Good antivirus

[poopypoo]

...apparently, all these companies go through high and low points. I switched to Kaspersky when NAV was working like a total turd in 2004. then i switched to NOD when the following year's Kapsersky octupled its memory footprint and refused to finish scanning 500 GB of data, the same year it (KAV) removed a bunch of features from the configuration screens, called it "Personal" edition, and became teh suck for me. NOD's lightweight and effective so far -- I'm not a virus guru but it catches stuff and I haven't gotten infected yet! What else can you judge by? Also, NOD is very reasonable -- here in HK at least you can buy a 5-seat license for ~$125 US. For the first time, ever, an AV is affordable enough for me to protect all of our machines with legal licenses on commercial AV software. They also have a free 30-day trial... I imagine that, in a few years, NOD will be famous enough to be bought out by McAfee or Norton or some new giant looking to make a name for themseves in AV, and become teh suck, too...

 

[Mize]

Nothing. Or at least that's how I've been running my Windows rig for several months now, in both XP and now Vista. I've actually never had a virus on any of my personal rigs. Risky business? Maybe, but I do not have any media on the computers that is must have or that I want for permanent storage, that is backed up on my server.

It's good of you to backup your virii - OH! I MEAN VIRUSES!!!

 

[Skrying]

It's good of you to backup your virii - OH! I MEAN VIRUSES!!!

I have my doubts considering the operating system. Sure, they might be there but they're not going to do anything. Then again I would think my computers would have problems if they ever had viruses, yet I seem to have tremendous luck with basically never having issues with software, nothing major. I don't actually keep anything I really care about on my windows machines.

 

[Saem]

I"ve used or had inflicted upon my machines, depending on how you see it:

AVG
Avast
Norton
Sophos

AVG is the fastest by far, it also has the most craptastic detection -- I've had about three unique instances where it's missed things.

Avast will noticeably slow down your machine, it's detection has yet to let me or anyone I know down.

Norton, is pure evil -- it's so slow, creeps in everywhere, it gets to the point where one wonders if the only reason to have a machine is to keep it free from viruses.

Sophos is good detection wise, and it might be a tad slower than Avast.

 

[thehulk]

There's no such thing as a 100% perfect AV.
That being said IMO the two overall best AV would be Kaspersky and NOD32.
Honourable mention for Symantec AV Corporate (not to be confused with the Norton crap).

 

[N00b]

Avira

Free for personal use and one of the best when it comes to detection rates. The background scanner is fast, a bit slower than AVG.

 

[Blazkowicz]

AVG is the fastest by far, it also has the most craptastic detection -- I've had about three unique instances where it's missed things.

I use AVG for that reason. light on resources, doesn't use custom windows border, splash screens etc. yeah, a bit crappy perhaps but I don't care, to me an antivirus is to feel good. AVG did clean once something kapersky couldn't.

there's no absloute security anyway, security is relative. I'm thus perfectly okay with being a AVG + firefox + NAT/proxy + disabled windows updates guy. (my windows install is recent with an integrated SP2 + "pre-SP3" pack, and before that I did install manually the WMF fix)

 

[MulciberXP]

Yea, same here. Whenever I install Windows XP SP2 I usually turn off about a dozen security holes *cough* oops I mean services like Telnet, Remote Regestry, Netbios Helper and all that crap, but most importantly I turn off DCOM and finally run all the security updates just before disabling automatic updates. NATing is also a good idea. Once you disabled the vast number of unused ports, there's not much to worry about after that, providing you're not an idiot who opens email attachments about horny goat weed and viagra.

 

[AcceleratorX]

I was wondering when such a thread would come up....

No AV/AS will protect you 100% from all threats out there. But you can secure yourself by using a good AV. Usually, you can be more safe if you use a dedicated Anti-Spyware application along with your AV, because though AVs are good at detecting all kinds of malware, removal is another thing altogether.

At http://www.av-comparatives.org you can see the results. The Proactive/Retrospective test measures the heuristic detection of various AV products while the On-demand test is the signature+heuristic detection.

NOD32 is pretty good, but watch out if something does get by NOD32 and infects your PC, because Eset's support on such matters is next to zero.

Kaspersky has a very good signature engine and detects a lot of malware, but its heuristic engine is currently not so good.

BitDefender is an AV I like. It has very good signature detection, and a heuristics engine that is second only to NOD32. Its GUI is OK as well, and the only real problem with it is that it has a somewhat high resource usage.

You can try F-Secure and Panda as well, and even Norton's 2007 products are quite good.

I personally have a license for many products, but like I said earlier, getting an AS with an AV is probably the better defense. For this purpose I use AVG Internet Security (Ewido Anti-Spyware + AVG Anti-Virus Pro editon), which has a WAY better protection efficiency than the free or pro version will ever have.

Personally, I would recommend BitDefender, AVG Anti-Malware/Internet Security,
Dr.Web, Panda or AVIRA AntiVir Premium edition for good protection. In my opinion these are the best in the industry.

Ashampoo also offers a Security Suite based on an AntiVirus from Avira and an AntiSpyware based on A-Squared. The combination of the two will be very effective, but I would not recommend it just yet because of various ongoing bugs and product immaturity at the moment.

You can also see a PC World article review below:

http://www.pcworld.com/article/id,130869/article.html

And a comparison chart from the same article containing detection rate graphs as well:

http://www.pcworld.com/product/test...=29899&prodid=29900&prodid=29901&prodid=29902

If you don't want to pay, there's a good security suite out there being offered for FREE for 1 year for residents of the USA and Canada called eEye Blink Personal Edition. See the link below:

http://www.eeye.com/html/products/blink/personal/index.html

 

[mito]

Thx Xcel8r

 

[DeadlyNinja]

I myself have been quite happy with Avast. I've tested it against AVG and Avast was able to pick viruses AVG couldn't. I haven't noticed any speed issues with Avast or AVG, but the fact that Avast was able to pick up stuff AVG missed makes all the difference to me.

 

[AcceleratorX]

I myself have been quite happy with Avast. I've tested it against AVG and Avast was able to pick viruses AVG couldn't. I haven't noticed any speed issues with Avast or AVG, but the fact that Avast was able to pick up stuff AVG missed makes all the difference to me.

I guess it makes some difference to you. Handling samples frequently every week, I come across several malware samples which are not detected by anything except AntiVir and Kaspersky. In my opinion response time matters 100% more than pure detection rates. In my samples what I observed was that generally the following AVs perform well:

AntiVir
Kaspersky
BitDefender
F-Secure
Norman
F-Prot/Authentium Command AntiVirus

Though AVG is as good as the above products, I didn't list it because of two reasons:

1) AVG's free edition is not so good (You need to use the paid Anti-Malware edition if you want good protection)
2) AVG usually detects a lot of stuff, and has generally good protection, but due to its update policy (one update a day), it is often too late in detecting the latest malware. The AVs listed above all have more than one update a day in cases of emergency.

Another AV I would recommend is Dr.Web. It used to be among the top a few years ago, but in recent days it is not as good as it used to be, because Dr.Web is a small company and possibly lacking enough staff. But they are improving again now, and they still have a very strong heuristic engine.

Avast! is only "average" detection wise at least to me (but even that is good enough!). And Microsoft's OneCare is a waste. It lacks horribly in detection rates, just in case anyone wanted to know. I wouldn't recommend OneCare to anyone at all right now.

Some good Anti-Spyware applications are:

1) A-Squared (http://www.emsisoft.com)
2) AVG AntiSpyware (http://www.ewido.net)
3) Webroot Spy Sweeper (http://www.webroot.com)

Avoid Webroot's Spy Sweeper + Antivirus product, because their AV is crap.

If you are looking for Internet Security Suites, I will recommend:

1) Kaspersky Internet Security (http://www.kaspersky.com)
2) Steganos Internet Security (http://www.steganos.com, basically the same as Kaspersky but with cheaper price)
3) ZoneAlarm Security Suite (again, uses Kaspersky technology but has separetely developed ZoneAlarm technology as well)
4) AVG Internet Security (Most cost effective internet security suite I have ever seen, and has good detection rate as well)
5) eEye Blink Personal Edition (see link in my previous post, uses a very good Norman AV engine, free for users from USA and Canada, or $24.95 for 1 computer/$29.95 for 3 computers if you are not from North America, which is also VERY cheap compared to others)
6) F-Secure Internet Security (http://www.f-secure.com, uses Kaspersky, Norman and two in-house developed engines)

Sometimes, if you wish maximum protection, then a dual engine AV is the best way to go. F-Secure (http://www.f-secure.com) and GDATA (http://www.gdata.de) are two companies selling double engine Antivirus. F-Secure uses Norman and Kaspersky with two in-house engines while GDATA uses Kaspersky and Avast! engines. The combination of multiple engines usually provides a VERY HIGH protection against malware, but the downside of such a product is that resource usage can be high, scanning speed may be slow and the product may be very heavy. Also, such products are also somewhat higher priced than the normal single engine AVs.

 

[Frank]

Though AVG is as good as the above products, I didn't list it because of two reasons:

1) AVG's free edition is not so good (You need to use the paid Anti-Malware edition if you want good protection)
2) AVG usually detects a lot of stuff, and has generally good protection, but due to its update policy (one update a day), it is often too late in detecting the latest malware. The AVs listed above all have more than one update a day in cases of emergency.

Then again, the chance of you getting infected with the newest virus as one of the first victims (before the update) are very slim to nonexistant. Only worms can do that, but that's why you want a router. And I think using a good browser beats any anti-malware scanner hands down.

And if you don't get infected in the first place, a software firewall that monitors outgoing packets as well is useless.

AVG free + Firefox/Opera + a hardware router (or a Linux server that doubles as router) are very good protection for just about anyone.

 

[AcceleratorX]

Then again, the chance of you getting infected with the newest virus as one of the first victims (before the update) are very slim to nonexistant. Only worms can do that, but that's why you want a router. And I think using a good browser beats any anti-malware scanner hands down.

And if you don't get infected in the first place, a software firewall that monitors outgoing packets as well is useless.

AVG free + Firefox/Opera + a hardware router (or a Linux server that doubles as router) are very good protection for just about anyone.

That will work most of the time, and I myself use AVG Internet Security, because I'm not particularly concerned about the updating. A bit of a problem about AVG free is that it doesn't detect spyware (Avast does, AOL ActiveVirusShield based on Kaspersky does, AntiVir free does NOT). So, it is possible some user may install some adware program and AVG may not inform him or her about it...

 

[Frank]

Something worth noticing: many people have said in the past (and still do), that Linux and Firefox are only as secure as they are, because they aren't targeted by malware/virus writers, because they only have a tiny market share.

Well, by now, just about all routers and servers you encounter across the internet by far run a Linux variant. And they do very well. They're not corrupted. And while Firefox still isn't the most widely used browser, it does have a market share of close to 30% by now. And if you look at the volume of pages requested by browser, it's even close to half.

So, the people who surf the internet most (and visit the most shady sites) use Firefox (or Opera), and it's still as safe as a bunker, compared to even IE7 with all daily patches applied.

And *nix has historically been the playground you need to master to become a good hacker in the first place. Not that hackers harm others, but that's another discussion.

Those hackers are also the people who collectively wrote Linux and Firefox.

 

[Mize]

Avoid Webroot's Spy Sweeper + Antivirus product, because their AV is crap.

Their AV is Sophos which is considered amongst the best in the corporate world and Webroot has the only consumer edition of it. Please explain how you determined that their AV is crap.

 

[AcceleratorX]

Their AV is Sophos which is considered amongst the best in the corporate world and Webroot has the only consumer edition of it. Please explain how you determined that their AV is crap.

There are many reasons which contributed to my determination that Webroot AV based on Sophos is crap:

1) It *seems* to not use the Sophos heuristic engine because Sophos does some runtime compressor detections as "Mal/Packer" which is not there in Webroot Spy Sweeper + AV.

2) AV-comparatives tested this product and it achieved a very nice 77% detection rate. In AV-comparatives, it is generally accepted that even a moderately good AV product will score at least 85% in detection rates. Thus, according to AV-comparatives, Sophos was behind all of the following vendors:

AVIRA (AntiVir)
GDATA
Avast!
AVG
BitDefender
Dr.Web
Fortinet
F-Prot/Authentium Command AV
F-Secure
Kaspersky
McAfee
Microsoft OneCare (even this one didn't reach the minimum certification of 85% detection, but it was still better than Sophos)
NOD32
Norman
Norton
TrustPort (uses Norman+BitDefender+AVG+Ewido, not available for purchase globally)
Trend Micro
ArcaVir

You can see the thread discussing Sophos' poor result here:

http://www.wilderssecurity.com/showthread.php?t=170097

However, you can no longer see the results because Sophos made a hue and cry and demanded that the results be removed as it was degrading to their reputation. However, the tester himself has made a post highlighting Sophos' detection rates since 2004 in the same above thread. See below for post number 53 of that thread

http://www.wilderssecurity.com/showpost.php?p=980923&postcount=53

I will quote him here:

feb04 86%
aug04 82%
feb05 79%
aug05 78%
feb06 ??
aug06 ??
feb07 under 77%

AV-comparatives' testing practices are reliable and are widely well-regarded in the industry as being one of the most comprehensive testing authorities. Companies like Eset, AVIRA and Kaspersky have frequently made articles on AV-comparatives, which means they have accepted the correctness of the results. Obviously, Sophos does not want any of it...do I smell a chicken?


2) AV-test.org, which is another industry-recognized and highly reliable testing authority has also tested Sophos in the past. See two threads of this discussion:

- AV-test.org test published in German PC Welt magazine, October 2006:

http://www.wilderssecurity.com/showthread.php?t=148622

Sophos scores a mediocre 65.55% as you can see in the thread. I'll reproduce the entire test results here for your convenience (300, 000 trojans were used as the sample set):

1 WebWasher 99,97%
2 Antivir 99,952%
3 AVK 2007* 99,951%
4 AVK 2006* 99,89%
5 Symantec 99,04%
6 Kaspersky 98,86%
7 F-Secure 98,24%
8 Bitdefender 96,51%
9 Norman 96,34%
10 Nod32**** 95,80%
11 Avast!**** 95,17%
12 AVG**** 94,78%
13 Fortinet 94,65%
14 McAfee 93,99%
15 Rising 91,18%
16 Panda 90,45%
17 Dr Web 90,38%
18 Trend Micro 90,03%
19 Ikarus 84,77%
20 VBA32 81,28%
21 F-Prot** 77,88%
22 Command** 77,11%
23 Microsoft 76,18%
24 Ewido 74,67%
25 Sophos 65,55%
26 eSafe 59,34%
27 UNA 58,76%
28 QuickHeal 55,72%
29 Proventia-VPS 51,76%
30 ClamAV 48,71%
31 eTrust-VET*** 48,37%
32 eTrust-INO*** 41,92%
33 VirusBuster 40,94%

A second test published again in November on the same magazine and again performed by AV-test was not so favourable towards Sophos (see thread below):

http://www.wilderssecurity.com/showthread.php?t=155906

1 WebWasher 99.89%
2 AntiVir 99.86%
3 AVK 2007* 99.78%
4 Fortinet 99.75%
5 AVK 2006* 99.63%
6 Symantec 99.08%
7 Kaspersky 98.96%
8 F-Secure 98.27%
9 BitDefender 97.45%
10 Norman 96.01%
11 Avast**** 95.91%
12 NOD32**** 95.65%
13 AVG**** 95.25%
14 McAfee 94.88%
15 Ikarus 93.55%
16 Trend Micro 93.46%
17 Dr.Web 91.11%
18 Panda 90.37%
19 Rising AV 90.11%
20 Ewido 81.71%
21 F-Prot** 81.56%
22 Microsoft 81.22%
23 Command AV** 81.00%
24 VBA32 80.99%
25 Sophos 75.62%
26 eSafe 68.84%
27 UNA 65.54%
28 QuickHeal 57.48%
29 eTrust - INO*** 55.39%
30 Proventia-VPS 53.95%
31 eTrust - VET*** 53.11%
32 VirusBuster 51.08%
33 ClamAV 48.76%

The test set used for this test was:
83.000 Worms
86.000 Bots
218.000 Trojans
79.000 Backdoors

* = GDATA AntiVirusKit (AVK) 2006 used BitDefender+Kaspersky engines, while the 2007 version uses Avast+Kaspersky engines.

** = Due to product immaturity of the latest version F-Prot 6.0 at the time of testing, the older version 3.16f was used for testing. Command AV was also using the F-Prot 3.x technology at that time. Both products have upgraded their engine to version 6.0, and both are MUCH better today in terms of detection rates.

*** = eTrust has two engines, InnoculateIT and VET. Both are usually close to each other in terms of detection rates though.

**** = In the PC World article I linked to in one of my previous posts, it is important to know that AV-test also performed the malware detection tests in the PC world article. The PC World article was published April 23, 2007 and shows that both AVG and Avast have higher malware detection rating than NOD32 (However, this is not the only consideration PC World used to determine overall product rating). Also, it is to be remembered that AVG Professional was used (which detects adware/spyware), not AVG Free edition (which doesn't). AVG also now has a newer product which integrates the Ewido engine alongside with AVG. This product is called AVG Anti-Malware, and tests at AV-comparatives have shown that this product raises AVG's protection level to be on par with BitDefender, while costing only US $5 more than AVG Professional. But spyware detection does not matter in the PC Welt tests, because no spyware samples were used. However, the PC world test does use spyware samples.

So basically, Avast>NOD32>AVG Free, or AVG Pro = Avast>NOD32, or AVG Anti-Malware>Avast>NOD32. But regardless, the protection level offered by all AVs is very good, and one should not change his/her AV for this purpose. Also, NOD32's heuristics is a lot better than both AVG and Avast, which will help protect users from the latest malware.

I hope this was enough proof to show you that Sophos is not up to par. And since Webroot appears to not even have Sophos' heuristics engine, it is even more crippled than Sophos itself. Spy Sweeper's inherently good Anti-Trojan/Spyware capabilities are not enough to offser Sophos' bad detection rates in terms of trojans/worms/bots/dialers/otherOS malware detection. It is best to use Spy Sweeper with some other *good* AV for maximum protection.

 

[pascal]

AVG free started to eat my emails (the content of some of the emails). Changed to Kaspersky and everything is fine. Also kaspersky found two virus in some old files.

 

[Mize]

hadn't been back here in a while...maybe I'm blind to Sophos' issues as I've both gateway and spam firewall virus scanners as well as Sophos on all my desktops (zonelabs on the laptops).

 

[deviantchild]

Never wanted or needed a resident AV: slower than usual computer; mails deleted or interfered with; files with unusual compression methods blocked = not likely, thank you.

My way:-
Lock down Windows, with only a dozen safe/required services still running.
Switch off any sharing/remote type vulnerabilities, plus Guest accounts etc.
Expose all file extensions and system folders etc.
Disable ActiveX and Windows Scripting Host.
Have my firewall prompt me to verify every action or request, until I have set rules for each.
Lock down a couple of additional ports.
Allow filesharing through the firewall, but use PeerGuardian to limit unwittingly obtained crap.
Don't use MSN Messenger - even though I still use the service via Pidgin[GAIM]
Don't use Outlook or Internet Explorer.
Use K-Lite Mega Codec Pack to play everything and avoid crapping up my computer with the likes of junk installing client software such as RealPlayer.
Keep updated/hotfixed via Windiz Update. Although MS has had quite a track record of using these to interfere with (up until then) happily running software; and also switching some of the above listed crap back on upon reboot
Check the integrity of my system by running AutoRuns/Process Explorer occasionally; and also programs like HijackThis.
[probably other bits and bobs I can't recall right now]
And about twice a year...





...run Trend Housecall online... and it finds nothing.