Anybody read this review...?

The new issue of ‘Computer Shopper’ (at least I think it’s Computer Shopper and not Computer Buyer - they are very similar) has just group tested leading a/v suites with particular emphasis on detecting Trojans. Avast gets completely hammered and comes out with a one-star rating. I’ve been a satisified Avast (Home) user for years and it’s kept me out of trouble on several occasions. I’ve always been quite happy with it but it is really so much less effective than other a/v programs. I notice Kaspersky comes out particularly well and even AVG gets rated more highly.
Anybody else read the review?

These magazine tests are mostly full of shit (not nice word but thats how it is).
I trust only av-comparatives.org tests.

Why?
Would you care to expand on that?

Computer Shopper is one of the leading computing magazines here in the UK, and, with respect, that sort of dismissal is not going to carry much weight with its readers.

In my opinion, most of tests/reviews from such magazine were not done by real-antivirus experts (real-antivirus experts such as Joe Wells, the founder of the WildList Organization), to make thing short, reviewers/testers from such magazine don’t really know what they say or do, they just use their personal opinions or personal experiences that may based on wrong knowledge.

Do you think who can test/review an antivirus software better than real-antivirus experts who really know how malware and antivirus software work? :slight_smile:

Tap,

Your comments aroused my interest. I went to the WildList Organization website, and couldn’t find any AV program reviews.

Would you be able to point me to a link where Joe Wells comments on avast!?

Thanks.

[Edit: I was actually refering to Tap’s post here: sorry for any confusion!]

I don’t really have much time for that sort of argument, sorry. I doubt if anybody would be claiming that authors from a major magazine “don’t really know what they say or do, they just use their personal opinions or personal experiences that may based on wrong knowledge” if avast! had come out well.

Not so long ago people here were making excuses for avast! not passing the in-the-wild virus test, now people congratulate avast! when it passes.

I haven’t read the review (I’ll have to go out and buy the mag) but I’m certainly not going to dismiss it out of hand. avast! certainly needs to improve its detection rate, and I’m sure the writers at Computer Shopper know what they are doing.

Frank,

I’m confused. If Computer Shopper is one of the leading computing magazines in the UK, why would their readers dismiss an article that trashes avast!?

Edit:

Frank, See post below.

TAP

Hang on a minute…
It may be a simplistic view but surely an objective test - either a trojan is detected or it isn’t.
Are you really telling me that it’s possible to ‘influence’ the results to such an extent by doctoring the tests or manipulating the a/v sensitivity settings or something?
Even if it were, what’s to be gained in a so called ‘independent test’ carried out by a respectable publication.

BTW - I looked at some past results on a-vcomparitives and Avast does indeed seem to score quite low for Trojan detection. I’m sure the Avast developers are aware of this and striving to improve things. I’m not denigrating Avast - i like it - I just want it to be the best!

I picked this up in the News Agents today and leafed through.

I’m normally one for checking out the mags and reviews before going for a product and I’ve been using Avast! for a couple of years without any problems. So based on that I walked away thinking “must download Kaspersky tonight - what’s £18 for a year when the product is streets ahead of Avast!”

But then I got to thinking. The results of that test seem to be at odds with pretty much everything else I’ve read, including other independent comparisons so perhaps I should stick with Avast! after all. I’m not sure what to do. Those mags do wield a lot of power when they publish this stuff and they really should do it responsibly.

???

No, I didn’t mean Joe Wells comments on avast! or something like this or the WildList Organization has any antivirus reviews. I just say I want real-antivirus experts who have more credibility in AV industry such as Joe Wells (and others) to do the most correct tests/reviews.

I don’t applaud people or magazine who say avast! is good and blame others who say avast! is bad, I have to know how their methodologies that make such results. If their methodologies are acceptable and avast! fails, I would blame avast! for its flaws, but if their methodologies are flaw and avast! fails so is it fair for avast!?

And what I said in Reply #4 is just my opinion, anyone can or cannot freely agree.

Frank,

Never mind, I lost continuity between your post and RejZoR’s (?).

Sorry.

Hi jhiker,

I also question the objectivity of such tests. What would you think that you have two of these tests and Bitdefender in the one test is number one, and in the other test is number final. It says something about the credibility. And then it is what you get out of the virus zoo to test the darned scanners with (in the wild). Furthermore you cannot compare apples with pears (heuristic scanners, the amount of packers detected, on the fly scanning, shortly there are so many features a scanner could have, how do you weigh the results?).
Don’t pay too much attention, better put energy into a question how do I achieve the best results on my machine in the way of multilevel-protection.
I think if you have for instance one resident scanner like Avast, together with one non-resident open source solution like ClamWin, some online scanner regularly like BitDefender together with stinger.exe, and the free downloaded DrWebCureIt, together with in-browser script protection and siteadvisor, hyperlink pre-scanning installed, WebShield active, I think in that case we are talking shop, you are well protected, and you need not worry about test results. That is all IMHO.

polonus

Joe Wells isn’t sat at my computer… I am.

It’s me who’s doing the real-world testing on a day-to-day basis and I want to be sure I’m protected as well as I can be whether it’s with Avast or an alternative…

…or Kaspersky…?

I too haven’t read the review and I don’t think I will be buying it just to read it, I’m here sat behind my keyboard, a happy avast user for two years and if avast were really bad, would I not be infected by now.

No I exercise caution and have a multi level approach to protection, I use avast, adaware, spybot S&D, spywareblaster, ewido and hijackthis on occasion as my main security programs; this backed up with exercising common sense should see most people right.

In some of the posts in this thread they are talking about trojans, now a trojan by its nature can be many things, adware, spyware, etc. and since avast is primarily an anti-virus program that happens to detect some other malware, it may well miss a trojan that is picked up by another AV but this is true for many AVs.

Yes avast can definitely improve its detections but does it make it bad, I don’t think so. Some of the recent reviews from the likes of avcomparitives places AVGs detections below that of avast, yet this single review places it higher.

Now neither of this means they are bad AVs, just that in that particular test, not knowing how it was conducted and what samples were used, avast did less well. There is more to an AV than simple detection rate, yes it is an important factor, there are some that may well have great detections, but it doesn’t provide email protection or P2P support, etc.

We all know (I hope), that prevention is better than cure so stopping a virus getting into you system is better than trying to remove it once established, so in this case better detection isn’t necessarily going to protect you better. So all I’m trying to say is that you need to compare more than simply detection rate tests.

Hi,

Is there an excerpt or something like that on the Net. A link?

Difficult to discuss someting you havn’t seen. :wink:

HL

Here’s the review for anybody interested:

http://donaldbroatch.users.btopenworld.com/howwetested.jpg

http://donaldbroatch.users.btopenworld.com/review.jpg

Some info about the source of the malware here:

http://insight.zdnet.co.uk/internet/security/0,39020457,39239134,00.htm

MessageLabs antivirus team deal with a mixture of long and short-term projects running concurrently. Long-term projects include looking at different ways to roll out malware signatures over the company infrastructure and measuring the efficacy of other vendors' antivirus engines used by MessageLabs. Currently, the email monitoring company use antivirus engines from McAfee and F-Secure, having switched last year from Sophos.

Short-term projects arrive as-and-when for ad hoc fire-fighting. Every day MessageLabs stop 12,000 items that are not stopped by the antivirus engines alone. Dedicated mailservers are used to filter emails for malware by analysing how much ‘chaos’ is contained in the code. Good files such as legitimate updates have a different stat distribution within the code. If the code has a number of different values, it is classed as chaotic. “If the code has 64 bytes, and every single byte is different, then the code is likely to be malware,” said Shipp. For example, bad files often have encryption, and look different from good files because they are trying to hide themselves.

MessageLabs also compares new code with its signature file databases, which is between 2GB and 3GB of information. This database is constantly being updated, “so having caught variant A, we’re confident of catching B, C, and D,” says Shipp.

Initially defining viruses is “processor intensive”. MessageLabs take the potentially malicious code and analyse it. Unusual features in email immediately mark code down as being suspicious. “If the code has IRC, FTP and email — not many legitimate programs have all of those capabilities,” says Shipp.

MessageLabs also look for profanity, and virus writer handles. “Virus writers have big egos — they like putting their own names into the code. This never appears in good files,” he adds.

Knowing their code contains indicators has led hackers to attempt more subtle social engineering tactics to propagate malicious code, including sending links in emails. This circumvents this problem as the malicious code is not actually contained in the email. “That’s why the bad guys are sending links,” said Shipp. One example of social engineering tactics is an email pretending the recipient has been sent an e-card. When the person clicks on the link to the card, they are redirected to a site containing malware, and infected.

MessageLabs work around this by detecting if the links have been obfuscated in an email to hide the URL or URI of the site the user would go to. There is also a link-following system which feeds into a discrete network that is dedicated to analysing the links.

Antivirus knowledge is also increased by MessageLabs sharing virus information with other companies, and law enforcement agencies. The company provides virus samples to sharing networks such as AV Gurus. This site maintains and publishes a collection of viruses using PTP encryption, and can only be accessed by legitimate users, according to Shipp.

The threat landscape: A new threat that the antivirus team has seen are data-stealing Trojans sent in spam. The email only has to be opened and the Trojan — hidden in a word document — is activated. These are being repeatedly sent to banks and government agencies in the hope that some information can be stolen.

So the malware used to test was caught by McAfee, F-Secure or MessageLabs themselves.

Why noone ever cares to try to understand the program? They are all talking about skinned inteface but no one cares to tell that there is also normal, non skinned and non “futuristic” interface.
Thats why i call all reviews BS. Testing AVs is not about installing them and quickly judge (and misjudge them), but in actually understanding them, learning what specific features do and so on.