Why popular antivirus apps 'do not work'

[Steve]

Source: http://www.zdnet.com.au/blogs/securi...9264249,00.htm

Antivirus applications from Symantec, McAfee or Trend Micro -- the three leading AV vendors in 2005 -- are far less likely to detect new viruses and Trojans than the least popular brands.

This has nothing to do with the quality of the software or how long it takes the respective firms to update their clients with signatures and other malware countermeasures.

AV companies continue to refine their products and most will tell you they stopped relying on purely signature-based systems many years ago. These days they use all sorts of clever methods to try and detect suspicious behaviour but the problem is that malware authors are also very clever. Very, very clever.

On Wednesday, the general manager of Australia's Computer Emergency Response Team (AusCERT), Graham Ingram, described how the threat landscape has changed -- along with the skill of malware authors.

"We are getting code of a quality that is probably worthy of software engineers. Not application developers but software engineers," said Ingram.

However, the actual reason why the top selling antivirus applications don't work is because malware authors are specifically testing their Trojans and viruses to make sure they can bypass these applications before releasing them in the wild.

"The most popular brands of antivirus on the market… have an 80 percent miss rate… So if you are running these pieces of software, eight out of 10 pieces of malicious code are going to get in," said Ingram.

Although Ingram didn't mention any of the leading losers by name, Gartner's figures for 2005 show that Symantec is the clear leader with 53.6 percent of the market. McAfee and Trend own 18.8 percent and 13.8 percent of the market respectively.

One vendor Ingram did mention was Russian outfit Kaspersky, which in the same tests managed to block around 90 percent of new malware.

According to Gartner, Kaspersky's market share is a lowly 0.7 percent.

Most large firms already use more than one antivirus application but I wonder how many use two of the Symantec, McAfee and Trend trio?

If you do then I suggest investing in yet another -- but whatever you do, stay well away from the bestseller shelf.

[SilentTrigger]

Then theres those "less popular" brands that put viruses on your computer before it searches your computer, they forgot to mention that if im not misstaken.

[Steve]

example?

did you know Symantec had a rootkit in their install! ( http://www.eweek.com/article2/0,1895,1910077,00.asp )

Symantec and McAfee have always been poor products to use.

[SilentTrigger]

Just do a search for free antivirus and you will hit plenty of those virus planting bobos

I've used several, both free and paid and so far the one with least problems is Norton with out a doubt.

[Steve]

daaaaamn what version of nortons?

all ive had with nortons is bloatware, system resource hog and little protection oh and a nice rootkit installed. + the c@rp doesn't even uninstall itself fully without 3rd party removal tools.

even Panda anti virus was more effective than nortons on my system. NOD32 is outstanding above nortons, the only product i find better than NOD is Kaspersky which is the only anti virus software i'll be using ty

i suppose personal experience counts for a lot, but ive spent a lot of time testing / researching and i know what's good for my system. but there is good reasons why symantec get a kicking from lots of proper security sites.

[Chrispy]

I think Norton is alright. It's not really their fault that their program cannot detect a variety of viruses.
It occurs to me, is PC-Cillin Internet Security 2006 any better?

Thanks.

Chris_OJB_DF645 --

[SilentTrigger]

Originally posted by Steve
daaaaamn what version of nortons?

all ive had with nortons is bloatware, system resource hog and little protection oh and a nice rootkit installed. + the c@rp doesn't even uninstall itself fully without 3rd party removal tools.

even Panda anti virus was more effective than nortons on my system. NOD32 is outstanding above nortons, the only product i find better than NOD is Kaspersky which is the only anti virus software i'll be using ty

i suppose personal experience counts for a lot, but ive spent a lot of time testing / researching and i know what's good for my system. but there is good reasons why symantec get a kicking from lots of proper security sites.

Lol its strange, all other has been resource hogs but Norton, I dont get any more resources freed when its truned of, well maybe a really small of course but nothing mayor, other firewall/antivirus programs however make it near impossible to even browse a site. Its weird that there can be such a difference.

I have Internet Security 2005 anti spyware edition. Works great!

My experience of panda is bad, the city use it for their schools and such, was quite a while since i was there though heh but I remember that Panda didnt even take care of the obvious files that everyone knew was a virus (well known). But I guess and hope that its transformed into a great program

[Hellfighter]

most hackers like to get a boner on getting pass big name anti-virus mfg, but get Avast! (avast.com) it do a boot scan and so much more without hogging your system down any.

i use it and have it going in the back ground as the game play, no screen lag at all.

norton is to buggy for me, mostly hate the scrip blocking bet it make errors

[SilentTrigger]

If its the one im thinking of I tried it on my other computer, nots not bad but its not something i jump up and down about. It was decent, felt unsecure however.

[Scott]

I herd Kaspersky and NOD32 were very good.. ATM i am using McAfee enterprize cause it's pretty good and very low on resources.. next time I reinstall im going to try Kaspersky.

Nortons was always to bulky for me.. The one time I did get a virus with nortons installed, norton just 'warned' me that I had one, it didn't stop anything from happening. Also since nortons could not remove it (file in use, duh) I had to manually remove it..

[SilentTrigger]

Any link to this Kaspersky?

[Scott]

http://www.kaspersky.com/