Vista Tutorial - Vista SP1 Antivirus Performance

The following Vendor viral lab testing performance information is to provide assistance in choosing an antivirus/antimalware program. A single test failure does not mean the product will not provide adequate protection. Ideally those that have consistently passed testing are more reliable and will provide the utmost protection, but a failure could be the result of many different reasons.
note-registration(free) may be required to view detailed Vendor test results.

"In the wild" or "Wildlist" means Viruses and/or malware that are currently circulating on the Net, and infecting systems (i.e., 5 Wildlist misses means 5 individual viruses/malware infections). "false Positives" is the detecting of a Virus/malware, that is in effect not a Virus or malware.



AV-Comparatives February 2009 test results
On Demand Detection test




For AV-Comparatives November 2008 Test results
Proactive/Retroactive test




For AV-Comparatives August 2008 Test results
On Demand Detection Test





For current Vista x64 results December 2008 (virus Bulletin- VB100)
Agnitum


Status: PASS
Result history: Agnitum
Product name: Agnitum Outpost
Details: Only available to subscribers.

AhnLab


Status: PASS
Result history: AhnLab
Product name: AhnLab V3 Internet Security
Details: Only available to subscribers.

Alwil


Status: FAIL
Failure reason: 1 false positive
Result history: Alwil
Product name: Alwil avast!
Details: Only available to subscribers.

AVG (Grisoft)


Status: PASS
Result history: AVG (Grisoft)
Product name: AVG Internet Security
Details: Only available to subscribers.

Avira


Status: PASS
Result history: Avira
Product name: Avira AntiVir
Details: Only available to subscribers.

CA eTrust


Status: PASS
Result history: CA eTrust
Product name: CA eTrust
Details: Only available to subscribers.

Eset


Status: PASS
Result history: Eset
Product name: ESET NOD32
Details: Only available to subscribers.

Fortinet


Status: PASS
Result history: Fortinet
Product name: Fortinet FortiClient
Details: Only available to subscribers.

FRISK


Status: PASS
Result history: FRISK
Product name: FRISK F-Prot
Details: Only available to subscribers.

F-Secure


Status: PASS
Result history: F-Secure
Product name: F-Secure Client Security
Details: Only available to subscribers.

Kaspersky


Status: PASS
Result history: Kaspersky
Product name: Kaspersky Anti-Virus
Details: Only available to subscribers.

Kingsoft


Status: PASS
Result history: Kingsoft
Product name: Kingsoft Internet Security
Details: Only available to subscribers.

McAfee


Status: PASS
Result history: McAfee
Product name: McAfee VirusScan
Details: Only available to subscribers.

Microsoft Forefront


Status: PASS
Result history: Microsoft Forefront
Product name: Microsoft Forefront
Details: Only available to subscribers.

Microsoft OneCare


Status: PASS
Result history: Microsoft OneCare
Product name: Microsoft OneCare
Details: Only available to subscribers.

MicroWorld


Status: PASS
Result history: MicroWorld
Product name: MWTI eScan
Details: Only available to subscribers.

Norman


Status: FAIL
Failure reason: 1 false positive
Result history: Norman
Product name: Norman Virus Control
Details: Only available to subscribers.

CAT QuickHeal


Status: PASS
Result history: CAT QuickHeal
Product name: Quick Heal AntiVirus
Details: Only available to subscribers.

Rising


Status: PASS
Result history: Rising
Product name: Rising Antivirus
Details: Only available to subscribers.

Sophos


Status: PASS
Result history: Sophos
Product name: Sophos Anti-Virus
Details: Only available to subscribers.

Symantec


Status: PASS
Result history: Symantec
Product name: Symantec Endpoint Protection
Details: Only available to subscribers.

VirusBuster


Status: PASS
Result history: VirusBuster
Product name: VirusBuster Professional
Details: Only available to subscribers.

Webroot


Status: PASS
Result history: Webroot
Product name: Webroot I.S. Essentials
Details: Only available to subscribers.

Updated:
Virus Bulletin October 2008 Windows Server 2008 Vendor Results
Windows Server 2008 is built from the same code base as Windows Vista; therefore, it shares much of the same architecture and functionality.
https://www.virusbtn.com/Session-b1e...rchive/2008/10

Agnitum-Passed
AhnLab-Passed
Avast! (Alwil)-Passed
AVG (Grisoft)-Passed
NOD32 (Eset)-Passed
Fortinet-Passed
FRISK-Passed
Kingsoft-Passed
McAfee-Passed
Microsoft Forefront-Passed
Norman-Passed
Rising-Passed
VirusBuster-Passed
Sophos-Passed
Norton (Symantec)-Passed
AEC (Trustport)-Passed

ArcaBit
Status: FAIL
Failure reason: 93 wildlist misses, 3 false positives

Avira
Status: FAIL
Failure reason: 1 false positive

CA eTrust
Status: FAIL
Failure reason: 1 wildlist miss

F-Secure
Status: FAIL
Failure reason: 1 false positive

Kaspersky
Status: FAIL
Failure reason: 1 false positive

MicroWorld
Status: FAIL
Failure reason: 1 false positive

Quick Heal
Status: FAIL
Failure reason: 1 false positive

RedStone
Status: FAIL
Failure reason: 1 wildlist miss, 1 false positive



Virus Bulletin April 2008 Vista SP1 Vendor Results
https://www.virusbtn.com/Session-be9a3da9e372acb7194b9a2549bd541a/vb100/archive/2008/04

AEC (Trustport)-Passed
AVG (Grisoft)-Passed
Avira-Passed
CA eTrust-Passed
CA Home-Passed
Check Point-Passed
NOD32 (Eset)-Passed
Fortinet-Passed
FRISK-Passed
F-Secure-Passed
GDATA-Passed
Kaspersky-Passed
Kingsoft-Passed
Microsoft Forefront-Passed
Microsoft OneCare-Passed
MicroWorld-Passed
Redstone-Passed
Norton (Symantec)-Passed


Avast! (Alwil)
Status: FAIL
Failure reason: 19 wildlist misses, 1 false positive


Agnitum
Status: FAIL
Failure reason: 4 wildlist misses

AhnLab
Status: FAIL
Failure reason: 2 wildlist misses

BitDefender (SOFTWIN)
(Status: FAIL
Failure reason: 2 wildlist misses

Bullguard
Status: FAIL
Failure reason: 2 wildlist misses

Doctor Web
Status: FAIL
Failure reason: 47 wildlist misses

Hauri
Status: FAIL
Failure reason: 3 wildlist misses

Ikarus
Status: FAIL
Failure reason: 24 wildlist misses, 6 false positives

K7 Computing
Status: FAIL
Failure reason: 19 wildlist misses, 2 false positives

McAfee
Status: FAIL
Failure reason: 1 wildlist miss

Norman
Status: FAIL
Failure reason: 1 false positive

PC Tools AntiVirus
Status: FAIL
Failure reason: 4 wildlist misses

Quick Heal
Status: FAIL
Failure reason: 2 false positives

Rising
Status: FAIL
Failure reason: 3 wildlist misses, 1 false

Security Coverage
Status: FAIL
Failure reason: 859 wildlist misses, 1 false

Sophos
Status: FAIL
Failure reason: 2 wildlist misses

Trend Micro
Status: FAIL
Failure reason: 3 wildlist misses, 2 false positives

VirusBuster
Status: FAIL
Failure reason: 4 wildlist misses

Spysweeper (Webroot)
Status: FAIL
Failure reason: 2 wildlist misses

Hi rive0108

Nice post, good and very Important info.
I'm a Lifetime member at VB, I was awarded a Lifetime membership for the years I worked as an Independent Unknown Variant tester (in my spare time) for the major companies a few years back.
VB100% is the AV Bible AFAIC, and any product that can't attain a VB100% is not worth a cent IMHO.

There's a few surprises in this most recent round of testing I must say...don't you think? A couple that I really didn't expect to see fail in there, and a bunch of the regulars to the Failure list as well.

Anyway, I hope some of the less security savvy members can find some use for this info and possibly drop their garbage AV if they have one, and get something worth it's weight in Gold...(like Nod32...not like I'm endorsing or anything...but NOD32 - by Eset...thats N-O-D-32...ok)

ESET still passes on all Vista tests, as does Symantec.....in fact, both companies have passes across all platforms tested in the last year.

I'm not surprised with a huge portion of the programs failing the tests. What surprises me is that Symantec passed these tests. Normally Symantec can't even pass VB100 tests that I know of.

Hiya Guys

John, Eset holds the record for consecutive VB100% awards. I thought it was 43 but I'm either mistaken or some have gone missing recently. Eset also boasted this on their website but that has also been removed. They do hold the most VB100%'s by any vendor now, at 51, and 0 false positives since VB started testing in 1998.
3 Fails in 54 submissions, 1 for DOS, 1 for early NT, and 1 for Suse Linux, but 100% on all platforms since 2002.
Their heuristics engine is still considered the most advanced in the Biz, Nod32 is my #1 recommendation. Kaspersky was my #2 but they had update issues this year that made the scanner nearly useless for awhile. Plus they had 2 fails last year and 1 already this year...not so good so I've stopped recommending them until they pick it up. They fixed those update issues fairly quickly once found but I think that just shows a lack of competence in their engineers right now.
I haven't had the time to research a new #2 recommendation yet but I will soon.

WildEagle - Actually my friend, Symantec has 39 consecutive VB100% awards. They usually do very well in "In the Wild" and 0 false positives, it's their bloat and resource usage that irks everyone...that and the fact that their uninstall routines are notoriously horrible for removing Symantec and Norton items...and that's not by accident either. I have found over 85 Symantec objects left on a machine (XP Pro SP2) after the uninstaller has run. You have to use a secondary tool to remove any of those others, it's not readily available to regular users, and that's just unacceptable IMO. And it STILL doesn't remove everything...

The exact reason I quit using them years ago...I find a lot of comfort in the free guys without the accompanying BS.

See...
(LOL)

Hi loceng

You're in a very large and rather unruly group there my friend! I do have to say that Symantec is actually a very good scanner and decent heuristics engine, but their recent reputaion (deservedly so too) for bloat, resource usage, and leftovers after uninstalling are just completely unnecessary and unwanted. Most other good scanners have small footprints and lower resource usage, Symantec needs to learn from this but they have such a large OEM base still, I think they just don't care.

I can't knock Symantec/Norton for effectivness...they always kept my machine clean, but at what cost? Others have proven that the same thing can be accomplished with a smaller footprint while drawing from less resources and digging their tentacles in not so deeply. I'm with you, they have got their foot in the door with OEM's and really don't care about making their product better. Actually "better" would be in the eye of the beholder.

That I did not know. It's because of the bloat and other garbage that I quit using Norton years ago.

I myself use NOD32 3.0 x64 antivirus. I would recommend it to anyone. It's also rather inexpensive for annual renewal ($27.99), and unlike Norton automatically updates the program to the newest release for free.