AV-Comparatives AV-Comparatives Real World Protection Test - Feburary - May 2019

[TairikuOkami]

I love this, it is just a picture.

 

[Andy Ful]

AFAIK the malicious file type would be document_bill.docx.exe
If you did not enable "show file name extensions" you will see only document_bill.docx and that looks safe.
But even if it is truly document_bill.docx it is still dangerous because it might be a weaponized doc.

It is easy to fool most people by using another trick:

document_bill.docx                                                       .exe

The .exe is not visible when there are many spaces between.

Edit.
The cautious user can recognize the trick because in the "Type" column in Windows Explorer the file will be still visible as an application.

 

[shmu26]

But this thing about scripts silently downloading and attacking your computer -- that's scare stories from the sandbox fanboys, or maybe it's propaganda from some company trying to sell you something.

I want to qualify this claim a little bit. I read today that both Chrome and Firefox had an actively exploited zero-day this year. In the case of Firefox, it was in fact capable of remote code execution on Windows 7 32 bit, due to a vulnerability in that OS which was not patched at the time.
However, all the vulnerabilities were subsequently patched, and were observed only in targeted attacks. So it is still safe to say that random surfing does not put the average user at a risk of infection.

Regular AV protection is not the best way to defend against attacks of these types. The advanced security solutions are better equipped for that.

But anyways, in real-life terms, it's not a threat. Today's attacks are more and more targeted. If a malcoder worked for months and discovered a million-dollar zero-day exploit, you can be sure he won't waste it on you.

 

[blackice]

I want to backtrack on this claim a little bit. I read today that both Chrome and Firefox had an actively exploited zero-day this year. In the case of Firefox, it was in fact capable of remote code execution on Windows 7 32 bit, due to a vulnerability in that OS which was not patched at the time.
However, all the vulnerabilities were subsequently patched, and were observed only in targeted attacks. So it is still safe to say that random surfing does not put the average user at a risk of infection.

Regular AV protection is not the best way to defend against attacks of these types. The advanced security solutions are better equipped for that. But anyways, in real-life terms, it's not a threat.

After reading your comment yesterday I proceeded to have a dream last night that I got ransomware from a drive by download. Woke up and my system is clean. Though not impossible drive by dls are rare. I’ve been reading too many stories.

 

[Dave Russo]

Eset is still a very good choice,just add voodoshield, with Eset"s low impact and nice firewall plus tweaks its very strong,There are very few of us here at MalwareTips,who do not add layers to our security,the only thing I do not recommend is buying a license from Eset, do to cost{you get the exact same product on e-bay for so much less}A good survey one day would be ,who uses a Internet security program only? I would bet on this site less than10 percent. gl all

 

[shmu26]

Eset is still a very good choice,just add voodoshield, with Eset"s low impact and nice firewall plus tweaks its very strong,There are very few of us here at MalwareTips,who do not add layers to our security,the only thing I do not recommend is buying a license from Eset, do to cost{you get the exact same product on e-bay for so much less}A good survey one day would be ,who uses a Internet security program only? I would bet on this site less than10 percent. gl all

What in particular do you like about the ESET firewall? Wondering whether it's better than Windows firewall with SysHardener tweaks.

 

[Dave Russo]

What in particular do you like about the ESET firewall? Wondering whether it's better than Windows firewall with SysHardener tweaks.

Forgive me I am no expert,But Eset is one of the only program who"s firewall passes the cursed Fortiguard test {The Test - Test Your Metal by Fortinet } and I like the easy to use options.Windows firewall fails,Kaspersky"s firewall fails,but once again the test may be misleading, so I am only giving a opinion and not a expert gl.

 

[Andrew3000]

Forgive me I am no expert,But Eset is one of the only program who"s firewall passes the cursed Fortiguard test {The Test - Test Your Metal by Fortinet } and I like the easy to use options.Windows firewall fails,Kaspersky"s firewall fails,but once again the test may be misleading, so I am only giving a opinion and not a expert gl.

With kaspersky endpoint fails because it directly blocks the script used for the test, it seems.

Spoiler

 

[marcopaone]

As always Kaspersky and Norton are TOP

 

[Wraith]

ESET Firewall is one of the best.It offers protection like the corporate firewalls and there are a ton of settings you can use. The FW can stop the common exploits. The Windows Firewall is a good no nonsense firewall which can be customised with tweaks and the outbound connections can be controlled with the help of 3rd party apps. Has Windows 10 increased the Firewall self-protection? In Windows 7, it's extremely easy to disable the inbuilt firewall and it's one of the first things a malware does. Another firewall that I like is the Norton Firewall. It's extremely smart and has the ability to protect against exploits.

 

[harlan4096]

Forgive me I am no expert,But Eset is one of the only program who"s firewall passes the cursed Fortiguard test {The Test - Test Your Metal by Fortinet } and I like the easy to use options.Windows firewall fails,Kaspersky"s firewall fails,but once again the test may be misleading, so I am only giving a opinion and not a expert gl.

This test was already discussed here in the forum about 1 year ago or even more... Kaspersky fails most of the tests because the size of the files are bigger than 1MB, once You download manually and scan it detects all:

Web Anti-Virus settings

help.kaspersky.com

​

Update: in the past there was an option to tweak that size, I can't remember now if still in KES

 

[Andrew3000]

This test was already discussed here in the forum about 1 year ago or even more... Kaspersky fails most of the tests because the size of the files are bigger than 1MB, once You download manually and scan it detects all:

Web Anti-Virus settings

help.kaspersky.com

View attachment 215264
​

Update: in the past there was an option to tweak that size, I can't remember now if still in KES

Nope

 

[harlan4096]

And this is not a test for firewall but for Web filtering...

 

[TairikuOkami]

Are you sure your internet is configured correctly?

Since it has blocked even running the test, I guess so. I disabled firewall, cleanbrowsingDNS, all addons and it still fails. Maybe Yandex at work.

 

[Dave Russo]

of the test When I tested Kaspersky, used on wifes machine Kaspersky Total security. I do not know if Firewall is different on Endpoint,but if indeed its blocking the test then that would count as a pass ,but how can someone tell? When I tried symantec endpoint ,it showed one green pass, an then
it blocked the rest of the test. But KTS did finish the test with only1 out of 18 passed

 

[harlan4096]

I've already point the reason, 1st test is uncompressed, the rest are all compressed files with sizes greater than 1MB.

The firewall module has nothing to do here but Web AV module.

 

[simmerskool]

... passes the cursed Fortiguard test {The Test - Test Your Metal by Fortinet }

my first time at the fortiguard test. I have a few layers here and ?? what is this test supposed to do or be doing?? appears as if nothing is happening? I see 0/18 as if I failed all tests yet, it also appears as if it never ran at all. no screenshots, no compressed files. all I see on the webpage is "Loading..." and nothing appears to be loading. Am I supposed to defang my security to run their security test? I'll skip it then, or am I missing the point? /sk

Since it has blocked even running the test, .

me too +1 but not by yandex here.
edit: you got 1 red mark on the otherwise grey circle, not one thing changed here??

 

[DDE_Server]

why Emsisoft does not exist ??

 

[oldschool]

why Emsisoft does not exist ??

They choose not to participate in testing.

 

[DDE_Server]

They choose not to participate in testing.

Do you have any idea about the reason behind that decision ??
i know that gave up AV Test but trusted in AV comparative