Testing the on-demand detection of different AV with old malwares.

[sujay]

wow.. thanks for the info leo..

---------- Post added at 08:15 PM ---------- Previous post was at 04:07 AM ----------

CA, Cyber Defender, Norton 2010, ByteHero and Protector Plus tested. ByteHero is a heuristic scanner w/o any siganture. I am tested VirIT eXplorer, but it was taking too many time to complete scanning 2nd set. In 1st set its detection was not impressive at all 86/500. So, I didn't complete the scan of second set. I also tested a 'semi-rogue' Maxsecure Spyware Detector, but have not listed it in the main post. It scored fair as a spyware program, set 1: 335/500 (67%), set 2: 1522/5000 (30.44%).

[leofelix]

Hi sujay
never heard before about ByteHero
http://www.bytehero.com/index.asp
http://www.bytehero.com/index.asp
I do not understand if it is freeware or what and if it is available in english too.
Would you like to tell me more please?

Thank you

[sujay]

Hi leo,
See these threads
http://www.wilderssecurity.com/showthread.php?t=252923
http://www.wilderssecurity.com/showthread.php?t=273890

It is a legitimate program and available in english. But it is packed with "themida" and so mistakenly detected by malware by some vendors.
http://www.virustotal.com/analisis/3...77f-1280073314

---------- Post added 07-26-2010 at 01:18 AM ---------- Previous post was 07-25-2010 at 09:35 PM ----------

Guyzzz My post is out of word limit.. So I am removing update section from the main post to here.

I am disappointed in the performance of Immunet Free and shocked in the success of Digital Patrol. About the inconsistent performance of MBAM and SAS I can say that they are not a full AV.

Update 1: K7 antivirus and eScan added. I used eScan antivirus and software toolkit utility to scan.

Update 2: Added Dr.Web. I used latest version of Cure It to scan.

Update 3: Added Clam Cloud and Digital Defender. Although Clam cloud supposed to have the same technology as Immunet, they have different detection. Thanks to akhil for asking me to test...

Update 4: Added Norman. I used Norman Malware Cleaner to scan.

Update 5: F-Prot Added

Update 6: Kaspersky Added. I used AVP Tool to scan.

Update 7: Iobit360 added. I am impressed with the speed of scan and with the speed of removal.

Update 8: Spyemergency Added.

Update 9: The Cleaner Added. I am shocked. It is one of the oldest antimalware in the market.

Update 10: Trend Micro Added. I used Trend Micro Titanium Maximum Security Beta 3

Update 11: Added detection of Hitman Pro. But read the comment at last.

Update 12: Sophos added. I used Multi AV scanning tool for scanning.

Update 13: Panda and Advanced System Protector added.

Update 14: Eset added. I used the online scanner for scanning.

Update 15: Forticlient added. I used its free version.

Update 16: Solo Antivirus and Twister Antivirus added.

Update 17: Ad-Aware Free and AVG Free tested.

Update 18: VBA32 and Quick Heal tested. I again tested HMP with the latest build. Result improve slightly. Set 1: 471 to 472, Set 2: 2079 to 2959.

Update 19: Added Rising, AhnLab, Jiangmin, Kingsoft. I used free Rising (cloud enabled), AhnLab IS (w/o Firewall), Jiangmin (KVAntivirus) and Kingsoft IS (w/o firewall).

Update 20: SpySweeper, Vexira and Avast added. I used Avast Free AV.

Update 21: Arcavir, nProtect, ViRobot tested.

Update 22: Antiy, Iolo and Authentium tested. I used Antiy Ghostbuster, Iolo System Shield AV and Command Antimalware.

Update 23: Blue Point Security added.

Update 24: MSE and Comodo added. I have tested the latest stable build of MSE.

Update 25: Net Protector, eAcceleration, Zillya & Paretologic tested.

Update 26: mks_vir, Wuzzup & Blink Personal tested. Wuzzup like Hitman Pro skips NE files and thats why its detection is poor in the second set like Hitman Pro. For Blink Personal, due to a bug I could not update the engine to the latest version, but databases are current for it.

Update 27: Drive Sentry, Spyware Terminator (w/o Clam AV) and FSB Antivirus tested. Like Hitman Pro and Wuzzup, Drive Sentry also skipped many files in Set 2. It scanned only 1331 files among which it detected 1306. FSB Antivirus is a completely new product. It is still in beta. One of its developer tesk asked me to test the product. If you want to test the product mail to him ~thomas.sloth@fsb-antivirus.com~ . The product homepage is http://www.fsb-antivirus.com/ .

Update 28: Norton tested. I used its latest beta 2011 version.

Update 28: Trojan Remover, Coranti, Ashampoo antimalware, Trustport, Webroot AV, Windows Defender tested.

Update 29: My Free Antivirus, F-Secure & Bullguard tested.

Update 30: CA, Cyber Defender, Norton 2010, ByteHero and Protector Plus tested. ByteHero is a heuristic scanner w/o any siganture.

Update 31: MaxSecure Spyware Detector, G Data, Trojan Hunter and MAXSECURE AV 2010 tested. First Maxsecure is from hxxp://www.maxspywaredetector.com/, that is a delisted rogue, so WOT rating is bad. Later Maxsecure is from http://maxsecure.eu/ and has Ikarus engine, so don't get shocked at its detection. Trojan Hunter cannot scan all files like HMP, so judge its performance based on that.

Update 32: MaxSecure Antivirus Pro 2010 tested. it uses Vipre engine plus its own antispyware that I already tested.

Update 33: Norton Power Eraser, CMC Antivirus, Clamwin and Counterspy tested. Norton PowerEraser was tested with aggressive settings. Both NPE and Counterspy seems to have skipped the NE files. Surprising result of ClamWin compared t Immunet Free and Clam Cloud may be because it scanned all the files. CMC Antivirus is a Vietnamese AV. http://www.cmcinfosec.com/. It has a free version.

Update 34: Spyware Doctor, Outpost AV, Zone Alerm AV, Bitdefender AV, Eset AV, McAfee, BkAV Pro & Tizer Secure tested. I tested the main build of Eset because previously I tested the online scanner. Spyware Doctor surprisingly scored better than the free version. Zoe Alerm scored much bad than Kaspersky.

Update 35: Vipre, VirIT Explorer tested. I am concluding my test now.

---------- Post added at 01:20 AM ---------- Previous post was at 01:18 AM ----------

MaxSecure Spyware Detector, G Data, Trojan Hunter and MAXSECURE AV 2010 tested. First Maxsecure is from hxxp://www.maxspywaredetector.com/, that is a delisted rogue, so WOT rating is bad (I finally decided to list it.). Later Maxsecure is from http://maxsecure.eu/ and has Ikarus engine, so don't get shocked at its detection. Trojan Hunter cannot scan all files like HMP, so judge its performance based on that.

[leofelix]

Thank you sujay
I have downloaded but not installed since it seems to be really poor. Perhaps I'll try it into a VM
According to Jotti Malware Scan it is clean
http://virusscan.jotti.org/en/scanre...e1c1cb63155347
In regards to Themida, I do not think the developers had a very good idea
http://www.wilderssecurity.com/showthread.php?t=184840

[sujay]

Thank you leo. Please test it with the highest possible settings... But IMO in regards of a totally heuristic scanner FSB Antivirus beta is way better, that also do not have any signature...

---------- Post added at 01:46 AM ---------- Previous post was at 01:45 AM ----------

One thing, you don't have to install it. It is portable..

[leofelix]

@ Sujay: I have to be honest.
I wouldn't test it against live malware even if they paid me
Well I was kidding, I do not feel like doing it now

I have just re-tested another application (I won't tell its name now) which is supposed to remove rogue.
I infected a VM running XP with 5 old rogue (Antivirus2009 like), and that unnamed application detected only 1 infected file.
Do note: the most of antivirus and antimalware are able to detect and remove those old types of rogue I have used

[sujay]

lol I know what that is...

[acr]

What other av's are to be tested yet? What about ZoneAlarm? Might as well do the whole industry at this point

[sujay]

Hi acr: I wish to carry out some special tests now, like orignal engines like Ikarus, Virusbuster, Bitdefender, Vipre. Some Mixed AV
ZA: Kaspersky + own AS
Outpost: Virusbuster + own AS
Adaware TS: because I guess it has lavasoft + Vipre + Gdata
Kaspersky 2011, Panda cloud, Trendmicro noncloud
And last but not least McAfee.

I don't know how much I can test...

---------- Post added at 02:15 AM ---------- Previous post was at 02:11 AM ----------

MaxSecure Antivirus Pro 2010 tested. it uses Vipre engine plus its own antispyware that I already tested.
Good Night...

[richie1913]

Sujay If you get time could you please test Tizer Secure from x wire tech,they do a 14 day free trial,you can find out more Here