The Best antivirus/Antimalware Program currently Available

Computer magazines and ezine Antivirus Testing and Recommendations (i.e., Editor's Pick Awards)

by Andrew J. Lee
AVIEN Founding Member
http://www.avien.net

It is indisputable that any magazine can test and compare the usability, the interface, the update method, the system performance impact, the "user friendliness" and the features of respective products, and, on that basis, many magazines have conducted good and fair reviews of the anti-virus software included.

However, on the basis of their stated methodology for testing the virus detection functionality of the scanners, they often have not. The idea that a magazine will be able to test any virus scanner with their own "quarantined" virus collection is at best foolish and at worst dangerous.

Let me put it simply. When it comes to Scanner testing such magazines usually do not know what they are doing. This is proved by telling us how their test was conducted. It is simply wrong to assume that they can test a scanner just by seeing if it detects the viruses that they have. If it detects them they have proved nothing, except that there are some files they suspect of being viruses that it detects, you cannot extrapolate any further conclusion. If it does not detect, they have no way of telling why.

This is because they don't know whether their samples are viable* either fully or in part, nor whether the samples they have are mutations or variants (i.e. someone or something has made changes to it). The major criticisms that I have of such methodologies are these:

1. They do not define and publish the sample set used - listing by family, variant and type.
2. [FONT=Arial, Helvetica, sans-serif]They have not tested the ability to replicate, (the definition of a virus), of each member of that sample set.[/FONT]
3. [FONT=Arial, Helvetica, sans-serif]They do not publish the methodology of testing, which must be consistent for each product, i.e. how they set it up, were the files tested against in their natural state (as they would appear in the wild) etc.[/FONT]
4. [FONT=Arial, Helvetica, sans-serif]They do not state whether they have distinguished viruses from Trojans or other non viral malware.[/FONT]
5. [FONT=Arial, Helvetica, sans-serif]They often state disinfection or healing as a benefit, when it is far from agreed that it is of any benefit.[/FONT]
6. [FONT=Arial, Helvetica, sans-serif]They often do not state the update or engine level of each product, nor the platforms on which they tested.[/FONT]

[FONT=Arial,Helvetica, sans-serif]Therefore such tests have proved nothing, and are of little value in making a purchasing judgement.[/FONT]


[FONT=Arial,Helvetica, sans-serif]For reliable results check the tests done by respected independent bodies in the field, you will often see that their testing contradicts such arbitrary magazine test results. See these links for some real tests :[/FONT]

[FONT=Arial,Helvetica, sans-serif]http://www.av-test.org/index.php3?lang=en [/FONT]
[FONT=Arial,Helvetica, sans-serif]http://www.virusbtn.com/100[/FONT]
[FONT=Arial,Helvetica, sans-serif]http://agn-www.informatik.uni-hamburg.de/vtc/[/FONT]
[FONT=Arial,Helvetica, sans-serif]ftp://agn-www.informatik.uni-hamburg.de/pub/texts/tests/pc-av/2001-07/0xecsum.txt[/FONT]
[FONT=Arial,Helvetica, sans-serif]http://www.uta.fi/laitokset/virus/[/FONT]
[FONT=Arial,Helvetica, sans-serif]http://www.check-mark.com/cgi-bin/redirect.pl[/FONT]
[FONT=Arial,Helvetica, sans-serif]http://www.icsalabs.com/html/communities/antivirus/certifiedproducts.shtml[/FONT]

[FONT=Arial,Helvetica, sans-serif]Real world anti-virus scanner testing is carried out using thousands of verified viruses under strictly controlled conditions. They are also carried out, at least the recognized tests, by experts in the field, who understand not only the implications of the results, but who are able to correctly interpret the results. Any tests a computer magazine have conducted in the manner described earlier are immediately invalidated by the non scientific method. [/FONT]

[FONT=Arial,Helvetica, sans-serif]*Viable here means able to replicate and infect other files. [/FONT]


[FONT=Arial,Helvetica, sans-serif]Read more...[/FONT]
Source: http://www.claymania.com/scannertest.html

Certified Lab testing of Antivirus

There has been much debate about what is the best product available.
There are three main categories to consider when deciding:

Hueristic detection
On Demand Detection
Ease of use/Performance

Vendors submit their products to certified Labs for testing against a full battery of Viruses and Malware that are currently "In the Wild", or circulating on the net and infecting Machines.

The best of these "Labs" are AV-Comparatives, and Virus Bulletin. Of these AV-Comparatives is the most demanding, and takes multiple factors into account which include scanning Performance and speed, the ability to detect new and known Malware threats (some which have no known definitions available- forcing the program to use advanced hueristic scanning to protect the system, and do so without falsely blacklisting legitimate programs/Apps as "malware" aka false positives/false detections)

Here are the results (as of Feb, 2009):

Summary: the best is Eset NOD32, which is the only product to recieve 3 star certification in both Proactive (Hueristic) detection [Nov 2008], and On Demand scanning of known Viruses/Malware [Feb 2009].

The Overall Winners of the AV-Comparatives testing:

2006: NOD32
2007: NOD32
2008: Avira (NOD32 took close second)

note- Avira (apparently overconfident), has declined in the most recent On Demand testing from 3 star certification [Aug 2008], to 2 star Certification [Feb 2009], and thus is not part of the ranking below which is determined by the most recent Proactive/On Demand testing results where product was Awarded Advanced+ certification in at least one of the categories.

The Best in 2008-2009 (3 star certification- Advanced+)
*Eset NOD32
Symantec Norton
Kaspersky
Mcafee (with Artemis)

* Awarded Advanced+ Certification In Both categories

For futher info regarding Certification and Vendor test results see:
http://www.vistax64.com/system-security/172321-vista-sp1-antivirus-performance.html
http://www.virusbtn.com/news/2009/03_23.xml?rss
http://www.av-comparatives.org/
http://www.av-comparatives.org/images/stories/test/ondret/avc_report21.pdf
http://www.av-comparatives.org/seiten/ergebnisse/report20.pdf
http://www.av-comparatives.org/seiten/ergebnisse/report19.pdf