@ swagger re Kaspersky

Thanks Now I know about both

[exile360]

Yep, the AVPTool I linked you to is to download, install on a system that already has an AV installed, scan the system and remove any threats it finds. Very handy for cleanups . The online scanner only checks for infections but will not remove them.

[mountaintree16]

@ Exile

Thanks for explaining the difference, I wasn't sure if there was a difference in removal or not

I will definitely be using the AVPTool on this machine!

[exile360]

It is quite handy, and it's updated very regularly to contain the latest detection signatures .

[mountaintree16]

@ Exile

Which is why I'll download it shortly before I leave, hehe. I'll run it on my own machine too sometime soon, just to check.

[swagger]

No problem. It's very handy as exile said. An updated version is released every day so you can always get a new one with the updated definitions.

[mountaintree16]

@ swagger

[swagger]

@mountaintree,

No problem at all. Like I said, I use it very often as well. It's in my toolkit. I do have uses for the online scanner as well though. But, I completely understand your reasoning for using the virus removal tool. I was just mentioning that they update it daily.

[mountaintree16]

@ swagger

No problem,.

Thanks for mentioning that they update it daily. Exile told me this a while ago though, but it is useful to mention it in this thread too, for anyone else that might be reading

[Falkra]

Hi, I have to quote because the questions are far away now.

What do you suggest for settings for a user who knows little to nothing about an AV program? I am not there that often to keep an eye on the AV, so I would like to set it up to run as smoothly as possible with little user interaction needed, whilst providing maximum protection and user benefit to the system.

The default settings are ok, and it allows some user interaction. If the user is not sure, when a file is detected, the best thing to do is to quarantine it. This way it can be restored, in case you need it.

Thank you for the heads up on the update servers. I found this out partially last week when I was trying to download the setup for this computer; I had to delay my working on the system until tomorrow because of this. Do you know, when there is a delay in the updating of the AV on the free version, if it will come through eventually?

The delays look like poor bandwidth, or too much connected users at the same time. Most times, the delays appear when a big update is pushed on the servers, like a program update, of some Mb, instead of the database updates (some Kb). Things get back to normal after 2 days, usually.

The test reports I have been reading have listed Avira as being top in detection , But they always drop its position due to the amount of FP's

True, because Antivir uses a heuristics a lot, and the protocol used to test (it is readable) doesn't really use the positive aspects of heuristics.

Like every comparative, we have numbers, percentages, but this doesn't reflect the way we use antivirus software, in my opinion. It is good to compare, but what will make an antivirus better than another, at a precise moment ? Reactivity. Response.

In my opinion, one of the most important points cannot be compared easily, or computed to a percentage : the speed of the updating teams, the programers who add new signatures to the databases, and this makes difference. If you have a great antivirus engine, but you don't feed it, it's useless. When a new infection spreads, teams must react fast, get samples, classify them and push updates.

What malware infects computers ? The top-latest one, not the early variant that is 7 days old.

This is difficult, quite impossible to compare, but very important.

I sent infectged samples to editors, and I can see how fast they add them, or if they detect them already. Avira is good. Alwil (Avast) is not. they even don't answer my e-mails, and don't update detections, even on big infections. Avast is good, but the definitions are updated too late, as far as I see.

When you get FPs, send samples to the editors, they fix it quickly. I can post the link for Avira, if someone want's it, there is an online form.

[mountaintree16]

@ Falkra

That's alright. Sometimes it is necessary to quote

The default settings are ok, and it allows some user interaction. If the user is not sure, when a file is detected, the best thing to do is to quarantine it. This way it can be restored, in case you need it.

Alright, thanks I'll go with the default settings then, and tell them if they aren't sure to quarantine, quarantine, quarantine!

The delays look like poor bandwidth, or too much connected users at the same time. Most times, the delays appear when a big update is pushed on the servers, like a program update, of some Mb, instead of the database updates (some Kb). Things get back to normal after 2 days, usually.

Yeah, that's probably what it is. I was just really really bummed that day because, this computer really really needed a better AV asap and I had deleted my copy of Avira from a week prior to download a fresh copy, and the servers were down until it was too late for me to go... and because of the distance and my schedule, I was not able to make it again until today... I was going to do it two weeks ago but Firefox took so long to update, and I thought that that should be updated too. (the system in question has dial-up, which is why I am downloading everything onto a thumb drive).

Thanks again for your feedback, I appreciate it.

[exile360]

In my opinion, one of the most important points cannot be compared easily, or computed to a percentage : the speed of the updating teams, the programers who add new signatures to the databases, and this makes difference.

Bingo, which is why I love Kaspersky and MBAM .

edited for spelling

[mountaintree16]

@ Exile

I actually wanted to get them Kaspersky (as far as I can see on the website, you can't purchase a license for one machine, its 3 at once at minimum), and I was thinking about getting it for my system when my AVG runs out.

However, did you say somewhere that Kaspersky requires more user knowledge than most other AV's? I wouldn't want to install it on their system if this is the case, they wouldn't know what to do with it.