Vista SP1 Antivirus Performance

[rive0108]

The following Vendor viral lab testing performance information is to provide assistance in choosing an antivirus/antimalware program. A single test failure does not mean the product will not provide adequate protection. Ideally those that have consistently passed testing are more reliable and will provide the utmost protection, but a failure could be the result of many different reasons.
note-registration(free) may be required to view detailed Vendor test results.

"In the wild" or "Wildlist" means Viruses and/or malware that are currently circulating on the Net, and infecting systems (i.e., 5 Wildlist misses means 5 individual viruses/malware infections). "false Positives" is the detecting of a Virus/malware, that is in effect not a Virus or malware.



AV-Comparatives February 2009 test results
On Demand Detection test

For AV-Comparatives November 2008 Test results
Proactive/Retroactive test

For AV-Comparatives August 2008 Test results
On Demand Detection Test

For current Vista x64 results December 2008 (virus Bulletin- VB100)
Agnitum

Status: PASS
Result history: Agnitum
Product name: Agnitum Outpost
Details: Only available to subscribers.

AhnLab

Status: PASS
Result history: AhnLab
Product name: AhnLab V3 Internet Security
Details: Only available to subscribers.

Alwil

Status: FAIL
Failure reason: 1 false positive
Result history: Alwil
Product name: Alwil avast!
Details: Only available to subscribers.

AVG (Grisoft)

Status: PASS
Result history: AVG (Grisoft)
Product name: AVG Internet Security
Details: Only available to subscribers.

Avira

Status: PASS
Result history: Avira
Product name: Avira AntiVir
Details: Only available to subscribers.

CA eTrust

Status: PASS
Result history: CA eTrust
Product name: CA eTrust
Details: Only available to subscribers.

Eset

Status: PASS
Result history: Eset
Product name: ESET NOD32
Details: Only available to subscribers.

Fortinet

Status: PASS
Result history: Fortinet
Product name: Fortinet FortiClient
Details: Only available to subscribers.

FRISK

Status: PASS
Result history: FRISK
Product name: FRISK F-Prot
Details: Only available to subscribers.

F-Secure

Status: PASS
Result history: F-Secure
Product name: F-Secure Client Security
Details: Only available to subscribers.

Kaspersky

Status: PASS
Result history: Kaspersky
Product name: Kaspersky Anti-Virus
Details: Only available to subscribers.

Kingsoft

Status: PASS
Result history: Kingsoft
Product name: Kingsoft Internet Security
Details: Only available to subscribers.

McAfee

Status: PASS
Result history: McAfee
Product name: McAfee VirusScan
Details: Only available to subscribers.

Microsoft Forefront

Status: PASS
Result history: Microsoft Forefront
Product name: Microsoft Forefront
Details: Only available to subscribers.

Microsoft OneCare

Status: PASS
Result history: Microsoft OneCare
Product name: Microsoft OneCare
Details: Only available to subscribers.

MicroWorld

Status: PASS
Result history: MicroWorld
Product name: MWTI eScan
Details: Only available to subscribers.

Norman

Status: FAIL
Failure reason: 1 false positive
Result history: Norman
Product name: Norman Virus Control
Details: Only available to subscribers.

CAT QuickHeal

Status: PASS
Result history: CAT QuickHeal
Product name: Quick Heal AntiVirus
Details: Only available to subscribers.

Rising

Status: PASS
Result history: Rising
Product name: Rising Antivirus
Details: Only available to subscribers.

Sophos

Status: PASS
Result history: Sophos
Product name: Sophos Anti-Virus
Details: Only available to subscribers.

Symantec

Status: PASS
Result history: Symantec
Product name: Symantec Endpoint Protection
Details: Only available to subscribers.

VirusBuster

Status: PASS
Result history: VirusBuster
Product name: VirusBuster Professional
Details: Only available to subscribers.

Webroot

Status: PASS
Result history: Webroot
Product name: Webroot I.S. Essentials
Details: Only available to subscribers.

Updated:
Virus Bulletin October 2008 Windows Server 2008 Vendor Results
Windows Server 2008 is built from the same code base as Windows Vista; therefore, it shares much of the same architecture and functionality.
https://www.virusbtn.com/Session-b1e19e78fb19c1f4d52c93ecf25eaaec/vb100/archive/2008/10

Agnitum-Passed
AhnLab-Passed
Avast! (Alwil)-Passed
AVG (Grisoft)-Passed
NOD32 (Eset)-Passed
Fortinet-Passed
FRISK-Passed
Kingsoft-Passed
McAfee-Passed
Microsoft Forefront-Passed
Norman-Passed
Rising-Passed
VirusBuster-Passed
Sophos-Passed
Norton (Symantec)-Passed
AEC (Trustport)-Passed

ArcaBit
Status: FAIL
Failure reason: 93 wildlist misses, 3 false positives

Avira
Status: FAIL
Failure reason: 1 false positive

CA eTrust
Status: FAIL
Failure reason: 1 wildlist miss

F-Secure
Status: FAIL
Failure reason: 1 false positive

Kaspersky
Status: FAIL
Failure reason: 1 false positive

MicroWorld
Status: FAIL
Failure reason: 1 false positive

Quick Heal
Status: FAIL
Failure reason: 1 false positive

RedStone
Status: FAIL
Failure reason: 1 wildlist miss, 1 false positive



Virus Bulletin April 2008 Vista SP1 Vendor Results
https://www.virusbtn.com/Session-be9a3da9e372acb7194b9a2549bd541a/vb100/archive/2008/04

AEC (Trustport)-Passed
AVG (Grisoft)-Passed
Avira-Passed
CA eTrust-Passed
CA Home-Passed
Check Point-Passed
NOD32 (Eset)-Passed
Fortinet-Passed
FRISK-Passed
F-Secure-Passed
GDATA-Passed
Kaspersky-Passed
Kingsoft-Passed
Microsoft Forefront-Passed
Microsoft OneCare-Passed
MicroWorld-Passed
Redstone-Passed
Norton (Symantec)-Passed


Avast! (Alwil)
Status: FAIL
Failure reason: 19 wildlist misses, 1 false positive


Agnitum
Status: FAIL
Failure reason: 4 wildlist misses

AhnLab
Status: FAIL
Failure reason: 2 wildlist misses

BitDefender (SOFTWIN)
(Status: FAIL
Failure reason: 2 wildlist misses

Bullguard
Status: FAIL
Failure reason: 2 wildlist misses

Doctor Web
Status: FAIL
Failure reason: 47 wildlist misses

Hauri
Status: FAIL
Failure reason: 3 wildlist misses

Ikarus
Status: FAIL
Failure reason: 24 wildlist misses, 6 false positives

K7 Computing
Status: FAIL
Failure reason: 19 wildlist misses, 2 false positives

McAfee
Status: FAIL
Failure reason: 1 wildlist miss

Norman
Status: FAIL
Failure reason: 1 false positive

PC Tools AntiVirus
Status: FAIL
Failure reason: 4 wildlist misses

Quick Heal
Status: FAIL
Failure reason: 2 false positives

Rising
Status: FAIL
Failure reason: 3 wildlist misses, 1 false

Security Coverage
Status: FAIL
Failure reason: 859 wildlist misses, 1 false

Sophos
Status: FAIL
Failure reason: 2 wildlist misses

Trend Micro
Status: FAIL
Failure reason: 3 wildlist misses, 2 false positives

VirusBuster
Status: FAIL
Failure reason: 4 wildlist misses

Spysweeper (Webroot)
Status: FAIL
Failure reason: 2 wildlist misses

 

[Chappy]

Hi rive0108

Nice post, good and very Important info.
I'm a Lifetime member at VB, I was awarded a Lifetime membership for the years I worked as an Independent Unknown Variant tester (in my spare time) for the major companies a few years back.
VB100% is the AV Bible AFAIC, and any product that can't attain a VB100% is not worth a cent IMHO.

There's a few surprises in this most recent round of testing I must say...don't you think? A couple that I really didn't expect to see fail in there, and a bunch of the regulars to the Failure list as well.

Anyway, I hope some of the less security savvy members can find some use for this info and possibly drop their garbage AV if they have one, and get something worth it's weight in Gold...(like Nod32...not like I'm endorsing or anything...but NOD32 - by Eset...thats N-O-D-32...ok)

 

[johngalt]

ESET still passes on all Vista tests, as does Symantec.....in fact, both companies have passes across all platforms tested in the last year.

 

[WildEagle]

I'm not surprised with a huge portion of the programs failing the tests. What surprises me is that Symantec passed these tests. Normally Symantec can't even pass VB100 tests that I know of.

 

[Chappy]

Hiya Guys

John, Eset holds the record for consecutive VB100% awards. I thought it was 43 but I'm either mistaken or some have gone missing recently. Eset also boasted this on their website but that has also been removed. They do hold the most VB100%'s by any vendor now, at 51, and 0 false positives since VB started testing in 1998.
3 Fails in 54 submissions, 1 for DOS, 1 for early NT, and 1 for Suse Linux, but 100% on all platforms since 2002.
Their heuristics engine is still considered the most advanced in the Biz, Nod32 is my #1 recommendation. Kaspersky was my #2 but they had update issues this year that made the scanner nearly useless for awhile. Plus they had 2 fails last year and 1 already this year...not so good so I've stopped recommending them until they pick it up. They fixed those update issues fairly quickly once found but I think that just shows a lack of competence in their engineers right now.
I haven't had the time to research a new #2 recommendation yet but I will soon.

WildEagle - Actually my friend, Symantec has 39 consecutive VB100% awards. They usually do very well in "In the Wild" and 0 false positives, it's their bloat and resource usage that irks everyone...that and the fact that their uninstall routines are notoriously horrible for removing Symantec and Norton items...and that's not by accident either. I have found over 85 Symantec objects left on a machine (XP Pro SP2) after the uninstaller has run. You have to use a secondary tool to remove any of those others, it's not readily available to regular users, and that's just unacceptable IMO. And it STILL doesn't remove everything...

 

[locoeng]

it's their bloat and resource usage that irks everyone...that and the fact that their uninstall routines are notoriously horrible for removing Symantec and Norton items...and that's not by accident either. I have found over 85 Symantec objects left on a machine (XP Pro SP2) after the uninstaller has run. You have to use a secondary tool to remove any of those others, it's not readily available to regular users, and that's just unacceptable IMO. And it STILL doesn't remove everything...

The exact reason I quit using them years ago...I find a lot of comfort in the free guys without the accompanying BS.

 

[Chappy]

it's their bloat and resource usage that irks everyone...that and the fact that their uninstall routines are notoriously horrible for removing Symantec and Norton items...and that's not by accident either. I have found over 85 Symantec objects left on a machine (XP Pro SP2) after the uninstaller has run. You have to use a secondary tool to remove any of those others, it's not readily available to regular users, and that's just unacceptable IMO. And it STILL doesn't remove everything...

The exact reason I quit using them years ago...I find a lot of comfort in the free guys without the accompanying BS.

See...
(LOL)

Hi loceng

You're in a very large and rather unruly group there my friend! I do have to say that Symantec is actually a very good scanner and decent heuristics engine, but their recent reputaion (deservedly so too) for bloat, resource usage, and leftovers after uninstalling are just completely unnecessary and unwanted. Most other good scanners have small footprints and lower resource usage, Symantec needs to learn from this but they have such a large OEM base still, I think they just don't care.

 

[locoeng]

I can't knock Symantec/Norton for effectivness...they always kept my machine clean, but at what cost? Others have proven that the same thing can be accomplished with a smaller footprint while drawing from less resources and digging their tentacles in not so deeply. I'm with you, they have got their foot in the door with OEM's and really don't care about making their product better. Actually "better" would be in the eye of the beholder.

 

[WildEagle]

Hiya Guys

John, Eset holds the record for consecutive VB100% awards. I thought it was 43 but I'm either mistaken or some have gone missing recently. Eset also boasted this on their website but that has also been removed. They do hold the most VB100%'s by any vendor now, at 51, and 0 false positives since VB started testing in 1998.
3 Fails in 54 submissions, 1 for DOS, 1 for early NT, and 1 for Suse Linux, but 100% on all platforms since 2002.
Their heuristics engine is still considered the most advanced in the Biz, Nod32 is my #1 recommendation. Kaspersky was my #2 but they had update issues this year that made the scanner nearly useless for awhile. Plus they had 2 fails last year and 1 already this year...not so good so I've stopped recommending them until they pick it up. They fixed those update issues fairly quickly once found but I think that just shows a lack of competence in their engineers right now.
I haven't had the time to research a new #2 recommendation yet but I will soon.

WildEagle - Actually my friend, Symantec has 39 consecutive VB100% awards. They usually do very well in "In the Wild" and 0 false positives, it's their bloat and resource usage that irks everyone...that and the fact that their uninstall routines are notoriously horrible for removing Symantec and Norton items...and that's not by accident either. I have found over 85 Symantec objects left on a machine (XP Pro SP2) after the uninstaller has run. You have to use a secondary tool to remove any of those others, it's not readily available to regular users, and that's just unacceptable IMO. And it STILL doesn't remove everything...

That I did not know. It's because of the bloat and other garbage that I quit using Norton years ago.

 

[rive0108]

Hi rive0108

Nice post, good and very Important info.
I'm a Lifetime member at VB, I was awarded a Lifetime membership for the years I worked as an Independent Unknown Variant tester (in my spare time) for the major companies a few years back.
VB100% is the AV Bible AFAIC, and any product that can't attain a VB100% is not worth a cent IMHO.

There's a few surprises in this most recent round of testing I must say...don't you think? A couple that I really didn't expect to see fail in there, and a bunch of the regulars to the Failure list as well.

Anyway, I hope some of the less security savvy members can find some use for this info and possibly drop their garbage AV if they have one, and get something worth it's weight in Gold...(like Nod32...not like I'm endorsing or anything...but NOD32 - by Eset...thats N-O-D-32...ok)

I myself use NOD32 3.0 x64 antivirus. I would recommend it to anyone. It's also rather inexpensive for annual renewal ($27.99), and unlike Norton automatically updates the program to the newest release for free.

 

[rive0108]

list Updated:
Virus Bulletin October 2008 Windows Server 2008 Vendor Results

 

[caretaker]

Excellent find.
which my viper antivirus was in the test, but then maybe they are not game to test it as it would but all the rest to shame LOL

 

[rive0108]

Excellent find.
which my viper antivirus was in the test, but then maybe they are not game to test it as it would but all the rest to shame LOL

Sunbelt's VIPRE.
Vendors themselves submit their products for lab testing. Sunbelt has not submitted Vipre.

There was a review done on VIPRE through Wilders Security Forums September 2008. Apparently The software failed to detect/clean malware thrown at it by remove-malware.com. Sunbelt is trying to correct the problems.
Vipre Anti-Virus : Reviewed by remove-malware.com - Wilders Security Forums

 

[caretaker]

Wow a million thanks for that. I always thought that it was excellent and recommended it to people. now I know better. Thanks again.

 

[farout]

how do ni get windows defender to stay on under malware protection on vista 32bit premium edition. windows is updating it all the time. i turn it on and it goes off in 20 minutes.hackers come in and steal my bandwith. i have proved this as i have so much video stored.

 

[rive0108]

how do ni get windows defender to stay on under malware protection on vista 32bit premium edition. windows is updating it all the time. i turn it on and it goes off in 20 minutes.hackers come in and steal my bandwith. i have proved this as i have so much video stored.

Under TOOLS>OPTIONS check all the boxes.
Also,if you use a router set it to ignore unsolicited requests, use random alpha/numeric passwords/keys, use at a minimum WPA TKP encryption, disable remote admin, and use MAC filtering.

 

[rive0108]

Vista x64 and Server 2008 test results data added to performance list.

 

[nsbjsn]

Ok, Ive read all the above posts and still need some advice please. Im new to computers in general, this is my first in 10 yrs. Ive been using Norton 360 for the last year with no problems. However, I was unaware of its large "footprint". Would getting rid of it make everything else faster? and or free up enough space that its beneficial? Also the $65 a year kind of sucks? Ive heard on this forum that there are free antiviruses that work as well or better? Can I get a few more recomendations please?

Thanks

 

[rive0108]

Ok, Ive read all the above posts and still need some advice please. Im new to computers in general, this is my first in 10 yrs. Ive been using Norton 360 for the last year with no problems. However, I was unaware of its large "footprint". Would getting rid of it make everything else faster? and or free up enough space that its beneficial? Also the $65 a year kind of sucks? Ive heard on this forum that there are free antiviruses that work as well or better? Can I get a few more recomendations please?

Thanks

ok.
1. The newest version (Norton 2009) has a small footprint on par with Avira and NOD32
2.The issue with Norton is its high detection of false positives and its low detection of new and emerging threats (heuristic detection, i.e., the ability to detect malware without existing virus definitions).

Avira is a free program that I would recommend, and I use and also recommend NOD32 4. Purchase is $39, and then $27 annually for renewal. You can try it for 30 days
http://www.eset.com/download/free_trial_download.php

Both of these programs are the best on the market
Avira:Free antivirus - Avira AntiVir
Nod32 4:Purchase Antivirus and Security Software at ESET. Buy Antivirus Programs and More.

Other free antivirus
Avast!: http://www.avast.com/eng/download-avast-home.html
AVG: http://free.avg.com/download-avg-anti-virus-free-edition

for futher info on NOD32:http://www.vistax64.com/system-security/214724-new-nod32-4-smart-security-4-released.html

 

[nsbjsn]

Thanks Rive, Good explenation, Ill give the trials a shot before i get rid of Norton.