Reply to thread

Message

<blockquote data-quote="Anthony Qian" data-source="post: 1011707" data-attributes="member: 91446">Very interesting results.Some products (McAfee and Avira) perform well in AV-C&#039;s malware protection test but very poorly in this APT test. Some product (ESET) fails to get a 3-star certificate in malware protection tests, but turns out to be the best product in this APT test. Other products (Kaspersky and Bitdefender) generally perform well in both regular malware protection tests and this APT test. Anybody know why?My thoughts on this seemingly irrational results:According to my observation, some products like McAfee and Avira are continuously monitoring new samples uploaded to VirusTotal and immidiately block the samples that are not detected by themselves but detected by other trusted vendors. This strategy works out well in AV-C&#039;s malware protection tests as most samples may have been uploaded to VirusTotal. But it didn&#039;t work out well in the APT test which is focused on fileless attack. Perhaps, something like this APT test can best indicate a product&#039;s true ability to block malware.</blockquote>

[QUOTE="Anthony Qian, post: 1011707, member: 91446"] Very interesting results. Some products (McAfee and Avira) perform well in AV-C's malware protection test but very poorly in this APT test. Some product (ESET) fails to get a 3-star certificate in malware protection tests, but turns out to be the best product in this APT test. Other products (Kaspersky and Bitdefender) generally perform well in both regular malware protection tests and this APT test. Anybody know why? My thoughts on this seemingly irrational results: According to my observation, some products like McAfee and Avira are continuously monitoring new samples uploaded to VirusTotal and immidiately block the samples that are not detected by themselves but detected by other trusted vendors. This strategy works out well in AV-C's malware protection tests as most samples may have been uploaded to VirusTotal. But it didn't work out well in the APT test which is focused on [B]fileless [/B]attack. Perhaps, something like this APT test can best indicate a product's true ability to block malware. [/QUOTE]

Verification