AVLab.pl Advanced In-The-Wild Malware Test - September 2025

Disclaimer
  1. This test shows how an antivirus behaves with certain threats, in a specific environment and under certain conditions.
    We encourage you to compare these results with others and take informed decisions on what security products to use.
    Before buying an antivirus you should consider factors such as price, ease of use, compatibility, and support. Installing a free trial version allows an antivirus to be tested in everyday use before purchase.

Then it should be easy.

Saying "Do your research" is not offensive or hostile. You expect your undergraduate and/or graduate students to do their research - or - no? You certainly expect them to study, or AIW? People learn by doing.

With the topic that we're discussing, we could have a 250+ page thread and would probably only cover the basics.


No thanks, not interested in creating a dialogue with you.
 
Ad hominem and other distracting attacks add nothing usefull to the discussion.

I put you and your alter ego on the ignore list.
Best thing I ever did myself.
Ad hominem and other distracting attacks add nothing usefull to the discussion.

I put you and your alter ego on the ignore list.
You're not alone; many have followed suit. I get no value from their posts. There are many more respectable members for learning here. Just do what I do and quit responding; don't play that game.
 
Yes, Back on topic, I'm interested as to why Avast had a longer remediation time compared to Norton when I thought the new Norton was Avast under the hood? or am I wrong?
It's not quite as you say. Full consolidation of the technology has not yet in both software taken place, although similar things can be seen. In reality, apart from the visual aspect, these solutions are still different in technical terms.
 
Best thing I ever did myself.

You're not alone; many have followed suit. I get no value from their posts. There are many more respectable members for learning here. Just do what I do and quit responding; don't play that game.
Yes feed the trolls and coddle them. Because your such a saint as well. I do not care if the whole lot of you put me on ignore since you keep reinforcing this behavior of attacking others as if it's ok to cyber bully in a cyber security forum 🙄

Over it all

P.s I've gotten nothing from your supposed contributions ever here just these type posts. At least I post useful information on the board.
 
Last edited by a moderator:
It's not quite as you say. Full consolidation of the technology has not yet in both software taken place, although similar things can be seen. In reality, apart from the visual aspect, these solutions are still different in technical terms.
They are not very different, the difference is in the UI/UX and Norton is being pushed as slightly more premium product.

As such, Norton retains some patents and technology (File Insight, Backup and so on) which have not been transferred to Avast. Not yet. Gen wants to show that Norton is a “different product” to justify paying for Norton and not using the free Avast instead.

But the differences are minimal, the core engines are all the same.

The only product that still maintains some identity is Avira.
Though it has been reported that some Avast engines are being integrated in latest beta.

It’s only a matter of time (and one financial crisis which for now doesn’t look like it’s on the horizon) for the companies to merge it all, as it happened previously with PCTools and other companies acquired by Symantec.
 
They are not very different, the difference is in the UI/UX and Norton is being pushed as slightly more premium product.

As such, Norton retains some patents and technology (File Insight, Backup and so on) which have not been transferred to Avast. Not yet.

But the differences are minimal, the core engines are all the same.

The only product that still maintains some identity is Avira.
Though it has been reported that some Avast engines are being integrated in latest beta.

It’s only a matter of time (and one financial crisis which for now doesn’t look like it’s on the horizon) for the companies to merge it all, as it happened previously with PCTools and other companies acquired by Symantec.
unfortunately norton is not as good as symantec.
Norton despite topping many lab tests still failed against MSHTA malware delivering ACR stealer as reported by a reddit user. Persistence was established despite Norton trying to remove scheduled task.

I talked to the person and he confirmed it was Norton.

1765538711733.png
 
unfortunately norton is not as good as symantec.
Norton despite topping many lab tests still failed against MSHTA malwarw delivering ACR stealer as reported by a reddit user. Persistence was established despite Norton trying to remove scheduled task.

I talked to the person and he confirmed it was Norton.

View attachment 293682

SEP detected and stopped it?
 
unfortunately norton is not as good as symantec.
Norton despite topping many lab tests still failed against MSHTA malwarw delivering ACR stealer as reported by a reddit user. Persistence was established despite Norton trying to remove scheduled task.

I talked to the person and he confirmed it was Norton.

View attachment 293682

Symantec engines (SDS, SONAR, IPS and so on) weren’t perfect either and scheduled tasks were always the Norton Achilles heel.

Norton in general (and Symantec engines as well) offer very good and deep remediation. Symantec relies on engine called ERASER (enhanced remediation and side effects repair) whilst Avast relies on the IDP which collects extensive data even if you turn all protections off.

But remediation is still not perfect.

I’ve seen worse though.
 
The Narrative

Top performers clustered tightly between 98.65% and 98.87%.

The Reality

The numerical difference between the top-ranked product and the second-ranked products is a narrow 0.22 percentage points. The formal methodology confirms that scores in this range can sometimes be statistically insignificant, which is why the 2026 certification threshold is being raised.

Was it superior remediation speed or post-execution blocking?
 
I did not test it this exact payload but in general terms SEP will do better against Amatera aka ACR 2.0 stealer
Maybe against this particular malware it could do better, but against certain types of malware it will definitely do worse.

For example Avast Web Shield automatically initiates remediation when a process connects to a malicious host. Symantec IPS would block the traffic again and again but the root cause won’t be taken care of.

Speaking of IPS and Web Shield, the Web Shield is somewhat superior. IPS requires signatures which Symantec in a video claimed are relatively quick to write. But they are nevertheless signatures.

The Avast Web Shield automatically reports everything to Avast, they extract IoCs through static and dynamic analysis, correlation, crawling and so on.
The Avast Web Shield blocks more threats than IPS targeting home users. It can be layered with IPS on a router level so users would have both.
 
I can see Norton successfully detected it using file insight.

I wonder if file insight is dependent on Symantec or Avast telemetry and algorithm.
It’s the Norton algorithm that takes into account file age, prevalence, signature and so on. The data now doesn’t come from Broadcom but it comes from the Avast collection.