Latest anti-malware tests

[digitalprospector]

Hi everyone,

Just a quick note to throw my two cents into the ring. Effectiveness and performance as pertaining to antivirus software indeed seems to be cyclical. In the past 20 years, our IT Support business has moved to and from Norton products several times due to failure to identify and remove viral infections and/or especially performance issues (early Norton 360 products anyone?). Panda Security has become our 'go to' product for any newer computers. The 2010 version is even proving to be less of a processing hog than older versions. We have a 105 user network, running 3 shifts a day, that are all utilizing Panda as their security package except for a dozen 'older' computers that we are running Symantec Endpoint on (to reduce the performance drain). So in acknowledging that Endpoint utilizies less processing time as compared to the Panda product, we still feel better about the Panda product because in the last two years the only computers that suffered from virus intrusions were the units running the Endpoint protection. Panda's hueristics for day zero infections have proven desirable. A network admin colleague of mine swears by Kaspersky (which he has been utilizing for several years now), but has found with this latest release a real slowdown on network drive access that Kaspersky's support staff have been unable to resolve. He feels he must move away from the product for now. Again, that cyclical nature. Finally, just in case I have sounded like an advert for Panda... I only currently use their product on workstations in unmanged mode, because their server admin/protection software causes incremental loss of performance necessitating a server restart every 2 to 3 days. The lesson of the day seems to be... evaluate each and every product as an individual product and not guilty by association to previous products from the same company.

Cheers!

[SpiritWind]

Hi Rochelle ( and Others ) :

When it comes to "Advanced Heuristics" Detection that Bob Primak
makes reference to, that seems to be in the domain of "HIPS"
( Hosts based Intrusion Prevention System ) and/or "sandbox"
type programs . For the best info on those types of programs, I have
used the Wilders Security Forums, especially the "other anti-malware
software" forum ( www.wilderssecurity.com/forumdisplay.php?f=35 ),
though they also have a "sandboxing & virtualization" forum .
Several months ago when I spent several hours on those forums, I
was impressed with what I read about "Defensewall" available at
www.softsphere.com ; I was equally impressed that its Developer,
Ilya Rabinovich, appears to be a "regular" Poster on those Forums .

[kwe]

I understand the feelings about McAfee & Symantec. I had bad experiences with both at work but that was almost a decade ago. There are members here who have had very good experiences with the more recent versions of McAfee & Symantec products. So, I've had to curb my tongue as I've realized that my experiences then may not have any bearing on the products & companies now.

I think we must all remember that these companies do not stand still. To survive they invest time & money into their products. Effectiveness and efficiency can change dramatically from release to release.

Joe

I'll continue to bash them day and night because they deserve it. I have uninstalled Norton Suite from two systems in the last six months that were unable to accomplish basic web surfing. After removing Norton, the systems were responsive and the users were happy.

I support a school district that uses McAfee Virusscan Enterprise v8 and they call me in when they are unable to remove McAfee and reinstall it successfully. I have spent hours working on scripts to try to rip out all the McAfee junk and do a clean install and I'm just amazed at the poor quality of the software design. And we all learned this week that McAfee has no quality control on their updates. Their DAT update from Wednesday (I believe it was 5958) was not tested on Windows XP SP3. It identified svchost.exe as malware and removed the file, causing tens of thousands of systems to reboot continuously. Techs have to visit each machine in person to restore the svchost.exe file. Stores were closed and companies were rendered helpless as their IT staff ran around to each machine.

I don't need anymore information than I have to know that Norton/Symantec and McAfee/Network Associates are marketing driven companies. The fact that neither company can come up with a single name for themselves shows that they buy technology, they don't develop it and this has been true for decades. End of story. Nothing but woe awaits those who use these products.

[jscher2000]

I don't need anymore information than I have to know that Norton/Symantec and McAfee/Network Associates are marketing driven companies. The fact that neither company can come up with a single name for themselves shows that they buy technology, they don't develop it and this has been true for decades.

Symantec acquired Norton more than 15 years ago, and McAfee merged with Network Associates more than 10 years ago. To assert that the products have stood still since that time because neither Symantec nor McAfee actually does any development is absurd. You certainly can argue that at times each has suffered from misplaced priorities in the features and functionality it brought to market, but neither Symantec nor McAfee is a "marketing" company that simply rebrands third party products. Both of them are "all in" on the security business.

(I don't see any problem with maintaining separate Norton and Symantec brands for the consumer and enterprise markets, respectively, but I agree that the McAfee/Network Associates name changes have been a bit mysterious.)

[bobprimak]

Hi Rochelle ( and Others ) :

When it comes to "Advanced Heuristics" Detection that Bob Primak
makes reference to, that seems to be in the domain of "HIPS"
( Hosts based Intrusion Prevention System ) and/or "sandbox"
type programs . For the best info on those types of programs, I have
used the Wilders Security Forums, especially the "other anti-malware
software" forum ( www.wilderssecurity.com/forumdisplay.php?f=35 ),
though they also have a "sandboxing & virtualization" forum .
Several months ago when I spent several hours on those forums, I
was impressed with what I read about "Defensewall" available at
www.softsphere.com ; I was equally impressed that its Developer,
Ilya Rabinovich, appears to be a "regular" Poster on those Forums .

I don't know which methods are used by Avast in its heuristics, but with Comodo Defense Plus, I agree that they use HIPS primarily. Comodo in its new Version 4 also does a certain amount of sandboxing, but I don't know how effective this sandboxing feature is. When scanning, the term "advanced heuristics scanning" (Malwarebytes) seems to involve something else.

Great reference to Wilders Security! I was not aware that they have a special area for sandboxing and virtualization. Definitely worth a visit whenever I get the time.