TrendMicro Maximum Security 17 - September 2021 Report

[harlan4096]

Trend Micro Maximum Security 17 - September Report 2021

Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use.

__

System Status Abbreviations:

P: Protected
NC: Not Clean
I: Infected
E: Encrypted
* : Partially Blocked

Second Opinion Scanners Status Abbreviations:

C: Clean
I: Infected

Additional Abbreviations:

WV: WiseVector StopX
HMP: HitManPro
NPE: Norton Power Eraser
KVRT: Kaspersky Virus Removal Tool

BSR: Before System Reboot
ASR: After System Reboot

September 2021​	Samples Pack​	Static Detection​	Dynamic Detection​	Total Detection​	System Files Encrypted​	2nd Opinion Scanners​	System Final Status​	Thread Link​
08/09/2021​	2​	0 / 2​	1 + 1* / 2​	1 + 1* / 2​	No​	C: HMP I: WV NPE​	BSR: I ASR: I​	Post#3​
14/09/2021​	2​	0 / 2​	0 / 2​	0 / 2​	No​	I​	BSR: I ASR: I​	Post#3​
15/09/2021​	5​	1 / 5​	2 / 4​	3 / 5​	No​	C: HMP I: WV NPE KVRT​	BSR: I ASR: I​	Post#2​
18/09/2021​	2​	1 / 2​	1* / 1​	1 + 1* / 2​	No​	C: WV HMP KVRT I: NPE ​	BSR: I ASR: I​	Post#3​
21/09/2021​	4​	1 / 4​	1 / 3​	2 / 4​	No​	C: WV HMP KVRT I: NPE​	BSR: I ASR: NC​	Post#2​
26/09/2021​	2​	1 / 2​	0 / 1​	1 / 2​	No​	C: WV HMP NPE ​	P​	Post#4​
30/09/2021​	3​	0 / 3​	2 + 1* / 3​	2 + 1* / 3​	No​	C: HMP I: WV NPE KVRT​	BSR: I ASR: I​	Post#2​
/09/2021​	-​	/​	/​	/​	No Yes​	C: WV HMP NPE KVRT I: WV HMP NPE KVRT​	P NC I​	Post#​
/09/2021​	-​	/​	/​	/​	No Yes​	C: WV HMP NPE KVRT I: WV HMP NPE KVRT​	P NC I​	Post#​
/09/2021​	-​	/​	/​	/​	No Yes​	C: WV HMP NPE KVRT I: WV HMP NPE KVRT​	P NC I​	Post#​

 

[upnorth]

Nice choice @harlan4096 and looking forward to the results.

 

[upnorth]

It's a few days left on this test with TM, but I must say I'm surprised to see how much it struggles. On the other hand maybe not a surprise if one considering the issue with submitting undetected samples, as @harlan4096 also mention here:

Advice Request - How do you submit False Positive samples to McAfee effectively?

Hi, I’ve been using McAfee recently and I encountered some False Positive issues. Actually, I am not surprised that McAfee has a relatively high FP rate, but what surprises me most is how hard it is to let McAfee to rectify these FP problems. I followed their False Positive submission...

malwaretips.com

@harlan4096 , I did a small search and found two possible solutions for submitting samples to TM that you might wanna try. I'll send those internal and if it works you can always share it here.

 

[Nightwalker]

I am not surprised to see those below average results from Trend Micro, it is a okayish solution in the enterprise market and a pretty bad one in the consumer segment.

Trend Micro's detection rate is supported almost entirely by cloud-generated auto-detections, aka "detect everything certain industry names detect", which generates a ridiculous false positive rate.

This situation will not change, hiring laboratory analysts (woodpeckers) are expensive, but mediocre automated cloud detections? Not so much in the long term ...

The most important thing to demonstrate the quality of an antivirus solution is the quality of its "traditional" signatures and as the post above shows, Trend Micro doesn't care.

Not only that, considering how archaic the Trend Micro product code is and their glacial development cycle (numerous vulnerabilities over the years), I just can't understand why anyone would use their products by choice.

 

[Nightwater]

I am not surprised to see those below average results from Trend Micro, it is a okayish solution in the enterprise market and a pretty bad one in the consumer segment.

Trend Micro's detection rate is supported almost entirely by cloud-generated auto-detections, aka "detect everything certain industry names detect", which generates a ridiculous false positive rate.

This situation will not change, hiring laboratory analysts (woodpeckers) are expensive, but mediocre automated cloud detections? Not so much in the long term ...

The most important thing to demonstrate the quality of an antivirus solution is the quality of its "traditional" signatures and as the post above shows, Trend Micro doesn't care.

Not only that, considering how archaic the Trend Micro product code is and their glacial development cycle (numerous vulnerabilities over the years), I just can't understand why anyone would use their products by choice.

Hahaha, you're funny, people use it because it has good protection, everyone chooses what they want, I don't know why you hate the Trend so much, if you don't like it, keep quiet, there are people who like it, the same way people use that crap Chinese and comodo, I would never use, but I respect who uses, you should do the same, this is getting boring. update yourself!

* Another thing, the samples here from Hud would rarely reach the average user, the normal samples that reach the average user Trend Micro will block (av test, av comparatives), these samples here don't simulate the real life of an common/average user, keep that in mind.

 

[SpiderWeb]

Great table to keep track of everything! Keep us updated pls.

 

[Kongo]

Hahaha, you're funny, people use it because it has good protection, everyone chooses what they want, I don't know why you hate the Trend so much, if you don't like it, keep quiet, there are people who like it, the same way people use that crap Chinese and comodo, I would never use, but I respect who uses, you should do the same, this is getting boring. update yourself!

* Another thing, the samples here from Hud would rarely reach the average user, the normal samples that reach the average user Trend Micro will block (av test, av comparatives), these samples here don't simulate the real life of an common/average user, keep that in mind.

Criticizing him for "hating" on Trend Micro while you are calling Comodo and chinese software crap?

 

[upnorth]

* Another thing, the samples here from Hud would rarely reach the average user, the normal samples that reach the average user Trend Micro will block (av test, av comparatives), these samples here don't simulate the real life of an common/average user, keep that in mind.

Yes, and no. Let me try explain as this particular part sadly always been a huge misconception as it gets very obvious that people tends to forget, what the actual main purpose of the Malware Hub is. It's about testing AVs ( Anti-Virus ) software after a specific pre-set amount of staff decided rules and tools that also works as much as possible for the members of the Hub and their respective time-zone and spare/free-time. There is no secret and never been one in exactly how, the Hub in the end test the samples. That's even posted and shared in all the supplied screenshots. Again, the Hub plain and basic concentrate on test AVs, and not browsers, email clients etc.

Something else that can't be repeated enough is, Time! It's one of the most important key factors when testing malware. Much much more important then many realize and understand. Trace and investigate that specific part with testing labs and in their reports, is very different from how it's possible in the Hub. The more fresh a sample is, and the sooner a test is done and completed, the bigger chance is that the specific sample is still enough alive and kicking and actually would show what it can do, if an AV would not be able to block/kill and protect the system. For AVs in the Hub, it's many time a very brutal and painful experience, but that's also another reason for the Hub as we genuine try to help vendors and always submit those samples so the vendors can hopefully improve.

 

[harlan4096]

I recall last time I tested TM (last year) it got better results

 

[upnorth]

I recall last time I tested TM (last year) it got better results

Malware Hub Report - TrendMicro IS - July 2020 Report

TrendMicro IS - July 2020 Report Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use. __ C: Clean / P: Protected / P - NC...

malwaretips.com

 

[silversurfer]

* Another thing, the samples here from Hud would rarely reach the average user, the normal samples that reach the average user Trend Micro will block (av test, av comparatives), these samples here don't simulate the real life of an common/average user, keep that in mind.

From the point of view like protection effectiveness offered by AV vendors, that really doesn't matter how prevalent are malware samples. Any very good AV (what promises almost 100% protection for users) should be able to block attacks by malware as much as possible, so here the Malware-Hub with more fresh samples or rarely unknown malware variants also shows what AV performs better overall compared to other AVs. Finally, users can check for test-results and comparing with the last year...

 

[gery79]

although i have liked Trend a lot in the past and almost always bought licenses very often i=something kept me from using it as my main antivirus. the lack of fw and the reputation it had now and then....maybe it is the color that keeps me liking it...who knows